o
    jY                     @   s   d dl T dZdZdZdZd ZdZdZdZd	Z	d
Z
dZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZd Z d!Z!dZ"eZ#d Z$d"Z%G d#d$ d$e&Z'G d%d& d&e(Z)d'd( Z*G d)d* d*e+Z,e-e,Z.d+d, Z/d-d. Z0dcd/d0Z1d1d2 Z2d3d4 Z3d5d6 Z4d7d8 Z5d9d: Z6G d;d< d<e+Z7e-e7Z8e9Z:e:Z;d=Z<dZ=dZ>dZ?dZ@d ZAdZBd>ZCdZDd?ZEd@ZFdAZGdZHe@e>B ZIeAe>B e?B ZJeBe>B ZKeCe=B e>B ZLeDe>B ZMeEe=B e>B ZNeFe=B e>B ZOeGe>B ZPd ZQdZRdZSG dBdC dCe+ZTe-eTZUG dDdE dEe+ZVe-eVZWG dFdG dGe+ZXe-eXZYG dHdI dIe+ZZe-eZZ[G dJdK dKe+Z\e-e\Z]G dLdM dMe+Z^G dNdO dOe_j`ZaeadZbeadPZceadZdeadQZeG dRdS dSe+ZfG dTdU dUe+ZgG dVdW dWehZiG dXdY dYe+ZjG dZd[ d[e+ZkG d\d] d]ehZld^d_ Zmenfd`daZodbS )d   )*i  i                      @         i   i      i    i @  i   i   i   i   i   i   i    i  @ i    l        i   i   i   i   i   i  c                   @   s^   e Zd ZdZeZdd Zedd Ze	dd Z
edd	 Zed
d Zdd ZdddZdS )UserModeHandleab  
	Base class for non-kernel handles. Generally this means they are closed
	by special Win32 API functions instead of CloseHandle() and some standard
	operations (synchronizing, duplicating, inheritance) are not supported.
	@type _TYPE: C type
	@cvar _TYPE: C type to translate this handle to.
		Subclasses should override this.
		Defaults to L{HANDLE}.
	c                 C      t  NNotImplementedErrorself r   /root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/pypykatz/commons/readers/local/common/kernel32.py_closeZ      zUserModeHandle._closec                 C   s   |  | jS r   )_TYPEvaluer   r   r   r   _as_parameter_^      zUserModeHandle._as_parameter_c                 C   s   t t jS r   )r   r   r   )r   r   r   r   
from_paramc   r   zUserModeHandle.from_paramc                 C      dS NFr   r   r   r   r   inherith      zUserModeHandle.inheritc                 C   r   r   r   r   r   r   r   protectFromClosem   r!   zUserModeHandle.protectFromClosec                 C   r   r   r   r   r   r   r   dupr   r   zUserModeHandle.dupNc                 C   r   r   r   )r   dwMillisecondsr   r   r   waitv   r   zUserModeHandle.waitr   )__name__
__module____qualname____doc__HANDLEr   r   propertyr   staticmethodr   r    r"   r#   r%   r   r   r   r   r   K   s    



r   c                   @   s   e Zd ZdZeeB eB eB eB e	B Z
eeB eB e	B Zee	B ZeeB eB eB ZeeB Zd!ddZdd Zdd Zd	d
 Zdd Zdd Zdd Zdd Zdd Zdd Zdd Zdd Zdd Zdd Zdd  ZdS )"MemoryBasicInformationz<
	Memory information object returned by L{VirtualQueryEx}.
	Nc                 C   s   |du rd| _ d| _d| _d| _d| _d| _d| _dS |j | _ |j| _|j| _|j| _|j| _|j| _|j| _t|dr@|j| _t|drK|j	| _dS dS )z
		@type  mbi: L{MEMORY_BASIC_INFORMATION} or L{MemoryBasicInformation}
		@param mbi: Either a L{MEMORY_BASIC_INFORMATION} structure or another
			L{MemoryBasicInformation} instance.
