o
    j[                     @   s  d dl T d ZdZdZdZdZdZdZdZd	Z	d
Z
dZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZeZd Z dZ!dZ"G dd  d e#Z$G d!d" d"e%Z&d#d$ Z'G d%d& d&e(Z)e*e)Z+d'd( Z,d)d* Z-d+d, Z.dXd.d/Z/d0d1 Z0d2d3 Z1d4d5 Z2d6d7 Z3d8d9 Z4G d:d; d;e(Z5e*e5Z6e7Z8e8Z9d<Z:dZ;dZ<dZ=d-Z>d Z?dZ@d=ZAdZBd>ZCd?ZDd@ZEdZFe>e<B ZGe?e<B e=B ZHe@e<B ZIeAe;B e<B ZJeBe<B ZKeCe;B e<B ZLeDe;B e<B ZMeEe<B ZNd ZOdZPdZQG dAdB dBe(ZRe*eRZSG dCdD dDe(ZTe*eTZUG dEdF dFe(ZVe*eVZWG dGdH dHe(ZXe*eXZYG dIdJ dJe(ZZe*eZZ[efdKdLZ\d-efdMdNZ]d-deeB efdOdPZ^dQdR Z_dSdT Z`dUdV ZadWS )Y   )*                @         i   i      i    i @  i   i   i   i   i   i   i    i  @ i    l        i   i   i   i   i   i  c                   @   s^   e Zd ZdZeZdd Zedd Ze	dd Z
edd	 Zed
d Zdd ZdddZdS )UserModeHandleab  
	Base class for non-kernel handles. Generally this means they are closed
	by special Win32 API functions instead of CloseHandle() and some standard
	operations (synchronizing, duplicating, inheritance) are not supported.
	@type _TYPE: C type
	@cvar _TYPE: C type to translate this handle to.
		Subclasses should override this.
		Defaults to L{HANDLE}.
	c                 C      t  NNotImplementedErrorself r   /root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/pypykatz/commons/winapi/local/function_defs/kernel32.py_closeU      zUserModeHandle._closec                 C   s   |  | jS r   )_TYPEvaluer   r   r   r   _as_parameter_Y      zUserModeHandle._as_parameter_c                 C   s   t t jS r   )r   r   r   )r   r   r   r   
from_param^   r   zUserModeHandle.from_paramc                 C      dS NFr   r   r   r   r   inheritc      zUserModeHandle.inheritc                 C   r   r   r   r   r   r   r   protectFromCloseh   r   zUserModeHandle.protectFromClosec                 C   r   r   r   r   r   r   r   dupm   r   zUserModeHandle.dupNc                 C   r   r   r   )r   dwMillisecondsr   r   r   waitq   r   zUserModeHandle.waitr   )__name__
__module____qualname____doc__HANDLEr   r   propertyr   staticmethodr   r   r    r!   r#   r   r   r   r   r   F   s    



r   c                   @   s   e Zd ZdZeeB eB eB eB e	B Z
eeB eB e	B Zee	B ZeeB eB eB ZeeB Zd!ddZdd Zdd Zd	d
 Zdd Zdd Zdd Zdd Zdd Zdd Zdd Zdd Zdd Zdd Zdd  ZdS )"MemoryBasicInformationz<
	Memory information object returned by L{VirtualQueryEx}.
	Nc                 C   s   |du rd| _ d| _d| _d| _d| _d| _d| _dS |j | _ |j| _|j| _|j| _|j| _|j| _|j| _t|dr@|j| _t|drK|j	| _dS dS )z
		@type  mbi: L{MEMORY_BASIC_INFORMATION} or L{MemoryBasicInformation}
		@param mbi: Either a L{MEMORY_BASIC_INFORMATION} structure or another
			L{MemoryBasicInformation} instance.
		Ncontentfilename)
BaseAddressAllocationBaseAllocationProtect
RegionSizeStateProtectTypehasattrr,   r-   )r   mbir   r   r   __init__   s(   


zMemoryBasicInformation.__init__c                 C   s"   | j |  ko| j | j k S   S )z
		Test if the given memory address falls within this memory region.
		@type  address: int
		@param address: Memory address to test.
		@rtype:  bool
		@return: C{True} if the given memory address falls within this memory
			region, C{False} otherwise.
		)r.   r1   )r   addressr   r   r   __contains__   s   "	z#MemoryBasicInformation.__contains__c                 C   
   | j tkS )zL
		@rtype:  bool
		@return: C{True} if the memory in this region is free.
