o j&,@sddlZddlZddlZddlZddlZddlZddlZddlmZm Z m Z m Z m Z m Z mZmZmZddlmZmZmZmZmZmZmZddlmZedkrTeddedd kr_d nd ZGd d d ejZGdddej Z!Gdddej Z"ddZ#dZ$dZ%dZ&dZ'dZ(e$e%Be&Be'BZ)e)e(BZ*e#e"j+j,kre)e(BdBZ-ne)e(BdBZ-dZ.dZ/dZ0dZ1dZ2dZ3dZ4d Z5dZ6d!Z7d"Z8d#Z9d$Z:d%Z;dZd'Z?d(Z@d"ZAd'ZBd(ZCd&ZDd)ZE ejFZGeGjHZIejJj eI_KejjLjMZNejJj eN_KeGjOZOejJj eO_KeZPejjLjQZRee e ePe e efeR_SejJjeR_KeTeZUeTe ZVejjLjWZWd*eW_SeeW_KejjLjXZXeefeX_Se eX_KejjLjYZYefeY_Se eY_KejjLjZZZe e e feZ_SeeZ_Kejj[j\Z\ee ee e e e fe\_Se e\_Kd+d,Z]d-d.Z^d/d0Z_d6d1d2Z`d3d4Zaebd5kr{eadSdS)7N) HANDLEBOOLDWORDHWND HINSTANCEHKEYLPVOIDLPWSTRPBOOL)c_ulongc_char_pc_intc_void_pWinErrorget_last_errorwindll)enable_debug_privilegeWindowsz/This script will ovbiously only work on WindowsP FTc@sheZdZdZdZdZdZdZdZdZ dZ d Z d Z d Z d Zd ZdZdZdZdZdZdZdZdZdZdZdS) MINIDUMP_TYPErrr@iii i@iiN)__name__ __module__ __qualname__MiniDumpNormalMiniDumpWithDataSegsMiniDumpWithFullMemoryMiniDumpWithHandleDataMiniDumpFilterMemoryMiniDumpScanMemoryMiniDumpWithUnloadedModules&MiniDumpWithIndirectlyReferencedMemoryMiniDumpFilterModulePathsMiniDumpWithProcessThreadData"MiniDumpWithPrivateReadWriteMemoryMiniDumpWithoutOptionalDataMiniDumpWithFullMemoryInfoMiniDumpWithThreadInfoMiniDumpWithCodeSegsMiniDumpWithoutAuxiliaryStateMiniDumpWithFullAuxiliaryState"MiniDumpWithPrivateWriteCopyMemory MiniDumpIgnoreInaccessibleMemoryMiniDumpWithTokenInformationMiniDumpWithModuleHeadersMiniDumpFilterTriageMiniDumpValidTypeFlagsr@r@/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/minidump/utils/createminidump.pyrs0rc@s4eZdZdZdZdZdZdZdZdZ dZ d Z d Z d S) WindowsBuildi( iipii#i%i(iZ)i98i:N) r&r'r(WIN_XPWIN_2K3 WIN_VISTAWIN_7WIN_8WIN_BLUE WIN_10_1507 WIN_10_1511 WIN_10_1607 WIN_10_1707r@r@r@rArB-srBc@s(eZdZdZdZdZdZdZdZdZ dS) WindowsMinBuildi i iiXi@i$iH&N) r&r'r(rCrDrErFrGrHWIN_10r@r@r@rArM9srMcCsFGdddtj}ttjjd}|}t||_|t||jS)Nc@sDeZdZdejfdejfdejfdejfdejfdejdfgZdS) z&getWindowsBuild..OSVersionInfodwOSVersionInfoSizedwMajorVersiondwMinorVersion dwBuildNumber dwPlatformId szCSDVersionrN)r&r'r(ctypesr c_char_fields_r@r@r@rA OSVersionInfoDs rX GetVersionExA) rU Structuregetattrrkernel32sizeofrObyrefrR)rX GetVersionExversionr@r@rAgetWindowsBuildCs  rar!r"r#r$r%iirrri ili@i irrrir@cCs>t}t|t|}|dkrtdttt|j  S)Nrz#Failed to get process version info!) rIsWow64ProcessrUr^loggingwarningrrboolvalue)process_handleis64resr@r@rA is64bitProcs    rlcCsztd}|}t}tt|t|t|}|dkr'tttgSt |j tt}dd|d|DS)Nr rcSg|]}|qSr@r@).0ir@r@rA zenum_pids..) r EnumProcessesrUr^r]reerrorrrintrh) max_array pProcessIdspBytesReturnedrk nReturnedr@r@rA enum_pidssrycCsi}tD]K}d||<tttBd|}|dur$td|ttfqtj t }t d}t |d|t |}|dkrItd|ttfq|j||<q|S)Nz Not foundFz:[Enum Processes]Failed to open process PID: %d Reason: %s r rzD[Enum Proceses]Failed GetProcessImageFileName on PID: %d Reason: %s )ry OpenProcessPROCESS_QUERY_INFORMATIONPROCESS_VM_READredebugrrrUrVMAX_PATHrQueryFullProcessImageNamer^rhdecode) pid_to_namepidri