		Ncontentfilename)
BaseAddressAllocationBaseAllocationProtect
RegionSizeStateProtectTypehasattrr.   r/   )r   mbir   r   r   __init__   s(   


zMemoryBasicInformation.__init__c                 C   s"   | j |  ko| j | j k S   S )z
		Test if the given memory address falls within this memory region.
		@type  address: int
		@param address: Memory address to test.
		@rtype:  bool
		@return: C{True} if the given memory address falls within this memory
			region, C{False} otherwise.
		)r0   r3   )r   addressr   r   r   __contains__   s   "	z#MemoryBasicInformation.__contains__c                 C   
   | j tkS )zL
		@rtype:  bool
		@return: C{True} if the memory in this region is free.
		)r4   MEM_FREEr   r   r   r   is_free      
zMemoryBasicInformation.is_freec                 C   r<   )zP
		@rtype:  bool
		@return: C{True} if the memory in this region is reserved.
		)r4   MEM_RESERVEr   r   r   r   is_reserved   r?   z"MemoryBasicInformation.is_reservedc                 C   r<   )zP
		@rtype:  bool
		@return: C{True} if the memory in this region is commited.
		)r4   
MEM_COMMITr   r   r   r   is_commited   r?   z"MemoryBasicInformation.is_commitedc                 C   r<   )zf
		@rtype:  bool
		@return: C{True} if the memory in this region belongs to an executable
			image.
		)r6   	MEM_IMAGEr   r   r   r   is_image   s   
zMemoryBasicInformation.is_imagec                 C   r<   )z]
		@rtype:  bool
		@return: C{True} if the memory in this region belongs to a mapped file.
		)r6   
MEM_MAPPEDr   r   r   r   	is_mapped   r?   z MemoryBasicInformation.is_mappedc                 C   r<   )zO
		@rtype:  bool
		@return: C{True} if the memory in this region is private.
		)r6   MEM_PRIVATEr   r   r   r   
is_private   r?   z!MemoryBasicInformation.is_privatec                 C   s   |   o
t| jt@ S )zS
		@rtype:  bool
		@return: C{True} if all pages in this region are guard pages.
		)rC   boolr5   
PAGE_GUARDr   r   r   r   is_guard   s   zMemoryBasicInformation.is_guardc                 C   s   |   ot| jttB @  S )zW
		@rtype:  bool
		@return: C{True} if the memory in this region has any data in it.
		)rC   rJ   r5   rK   PAGE_NOACCESSr   r   r   r   has_content   s   z"MemoryBasicInformation.has_contentc                 C      |   ot| j| j@ S )zP
		@rtype:  bool
		@return: C{True} if all pages in this region are readable.
		)rN   rJ   r5   READABLEr   r   r   r   is_readable     z"MemoryBasicInformation.is_readablec                 C   rO   )zQ
		@rtype:  bool
		@return: C{True} if all pages in this region are writeable.
		)rN   rJ   r5   	WRITEABLEr   r   r   r   is_writeable	  rR   z#MemoryBasicInformation.is_writeablec                 C   rO   )a   
		@rtype:  bool
		@return: C{True} if all pages in this region are marked as
			copy-on-write. This means the pages are writeable, but changes
			are not propagated to disk.
		@note:
			Tipically data sections in executable images are marked like this.
		)rN   rJ   r5   COPY_ON_WRITEr   r   r   r   is_copy_on_write  s   	z'MemoryBasicInformation.is_copy_on_writec                 C   rO   )z
		@rtype:  bool
		@return: C{True} if all pages in this region are executable.
		@note: Executable pages are always readable.
		)rN   rJ   r5   
EXECUTABLEr   r   r   r   is_executable  s   z$MemoryBasicInformation.is_executablec                 C   rO   )z
		@rtype:  bool
		@return: C{True} if all pages in this region are executable and
			writeable.