		)r2   MEM_FREEr   r   r   r   is_free      
zMemoryBasicInformation.is_freec                 C   r:   )zP
		@rtype:  bool
		@return: C{True} if the memory in this region is reserved.
		)r2   MEM_RESERVEr   r   r   r   is_reserved   r=   z"MemoryBasicInformation.is_reservedc                 C   r:   )zP
		@rtype:  bool
		@return: C{True} if the memory in this region is commited.
		)r2   
MEM_COMMITr   r   r   r   is_commited   r=   z"MemoryBasicInformation.is_commitedc                 C   r:   )zf
		@rtype:  bool
		@return: C{True} if the memory in this region belongs to an executable
			image.
		)r4   	MEM_IMAGEr   r   r   r   is_image   s   
zMemoryBasicInformation.is_imagec                 C   r:   )z]
		@rtype:  bool
		@return: C{True} if the memory in this region belongs to a mapped file.
		)r4   
MEM_MAPPEDr   r   r   r   	is_mapped   r=   z MemoryBasicInformation.is_mappedc                 C   r:   )zO
		@rtype:  bool
		@return: C{True} if the memory in this region is private.
		)r4   MEM_PRIVATEr   r   r   r   
is_private   r=   z!MemoryBasicInformation.is_privatec                 C   s   |   o
t| jt@ S )zS
		@rtype:  bool
		@return: C{True} if all pages in this region are guard pages.
		)rA   boolr3   
PAGE_GUARDr   r   r   r   is_guard   s   zMemoryBasicInformation.is_guardc                 C   s   |   ot| jttB @  S )zW
		@rtype:  bool
		@return: C{True} if the memory in this region has any data in it.
		)rA   rH   r3   rI   PAGE_NOACCESSr   r   r   r   has_content   s   z"MemoryBasicInformation.has_contentc                 C      |   ot| j| j@ S )zP
		@rtype:  bool
		@return: C{True} if all pages in this region are readable.
		)rL   rH   r3   READABLEr   r   r   r   is_readable      z"MemoryBasicInformation.is_readablec                 C   rM   )zQ
		@rtype:  bool
		@return: C{True} if all pages in this region are writeable.
		)rL   rH   r3   	WRITEABLEr   r   r   r   is_writeable  rP   z#MemoryBasicInformation.is_writeablec                 C   rM   )a   
		@rtype:  bool
		@return: C{True} if all pages in this region are marked as
			copy-on-write. This means the pages are writeable, but changes
			are not propagated to disk.
		@note:
			Tipically data sections in executable images are marked like this.
		)rL   rH   r3   COPY_ON_WRITEr   r   r   r   is_copy_on_write  s   	z'MemoryBasicInformation.is_copy_on_writec                 C   rM   )z
		@rtype:  bool
		@return: C{True} if all pages in this region are executable.
		@note: Executable pages are always readable.
		)rL   rH   r3   
EXECUTABLEr   r   r   r   is_executable  s   z$MemoryBasicInformation.is_executablec                 C   rM   )z
		@rtype:  bool
		@return: C{True} if all pages in this region are executable and
			writeable.
		@note: The presence of such pages make memory corruption
			vulnerabilities much easier to exploit.
		)rL   rH   r3   EXECUTABLE_AND_WRITEABLEr   r   r   r   is_executable_and_writeable  s   z2MemoryBasicInformation.is_executable_and_writeabler   )r$   r%   r&   r'   PAGE_EXECUTE_READPAGE_EXECUTE_READWRITEPAGE_EXECUTE_WRITECOPYPAGE_READONLYPAGE_READWRITEPAGE_WRITECOPYrN   rQ   rS   PAGE_EXECUTErU   rW   r7   r9   r<   r?   rA   rC   rE   rG   rJ   rL   rO   rR   rT   rV   rX   r   r   r   r   r+   u   sj    

