o
    j,=                     @   sN  d dl T d dlT ddlmZmZmZmZmZmZ ddl	m
Z
mZ ddlmZ ddlmZ ddlZddlZddlZdZd Zd	Zd
ZdZdZdZdZdZdZeeB ZeeB eB eB eB eB eB eB eB eB Z dZ!d Z"d	Z#dZ$d Z%d	Z&G dd dZ'G dd dZ(G dd dZ)e*dkre)ddZ+e+,  e+-  e.d  	 e+j/dddd dS dS )   )*    )LoadLibraryWGetProcAddressWVirtualProtectExVirtualAllocExVirtualFreeExCreateRemoteThread)OpenProcessTokenDuplicateTokenEx)logger)PROCESSOR_ARCHITECTURENi                   @            c                   @   s0   e Zd Zdd Zdd Zedd Zdd Zd	S )
Modulec                 C   s4   d | _ d | _d | _d | _g | _d | _d | _d | _d S N)namebaseaddresssize
endaddresspagesversioninfochecksum	timestampself r#   /root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/pypykatz/commons/readers/local/process.py__init__)   s   
zModule.__init__c                 C      | j |  ko| jk S   S r   )r   r   r"   addrr#   r#   r$   inrange4      zModule.inrangec                 C   s4   t  }| |_|j|_|j|_|j|j |_||_|S r   )r   r   lpBaseOfDllr   SizeOfImager   r   r    )r   module_infor    mr#   r#   r$   parse7   s   zModule.parsec                 C   s(   d| j t| jt| jt| j| jf S )Nz%s %s %s %s %s)r   hexr   r   r   r    r!   r#   r#   r$   __str__C   s   (zModule.__str__N)__name__
__module____qualname__r%   r)   staticmethodr/   r1   r#   r#   r#   r$   r   (   s    
r   c                   @   s8   e Zd Zdd Zedd Zdd Zdd Zd	d
 ZdS )Pagec                 C   s(   d | _ d | _d | _d | _d | _d | _d S r   )BaseAddressAllocationBaseAllocationProtect
RegionSize
EndAddressdatar!   r#   r#   r$   r%   G   s   
zPage.__init__c                 C   s>   t  }| j|_| j|_| j|_t| jd|_| j| j |_|S )Ni  @)r6   r7   r8   r9   minr:   r;   )	page_infopr#   r#   r$   r/   P   s   z
Page.parsec                 C   s   t || j| j| _d S r   )ReadProcessMemoryr7   r:   r<   )r"   process_handler#   r#   r$   	read_dataZ   s   zPage.read_datac                 C   r&   r   )r7   r;   r'   r#   r#   r$   r)   ]   r*   zPage.inrangec                 C   s   t || jkr	g S t|| j| j}g }d}t |t |krD||}|dkr(|S ||| | j  ||d d  }t |t |ksd S d S )Nr   r   )lenr:   r@   r7   findappend)r"   patternrA   r<   floffsetmarkerr#   r#   r$   search`   s   
zPage.searchN)	r2   r3   r4   r%   r5   r/   rB   r)   rK   r#   r#   r#   r$   r6   F   s    	
	r6   c                   @   s   e Zd ZddedfddZdd Zdd Zd	d
 Zdd Ze	fddZ
deeB e	fddZefddZdd Zdd Zdd Zdd Zd/ddZed0d d!Zd"d# Zd$d% Zd1d&d'Zd1d(d)Zefd*d+Zeed,fd-d.ZdS )2ProcessNTc                 C   sH   || _ || _|| _d | _d | _d | _g | _g | _|du r"|   d S d S NT)	pidr   accesssysinfoprocessor_architecturephandlemodulesr   open)r"   rN   r   rO   rT   r#   r#   r$   r%   o   s   zProcess.__init__c                 C   s   t  | _t| jjjj| _| jd u rA| jd u r&| j	d u r t
dt| j	| _t| jd| j| _| jd u rCt
dt | j	| jf d S d S )Nz5Process name or PID or opened handle must be providedFz Failed to open %s(%s) Reason: %s)GetSystemInforP   r   idwwProcessorArchitecturerQ   rR   rN   r   	Exceptionpid_for_nameOpenProcessrO   ctypesWinErrorr!   r#   r#   r$   rT      s   