image_namemax_pathrkr@r@rAenum_process_namess  rc CsX|rtdt}ddg|}td|td|ttd|}|dur9td|tttdStd|t |}|t krYtd t sOd nd |sTd nd ftd t |t t Bd dttd}|dkr}tdtttdStdt||||d d d } t| stdttttdt|t|dS)NEnabling SeDebugPrivilegefailuresuccessSeDebugPrivilege assignment %szOpening process PID: %dFzFailed to open process PID: %dzProcess handle: 0x%04xz]process architecture mismatch! This could case error! Python arch: %s Target process arch: %sx86x64z$Creating file handle for output filerzFailed to create filezDumping process to filezFailed to dump process to filezDump file created succsessfully)rer}rrzPROCESS_ALL_ACCESSrfrsrrrl IS_PYTHON_64 CreateFileFILE_GENERIC_READFILE_GENERIC_WRITEFILE_CREATE_ALWAYSFILE_ATTRIBUTE_NORMALMiniDumpWriteDumprginfo CloseHandle) routput_filename mindumptype with_debugassignedmsgrirj file_handlerkr@r@rA create_dumps:   "      rc Cs ddl}|jdd}|jddddd|jd d d dd d |jdd}d|_d|_|jddd}|jddd}|jdd}|jddtdd|jdddd|jddd dd!| }|j dkrht j t j d"n|j d#krut j t jd"nt j d#d"tjtjB}|jrt d$t}d%d&g|} t d'| |jdkrt} d(d)| D} | | D] } t d*| | | fqdS|jdkr |jrt d+|jt|j|j||jd,|jrt} | D]!} | | |jd-krt d+| t| |j||jd,dSqt d.dSdSdS)/Nrz.Tool to create process dumps using windows API) descriptionz-dz --with-debug store_truezbenable SeDebugPrivilege, use this if target process is not in the same user context as your script)actionhelpz-vz --verbosecountzverbosity, add more - see more)rdefaultrcommands)rTcommandenumzEnumerate running processesdumpzDump running process)requiredz-pz--pidzPID of process to dump)typerz-nz--namezName of process to dumpz-oz --outfilezOutput .dmp file name)rr)levelrrrrrcSrmr@r@)rnpr@r@rArp1rqzmain..zPID: %d Name: %szDumpig process PID %d)rrzFailed to find process by name!)argparseArgumentParser add_argumentadd_subparsersrdest add_parseradd_mutually_exclusive_grouprt parse_argsverbosere basicConfigINFODEBUGrr)r+rr}rrrsortrrroutfilenamefind) rparser subparsersenumerate_group dump_group target_groupargsrrrrtrr@r@rAmain s^           r__main__)F)cossysrUrplatformrestructctypes.wintypesrrrrrrrr r r r r rrrrminidump.utils.privilegesrsystem ExceptioncalcsizerIntFlagrEnumrBrMraDELETE READ_CONTROL WRITE_DAC WRITE_OWNER SYNCHRONIZESTANDARD_RIGHTS_REQUIREDSTANDARD_RIGHTS_ALLrErhrFILE_SHARE_READFILE_SHARE_WRITEFILE_SHARE_DELETEFILE_FLAG_OPEN_REPARSE_POINTFILE_FLAG_BACKUP_SEMANTICSFILE_CREATE_NEWrFILE_OPEN_EXISTINGFILE_OPEN_ALWAYSFILE_TRUNCATE_EXISTINGrrFILE_GENERIC_EXECUTEFILE_GENERIC_ALLFILE_ATTRIBUTE_READONLYFILE_ATTRIBUTE_HIDDENFILE_ATTRIBUTE_DIRECTORYrFILE_ATTRIBUTE_REPARSE_POINT GENERIC_READFILE_READ_ATTRIBUTESr{r|r~psapiPsapiGetProcessImageFileNameAGetProcessImageFileNamewintypesrestyper\QueryFullProcessImageNameArrrLPSECURITY_ATTRIBUTES CreateFileWrargtypesPOINTERPHANDLEPDWORDGetCurrentProcessrdrrzDbgHelprrlryrrrr&r@r@r@rAs,$                      ! 8