r+   c                  C      t jj} g | _t| _|  S r   )windllkernel32GetLastErrorargtypesDWORDrestype)_GetLastErrorr   r   r   rc   *     rc   c                   @   s:   e Zd ZdefdefdefdefdefdefdefgZdS )	MEMORY_BASIC_INFORMATIONr.   r/   r0   r1   r2   r3   r4   N)r$   r%   r&   SIZE_Tre   _fields_r   r   r   r   ri   9  s    ri   c                 C   s<   t | dr
|   ntjj}tg|_t|_t	|_
||  d S )Nclose)r5   rl   ra   rb   CloseHandler(   rd   rH   rf   RaiseIfZeroerrcheck)hHandle_CloseHandler   r   r   rm   I  s   

rm   c                  C   r`   r   )ra   rb   GetCurrentProcessIdrd   re   rf   )_GetCurrentProcessIdr   r   r   rr   V  rh   rr   c                  C   r`   r   )ra   rb   GetCurrentProcessrd   r(   rf   )_GetCurrentProcessr   r   r   rt   ]  s   rt       c                 C   s   t jj}ttttg|_t|_	t
}	 t|}td|jd }|| ||t|}|r8d|j  k r7|k r8	 |jS  t }|tkrDt||d }|dkrQt|q)Nr    rv   r
   r   )ra   rb   QueryFullProcessImageNameWr(   re   LPWSTRPDWORDrd   rH   rf   MAX_PATHctypescreate_unicode_bufferr   byrefrc   ERROR_INSUFFICIENT_BUFFERWinError)hProcessdwFlags_QueryFullProcessImageNameWdwSizelpdwSize	lpExeNamesuccesserrorr   r   r   rx   j  s&   	

rx   c                 C   s>   t jj}tttg|_t|_|| t||}|t	krt
 |S r   )ra   rb   OpenProcessre   BOOLrd   r(   rf   rH   NULLr|   r   )dwDesiredAccessbInheritHandledwProcessId_OpenProcessr   r   r   r   r     s   r   c                 C   sn   t jj}ttttttg|_t|_	t
|}td}|| |||t|}|s/t tkr/t
 |jd |j S Nrv   )ra   rb   ReadProcessMemoryr(   LPVOIDrj   POINTERrd   rH   rf   r|   create_string_bufferr~   rc   ERROR_PARTIAL_COPYr   rawr   )r   lpBaseAddressnSize_ReadProcessMemorylpBufferlpNumberOfBytesReadr   r   r   r   r     s   
r   c                 C   sl   t jj}ttttttg|_t|_	t
|}t|}td}|| |||t|}|s3t tkr3t |jS r   )ra   rb   WriteProcessMemoryr(   r   rj   r   rd   rH   rf   lenr|   r   r~   rc   r   r   r   )r   r   r   _WriteProcessMemoryr   lpNumberOfBytesWrittenr   r   r   r   r     s   
r   c                 C   sT   t jj}ttttg|_t|_t	 }t
t	}|| |t||}|dkr&t t|S r   )ra   rb   VirtualQueryExr(   r   PMEMORY_BASIC_INFORMATIONrj   rd   rf   ri   sizeofr~   r|   r   r+   )r   	lpAddress_VirtualQueryExr   dwLengthr   r   r   r   r     s   r   c                 C   s6   t jj}tg|_t|_|| }|tkrt  d S d S r   )	ra   rb   	LocalFreeHLOCALrd   rf   r   r|   r   )hMem
_LocalFreeresultr   r   r   r     s   r   c                   @   s"   e Zd ZdefdefdefgZdS )SECURITY_ATTRIBUTESnLengthlpSecurityDescriptorr   N)r$   r%   r&   re   r   r   rk   r   r   r   r   r     s
    r   i              c                   @   s(   e Zd ZdefdefdefdefgZdS )PROCESS_INFORMATIONr   hThreadr   
dwThreadIdN)r$   r%   r&   r(   re   rk   r   r   r   r   r     s    r   c                   @   |   e Zd Zdefdefdefdefdefdefdefdefd	efd
efdefdefdefdefdefdefdefdefgZdS )STARTUPINFOcb
lpReserved	lpDesktoplpTitledwXdwYdwXSizedwYSizedwXCountCharsdwYCountCharsdwFillAttributer   wShowWindowcbReserved2lpReserved2	hStdInput