zProcess.openc                 C   s   g | _ t| j}|D ]5}t| j|}td| d}t| dkr.t	t
|j}|| _t| j|}| j t||| q
| j S )Nr   r   z
msv1_0.dll)rS   EnumProcessModulesrR   GetModuleFileNameExWr   logntpathbasenamelowerintosstatst_ctimemsv_dll_timestampGetModuleInformationrF   r   r/   )r"   module_handlesmodule_handlemodule_file_pathr    modinfor#   r#   r$   list_modules   s   
zProcess.list_modulesc                 C   sV   g | _ | jj}|| jjk r)t| j|}| j t| ||j	7 }|| jjk sd S d S r   )
r   rP   lpMinimumApplicationAddresslpMaximumApplicationAddressVirtualQueryExrR   rF   r6   r/   r:   )r"   current_addressr>   r#   r#   r$   
list_pages   s   
zProcess.list_pagesc                 C   s:   |    d }| jD ]	}||r|}q	|d u rtd|S )NzAddress not found in pages!)rs   r   r)   rY   )r"   r(   selected_pagepager#   r#   r$   page_find_for_addr   s   

zProcess.page_find_for_addrc                 C   s   |  |}t| j|j|j|S r   )rv   r   rR   r7   r:   )r"   r(   flagsrt   r#   r#   r$   page_change_protect   s   
zProcess.page_change_protectr   c                 C   s   t | j||||dS )N)	lpAddressdwSizeflAllocationType	flProtect)r   rR   )r"   r   r(   allocation_typeallocation_protectr#   r#   r$   
page_alloc      zProcess.page_allocc                 C   s0   |  |}|tkrdn|j}t| j|j||dS )Nr   )
dwFreeType)rv   MEM_RELEASEr:   r   rR   r7   )r"   r(   	free_typert   dwsizer#   r#   r$   	page_free   s   
zProcess.page_freec                 C      t | j||S r   )r@   rR   )r"   posamountr#   r#   r$   read      zProcess.readc                 C   r   r   )WriteProcessMemoryrR   )r"   r   bufferr#   r#   r$   write   r   zProcess.writec                 C   s   t | jd d|d dS )Nr   )r	   rR   )r"   
start_addrr#   r#   r$   create_thread   r   zProcess.create_threadc                 C   sF   t | jdkr|   | jD ]}|j | dkr |  S qd S )Nr   rC   )rD   rS   rn   r   rc   rE   )r"   module_namemoduler#   r#   r$   find_module_by_name   s   
zProcess.find_module_by_nameFc           	      C   s   t |}t||}tt |}t||d }|j| }| |}|d u r<|du r6| | | 	  | |}|d u r<d S |j| S rM   )
r   r   ri   GetCurrentProcessr   r/   r   r   load_dllrn   )	r"   dll_namefunction_name
force_loadrk   function_addr_totalrm   r   function_addr_offsetr#   r#   r$   get_remote_function_addr   s   





z Process.get_remote_function_addrr   c                 C   s   | j |d dddS )Nr   littleF)	byteordersigned)to_bytes)xbitsizer#   r#   r$   
int_to_asm   s   zProcess.int_to_asmc                 C   s   dt | }dt | }dt | }	dt | }
d}d}dt | }d}|	| | |
 | | | | }| || | |\}}t|}d S )N   H   H   I   H      H)rL   r   r   r   GetExitCodeThread)r"   enclavefnc_addrp1_addrp2_addrp3_addrexitthread_addrp1p2p3fnccall_fncexit_code_setthread_exit_fnccall_thread_exit_fnccodethread_handle	thread_idthread_exitr#   r#   r$   invoke_remote_function   s    zProcess.invoke_remote_functionc           	      C   s   |d dkr
|d7 }|  dd}|  dd}| d}| d}| ||d d}|d	t| 7 }|d
t| 7 }|d7 }|d7 }|d7 }|d
t| 7 }|d7 }| || | |\}}t|d | | d S )NrC    Kernel32.dllr   
ExitThreadi   z	utf-16-le    r   r   r   r   d   )	r   r   r   encoderL   r   r   WaitForSingleObjectr   )	r"   dll_pathloadlibrary_addrr   	code_cavedllname_pager   r   r   r#   r#   r$   r     s&   