		@note: The presence of such pages make memory corruption
			vulnerabilities much easier to exploit.
		)rN   rJ   r5   EXECUTABLE_AND_WRITEABLEr   r   r   r   is_executable_and_writeable#  s   z2MemoryBasicInformation.is_executable_and_writeabler   )r&   r'   r(   r)   PAGE_EXECUTE_READPAGE_EXECUTE_READWRITEPAGE_EXECUTE_WRITECOPYPAGE_READONLYPAGE_READWRITEPAGE_WRITECOPYrP   rS   rU   PAGE_EXECUTErW   rY   r9   r;   r>   rA   rC   rE   rG   rI   rL   rN   rQ   rT   rV   rX   rZ   r   r   r   r   r-   z   sj    

r-   c                  C      t jj} g | _t| _|  S r   )windllkernel32GetLastErrorargtypesDWORDrestype)_GetLastErrorr   r   r   re   /     re   c                   @   s:   e Zd ZdefdefdefdefdefdefdefgZdS )	MEMORY_BASIC_INFORMATIONr0   r1   r2   r3   r4   r5   r6   N)r&   r'   r(   SIZE_Trg   _fields_r   r   r   r   rk   >  s    rk   c                 C   s<   t | dr
|   ntjj}tg|_t|_t	|_
||  d S )Nclose)r7   rn   rc   rd   CloseHandler*   rf   rJ   rh   RaiseIfZeroerrcheck)hHandle_CloseHandler   r   r   ro   N  s   

ro   c                  C   rb   r   )rc   rd   GetCurrentProcessIdrf   rg   rh   )_GetCurrentProcessIdr   r   r   rt   [  rj   rt   c                 C   s   t jj}ttttg|_t|_	t
}	 t|}td|jd }|| ||t|}|r8d|j  k r7|k r8	 |jS  t }|tkrDt||d }|dkrQt|q)Nr    r   r   r   )rc   rd   QueryFullProcessImageNameWr*   rg   LPWSTRPDWORDrf   rJ   rh   MAX_PATHctypescreate_unicode_bufferr   byrefre   ERROR_INSUFFICIENT_BUFFERWinError)hProcessdwFlags_QueryFullProcessImageNameWdwSizelpdwSize	lpExeNamesuccesserrorr   r   r   rw   g  s&   	

rw   c                 C   s>   t jj}tttg|_t|_|| t||}|t	krt
 |S r   )rc   rd   OpenProcessrg   BOOLrf   r*   rh   rJ   NULLr{   r   )dwDesiredAccessbInheritHandledwProcessId_OpenProcessr   r   r   r   r     s   r   c                 C   sn   t jj}ttttttg|_t|_	t
|}td}|| |||t|}|s/t tkr/t
 |jd |j S Nr   )rc   rd   ReadProcessMemoryr*   LPVOIDrl   POINTERrf   rJ   rh   r{   create_string_bufferr}   re   ERROR_PARTIAL_COPYr   rawr   )r   lpBaseAddressnSize_ReadProcessMemorylpBufferlpNumberOfBytesReadr   r   r   r   r     s   
r   c                 C   sl   t jj}ttttttg|_t|_	t
|}t|}td}|| |||t|}|s3t tkr3t |jS r   )rc   rd   WriteProcessMemoryr*   r   rl   r   rf   rJ   rh   lenr{   r   r}   re   r   r   r   )r   r   r   _WriteProcessMemoryr   lpNumberOfBytesWrittenr   r   r   r   r     s   
r   c                 C   sT   t jj}ttttg|_t|_t	 }t