hStdOutput	hStdErrorN)	r$   r%   r&   re   LPSTRWORDr   r(   rk   r   r   r   r   r   /  (    r   c                   @      e Zd ZdefdefgZdS )STARTUPINFOEXStartupInfolpAttributeListN)r$   r%   r&   r   PPROC_THREAD_ATTRIBUTE_LISTrk   r   r   r   r   r   J      r   c                   @   r   )STARTUPINFOWr   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   N)	r$   r%   r&   re   ry   r   r   r(   rk   r   r   r   r   r   Q  r   r   c                   @   r   )STARTUPINFOEXWr   r   N)r$   r%   r&   r   r   rk   r   r   r   r   r   h  r   r   c                 C   sF   t jj}tttttg|_t	|_
t|_td}|| |||t| |jS r   )ra   rb   VirtualProtectExr(   r   rj   re   rz   rd   rH   rf   rn   ro   r~   r   )r   r   r   flNewProtect_VirtualProtectExflOldProtectr   r   r   r   x  s   r   c                 C   s4   t jj}ttttg|_t|_	t
|_|| ||| d S r   )ra   rb   VirtualFreeExr(   r   rj   re   rd   rH   rf   rn   ro   )r   r   r   
dwFreeType_VirtualFreeExr   r   r   r     s
   r   c                 C   sB   t jj}tttttg|_t|_|| ||||}|t	krt
 |S r   )ra   rb   VirtualAllocExr(   r   rj   re   rd   rf   r   r|   r   )r   r   r   flAllocationType	flProtect_VirtualAllocExr   r   r   r     s   r   c           	   	   C   sj   t jj}tttttttg|_	t|_
|sd }nt|}td}|| |||||t|}|s0t ||jfS r   )ra   rb   CreateRemoteThreadr(   LPSECURITY_ATTRIBUTESrj   r   re   LPDWORDrd   rf   r~   r|   r   r   )	r   lpThreadAttributesdwStackSizelpStartAddresslpParameterdwCreationFlags_CreateRemoteThreadr   r   r   r   r   r     s   
r   c                 C   s   t jj}ttg|_t|_t|tdtdfv r)t|}|jd@ r(t	d|j n't|tdkr:t
|d}nt|tdkrHt
|}nttt||| |S )Nrv   i  zOrdinal number too large: %drw   ascii    )ra   rb   GetProcAddressHMODULEr   rd   rf   typer   
ValueErrorr|   r   encodec_char_p	TypeErrorstr)hModule
lpProcName_GetProcAddressr   r   r   GetProcAddressW  s   


r   c                 C   s2   t jj}tg|_t|_|| }|tkrt	 |S r   )
ra   rb   LoadLibraryWry   rd   r   rf   r   r|   r   )
pszLibrary_LoadLibraryWr   r   r   r   r     s   r   N)rv   )bdefinesrK   r\   r]   r^   r_   rY   rZ   r[   rI   PAGE_NOCACHEPAGE_WRITECOMBINEr@   r>   MEM_DECOMMITMEM_RELEASEr;   rF   rD   	MEM_RESETMEM_TOP_DOWNMEM_WRITE_WATCHMEM_PHYSICALMEM_LARGE_PAGESMEM_4MB_PAGESSEC_FILE	SEC_IMAGESEC_RESERVE
SEC_COMMITSEC_NOCACHESEC_LARGE_PAGESrB   WRITE_WATCH_FLAG_RESETFILE_MAP_ALL_ACCESSPROCESS_DUP_HANDLEr(   r   objectr+   rc   	Structureri   r   r   rm   rr   rt   rx   r   r   r   r   r   r   r   r   r   LPPROC_THREAD_ATTRIBUTE_LISTPROC_THREAD_ATTRIBUTE_NUMBERPROC_THREAD_ATTRIBUTE_THREADPROC_THREAD_ATTRIBUTE_INPUTPROC_THREAD_ATTRIBUTE_ADDITIVE ProcThreadAttributeParentProcess ProcThreadAttributeExtendedFlagsProcThreadAttributeHandleList ProcThreadAttributeGroupAffinity ProcThreadAttributePreferredNode!ProcThreadAttributeIdealProcessorProcThreadAttributeUmsThread#ProcThreadAttributeMitigationPolicyProcThreadAttributeMax$PROC_THREAD_ATTRIBUTE_PARENT_PROCESS$PROC_THREAD_ATTRIBUTE_EXTENDED_FLAGS!PROC_THREAD_ATTRIBUTE_HANDLE_LIST$PROC_THREAD_ATTRIBUTE_GROUP_AFFINITY$PROC_THREAD_ATTRIBUTE_PREFERRED_NODE%PROC_THREAD_ATTRIBUTE_IDEAL_PROCESSOR PROC_THREAD_ATTRIBUTE_UMS_THREAD'PROC_THREAD_ATTRIBUTE_MITIGATION_POLICY-PROCESS_CREATION_MITIGATION_POLICY_DEP_ENABLE7PROCESS_CREATION_MITIGATION_POLICY_DEP_ATL_THUNK_ENABLE/PROCESS_CREATION_MITIGATION_POLICY_SEHOP_ENABLEr   LPPROCESS_INFORMATIONr   LPSTARTUPINFOr   LPSTARTUPINFOEXr   LPSTARTUPINFOWr   LPSTARTUPINFOEXWr   r   r   r   r   r   r   r   r   r   <module>   s   / 6