zProcess.load_dllc                 C   s    dt |d  }| |||S )Nr   )mathceildpapi_memory_unprotect_x64)r"   protected_blob_addrprotected_blob_sizerw   r#   r#   r$   dpapi_memory_unprotect)  s   zProcess.dpapi_memory_unprotectc                 C   s  |  ddd}|  ddd}|  dd}|  dd}| d	}| |d
 }	d}
|
dt| 7 }
|
dt| 7 }
|
dt| 7 }
|
dt| 7 }
|
d7 }
|
d7 }
|
dt|	 7 }
|
dt| 7 }
|
dt| 7 }
|
dt| 7 }
|
d7 }
|
d7 }
|
dt| 7 }
|
dt| 7 }
|
dt| 7 }
|
dt| 7 }
|
d7 }
|
d7 }
|
d7 }
|
dt| 7 }
|
d7 }
| ||
 | |\}}t|d t|}| |	|}| 	| | 	|	 |S )NzCrypt32.dllCryptProtectMemoryTCryptUnprotectMemoryr   r   z	NtDll.dllRtlCopyMemoryi   
   r   r   r   r   r   r   r   r   )
r   r   rL   r   r   r   r   r   r   r   )r"   r   r   rw   protectmemory_addrunprotectmemory_addrr   copymemory_addrr   result_caver   r   r   thread_exit_coderesultr#   r#   r$   r   -  sH   



z"Process.dpapi_memory_unprotect_x64c                 C   s   t | j|S r   )r
   rR   )r"   dwDesiredAccessr#   r#   r$   get_process_tokenl  s   zProcess.get_process_tokenr   c                 C   s(   t | jt}t||||d}t| |S )N)r   ImpersonationLevel	TokenType)r
   rR   TOKEN_DUPLICATEr   CloseHandle)r"   r   r   r   token_handlecloned_tokenr#   r#   r$   duplicate_tokeno  s   zProcess.duplicate_token)F)r   )r   )r2   r3   r4   PROCESS_ALL_ACCESSr%   rT   rn   rs   rv   PAGE_EXECUTE_READWRITErx   
MEM_COMMITMEM_RESERVEr   r   r   r   r   r   r   r   r5   r   r   r   r   r   TOKEN_ALL_ACCESSr   SecurityImpersonationr   r#   r#   r#   r$   rL   n   s,    	

	%

?rL   __main__il?  )rN   l   rI	)same_process)0common.versioncommon.live_reader_ctypes4pypykatz.commons.winapi.local.function_defs.kernel32r   r   r   r   r   r	   4pypykatz.commons.winapi.local.function_defs.advapi32r
   r   pypykatzr   !minidump.streams.SystemInfoStreamr   ra   re   r   !PROCESS_QUERY_LIMITED_INFORMATIONTOKEN_ASSIGN_PRIMARYr   TOKEN_IMPERSONATETOKEN_QUERYTOKEN_QUERY_SOURCETOKEN_ADJUST_PRIVILEGESTOKEN_ADJUST_GROUPSTOKEN_ADJUST_DEFAULTTOKEN_ADJUST_SESSIONIDSTANDARD_RIGHTS_READ
TOKEN_READSTANDARD_RIGHTS_REQUIREDr   SecurityAnonymousSecurityIdentificationr   SecurityDelegationTokenPrimaryTokenImpersonationr   r6   rL   r2   calcrs   rn   printr   r#   r#   r#   r$   <module>   sp     (  
<