t	}|| |t||}|dkr&t t|S r   )rc   rd   VirtualQueryExr*   r   PMEMORY_BASIC_INFORMATIONrl   rf   rh   rk   sizeofr}   r{   r   r-   )r   	lpAddress_VirtualQueryExr   dwLengthr   r   r   r   r     s   r   c                 C   s6   t jj}tg|_t|_|| }|tkrt  d S d S r   )	rc   rd   	LocalFreeHLOCALrf   rh   r   r{   r   )hMem
_LocalFreeresultr   r   r   r     s   r   c                   @   s"   e Zd ZdefdefdefgZdS )SECURITY_ATTRIBUTESnLengthlpSecurityDescriptorr   N)r&   r'   r(   rg   r   r   rm   r   r   r   r   r     s
    r   i              c                   @   s(   e Zd ZdefdefdefdefgZdS )PROCESS_INFORMATIONr   hThreadr   
dwThreadIdN)r&   r'   r(   r*   rg   rm   r   r   r   r   r     s    r   c                   @   |   e Zd Zdefdefdefdefdefdefdefdefd	efd
efdefdefdefdefdefdefdefdefgZdS )STARTUPINFOcb
lpReserved	lpDesktoplpTitledwXdwYdwXSizedwYSizedwXCountCharsdwYCountCharsdwFillAttributer   wShowWindowcbReserved2lpReserved2	hStdInput
hStdOutput	hStdErrorN)	r&   r'   r(   rg   LPSTRWORDr   r*   rm   r   r   r   r   r   ,  (    r   c                   @      e Zd ZdefdefgZdS )STARTUPINFOEXStartupInfolpAttributeListN)r&   r'   r(   r   PPROC_THREAD_ATTRIBUTE_LISTrm   r   r   r   r   r   G      r   c                   @   r   )STARTUPINFOWr   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   N)	r&   r'   r(   rg   rx   r   r   r*   rm   r   r   r   r   r   N  r   r   c                   @   r   )STARTUPINFOEXWr   r   N)r&   r'   r(   r   r   rm   r   r   r   r   r   e  r   r   c                   @   s   e Zd ZdefdeffZdS )SYSTEM_PROCESS_ID_INFORMATION	ProcessId	ImageNameN)r&   r'   r(   r*   UNICODE_STRINGrm   r   r   r   r   r   m  s    r   c                   @   s   e Zd Zdd ZdS )SYSTEM_INFORMATION_CLASSc                 C   s   dt | j| jf S )Nz%s(%s))typer&   r   r   r   r   r   __repr__s  s   z!SYSTEM_INFORMATION_CLASS.__repr__N)r&   r'   r(   r   r   r   r   r   r   r  s    r   =   X   c                   @   s2   e Zd Zdefdefded fdefdeffZdS )PROCESS_BASIC_INFORMATION	Reserved1PebBaseAddress	Reserved2r   UniqueProcessId	Reserved3N)r&   r'   r(   PVOID	ULONG_PTRrm   r   r   r   r   r   |  s    
r   c                   @   s`   e Zd Zdedfdedfdedfdedfdedfdedfdedfd	edfd
edfdedff
ZdS )*_PROCESS_EXTENDED_BASIC_INFORMATION_UNION1IsProtectedProcessr   IsWow64ProcessIsProcessDeletingIsCrossSessionCreateIsFrozenIsBackgroundIsStronglyNamedIsSecureProcessIsSubsystemProcess	SpareBits   N)r&   r'   r(   ULONGrm   r   r   r   r   r     s    r   c                   @       e Zd ZdZdefdeffZdS ))_PROCESS_EXTENDED_BASIC_INFORMATION_UNIONobjFlagsr   N)r&   r'   r(   _anonymous_r   r   rm   r   r   r   r   r     
    r   c                   @   s&   e Zd ZdZdefdefdeffZdS )"PROCESS_EXTENDED_BASIC_INFORMATIONr   Size	BasicInfor   N)r&   r'   r(   r   rl   r   r   rm   r   r   r   r   r     s    r   c                   @   s(   e Zd ZdedfdedfdedffZdS )UNION_PS_PROTECTIONr6   r   Auditr   Signerr   N)r&   r'   r(   UCHARBOOLEANrm   r   r   r   r   r     s
    r   c                   @   r   )PS_PROTECTIONr   Levelr   N)r&   r'   r(   r   r   r   rm   r   r   r   r   r     r   r   c                 C   s:   t jj}ttg|_t|_t|_	t
d}|| t| |jS r   )rc   rd   GetExitCodeThreadr*   ry   rf   rJ   rh   rp   rq   rg   r}   r   )r   _GetExitCodeThread
lpExitCoder   r   r   r    s   
r  c                 C   sz   t jj}ttg|_t|_|s|dkrt}|tkr'|| |}|tkr%t	
 |S 	 || d}|tkr5t	
 |tkr<	 |S q()Nr   r   d   )rc   rd   WaitForSingleObjectr*   rg   rf   rh   INFINITEWAIT_FAILEDr{   r   WAIT_TIMEOUT)rr   r$   _WaitForSingleObjectrr   r   r   r    s$   


r  N)r   )pdefinesSTILL_ACTIVEr  r  WAIT_OBJECT_0rM   r^   r_   r`   ra   r[   r\   r]   rK   PAGE_NOCACHEPAGE_WRITECOMBINErB   r@   MEM_DECOMMITMEM_RELEASEr=   rH   rF   	MEM_RESETMEM_TOP_DOWNMEM_WRITE_WATCHMEM_PHYSICALMEM_LARGE_PAGESMEM_4MB_PAGESSEC_FILE	SEC_IMAGESEC_RESERVE
SEC_COMMITSEC_NOCACHESEC_LARGE_PAGESrD   WRITE_WATCH_FLAG_RESETFILE_MAP_ALL_ACCESSr*   r   objectr-   re   	Structurerk   r   r   ro   rt   rw   r   r   r   r   r   r   LPSECURITY_ATTRIBUTESr   r   LPPROC_THREAD_ATTRIBUTE_LISTPROC_THREAD_ATTRIBUTE_NUMBERPROC_THREAD_ATTRIBUTE_THREADPROC_THREAD_ATTRIBUTE_INPUTPROC_THREAD_ATTRIBUTE_ADDITIVE ProcThreadAttributeParentProcess ProcThreadAttributeExtendedFlagsProcThreadAttributeHandleList ProcThreadAttributeGroupAffinity ProcThreadAttributePreferredNode!ProcThreadAttributeIdealProcessorProcThreadAttributeUmsThread#ProcThreadAttributeMitigationPolicyProcThreadAttributeMax$PROC_THREAD_ATTRIBUTE_PARENT_PROCESS$PROC_THREAD_ATTRIBUTE_EXTENDED_FLAGS!PROC_THREAD_ATTRIBUTE_HANDLE_LIST$PROC_THREAD_ATTRIBUTE_GROUP_AFFINITY$PROC_THREAD_ATTRIBUTE_PREFERRED_NODE%PROC_THREAD_ATTRIBUTE_IDEAL_PROCESSOR PROC_THREAD_ATTRIBUTE_UMS_THREAD'PROC_THREAD_ATTRIBUTE_MITIGATION_POLICY-PROCESS_CREATION_MITIGATION_POLICY_DEP_ENABLE7PROCESS_CREATION_MITIGATION_POLICY_DEP_ATL_THUNK_ENABLE/PROCESS_CREATION_MITIGATION_POLICY_SEHOP_ENABLEr   LPPROCESS_INFORMATIONr   LPSTARTUPINFOr   LPSTARTUPINFOEXr   LPSTARTUPINFOWr   LPSTARTUPINFOEXWr   r{   c_ulongr   ProcessBasicInformationProcessProtectionInformationSystemExtendedHandleInformationSystemProcessIdInformationr   r   Unionr   r   r   r   r  r  r  r   r   r   r   <module>   s   / 6


