o
    Žõ±j,=  ã                   @   sN  d dl T d dlT ddlmZmZmZmZmZmZ ddl	m
Z
mZ ddlmZ ddlmZ ddlZddlZddlZdZd Zd	Zd
ZdZdZdZdZdZdZeeB ZeeB eB eB eB eB eB eB eB eB Z dZ!d Z"d	Z#dZ$d Z%d	Z&G dd„ dƒZ'G dd„ dƒZ(G dd„ dƒZ)e*dkr¥e)dd�Z+e+ ,¡  e+ -¡  e.d ƒ 	 e+j/dddd� dS dS )é   )Ú*é    )ÚLoadLibraryWÚGetProcAddressWÚVirtualProtectExÚVirtualAllocExÚVirtualFreeExÚCreateRemoteThread)ÚOpenProcessTokenÚDuplicateTokenEx)Úlogger)ÚPROCESSOR_ARCHITECTURENi   é   é   é   é   é    é@   é€   é   é   c                   @   s0   e Zd Zdd„ Zdd„ Zedd„ ƒZdd„ Zd	S )
ÚModulec                 C   s4   d | _ d | _d | _d | _g | _d | _d | _d | _d S ©N)ÚnameÚbaseaddressÚsizeÚ
endaddressÚpagesÚversioninfoÚchecksumÚ	timestamp©Úself© r#   ú™/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/pypykatz/commons/readers/local/process.pyÚ__init__)   s   
zModule.__init__c                 C   ó   | j |  ko| jk S   S r   )r   r   ©r"   Úaddrr#   r#   r$   Úinrange4   ó   zModule.inrangec                 C   s4   t ƒ }| |_|j|_|j|_|j|j |_||_|S r   )r   r   ÚlpBaseOfDllr   ÚSizeOfImager   r   r    )r   Úmodule_infor    Úmr#   r#   r$   Úparse7   s   zModule.parsec                 C   s(   d| j t| jƒt| jƒt| jƒ| jf S )Nz%s %s %s %s %s)r   Úhexr   r   r   r    r!   r#   r#   r$   Ú__str__C   s   (zModule.__str__N)Ú__name__Ú
__module__Ú__qualname__r%   r)   Ústaticmethodr/   r1   r#   r#   r#   r$   r   (   s    
r   c                   @   s8   e Zd Zdd„ Zedd„ ƒZdd„ Zdd„ Zd	d
„ ZdS )ÚPagec                 C   s(   d | _ d | _d | _d | _d | _d | _d S r   )ÚBaseAddressÚAllocationBaseÚAllocationProtectÚ
RegionSizeÚ
EndAddressÚdatar!   r#   r#   r$   r%   G   s   
zPage.__init__c                 C   s>   t ƒ }| j|_| j|_| j|_t| jdƒ|_| j| j |_|S )Ni  @)r6   r7   r8   r9   Úminr:   r;   )Ú	page_infoÚpr#   r#   r$   r/   P   s   z
Page.parsec                 C   s   t || j| jƒ| _d S r   )ÚReadProcessMemoryr7   r:   r<   )r"   Úprocess_handler#   r#   r$   Ú	read_dataZ   s   zPage.read_datac                 C   r&   r   )r7   r;   r'   r#   r#   r$   r)   ]   r*   zPage.inrangec                 C   sŒ   t |ƒ| jkr	g S t|| j| jƒ}g }d}t |ƒt |ƒkrD| |¡}|dkr(|S | || | j ¡ ||d d … }t |ƒt |ƒksd S d S )Nr   éÿÿÿÿr   )Úlenr:   r@   r7   ÚfindÚappend)r"   ÚpatternrA   r<   ÚflÚoffsetÚmarkerr#   r#   r$   Úsearch`   s   
ûzPage.searchN)	r2   r3   r4   r%   r5   r/   rB   r)   rK   r#   r#   r#   r$   r6   F   s    	
	r6   c                   @   sâ   e Zd Zddedfdd„Zdd„ Zdd„ Zd	d
„ Zdd„ Ze	fdd„Z
deeB e	fdd„Zefdd„Zdd„ Zdd„ Zdd„ Zdd„ Zd/dd„Zed0d d!„ƒZd"d#„ Zd$d%„ Zd1d&d'„Zd1d(d)„Zefd*d+„Zeed,fd-d.„ZdS )2ÚProcessNTc                 C   sH   || _ || _|| _d | _d | _d | _g | _g | _|du r"|  ¡  d S d S ©NT)	Úpidr   ÚaccessÚsysinfoÚprocessor_architectureÚphandleÚmodulesr   Úopen)r"   rN   r   rO   rT   r#   r#   r$   r%   o   s   ÿzProcess.__init__c                 C   sŠ   t ƒ | _t| jjjjƒ| _| jd u rA| jd u r&| j	d u r t
dƒ‚t| j	ƒ| _t| jd| jƒ| _| jd u rCt
dt ¡ | j	| jf ƒ‚d S d S )Nz5Process name or PID or opened handle must be providedFz Failed to open %s(%s) Reason: %s)ÚGetSystemInforP   r   ÚidÚwÚwProcessorArchitecturerQ   rR   rN   r   Ú	ExceptionÚpid_for_nameÚOpenProcessrO   ÚctypesÚWinErrorr!   r#   r#   r$   rT   €   s   



÷zProcess.openc                 C   s†   g | _ t| jƒ}|D ]5}t| j|ƒ}t d|¡ d}t |¡ ¡ dkr.t	t
 |¡jƒ}|| _t| j|ƒ}| j  t |||¡¡ q
| j S )Nr   r   z
msv1_0.dll)rS   ÚEnumProcessModulesrR   ÚGetModuleFileNameExWr   ÚlogÚntpathÚbasenameÚlowerÚintÚosÚstatÚst_ctimeÚmsv_dll_timestampÚGetModuleInformationrF   r   r/   )r"   Úmodule_handlesÚmodule_handleÚmodule_file_pathr    Úmodinfor#   r#   r$   Úlist_modulesŽ   s   
zProcess.list_modulesc                 C   sV   g | _ | jj}|| jjk r)t| j|ƒ}| j  t |¡¡ ||j	7 }|| jjk sd S d S r   )
r   rP   ÚlpMinimumApplicationAddressÚlpMaximumApplicationAddressÚVirtualQueryExrR   rF   r6   r/   r:   )r"   Úcurrent_addressr>   r#   r#   r$   Ú
list_pagesœ   s   
üzProcess.list_pagesc                 C   s:   |   ¡  d }| jD ]	}| |¡r|}q	|d u rtdƒ‚|S )NzAddress not found in pages!)rs   r   r)   rY   )r"   r(   Úselected_pageÚpager#   r#   r$   Úpage_find_for_addr¥   s   

€zProcess.page_find_for_addrc                 C   s   |   |¡}t| j|j|j|ƒS r   )rv   r   rR   r7   r:   )r"   r(   Úflagsrt   r#   r#   r$   Úpage_change_protect¯   s   
zProcess.page_change_protectr   c                 C   s   t | j||||d�S )N)Ú	lpAddressÚdwSizeÚflAllocationTypeÚ	flProtect)r   rR   )r"   r   r(   Úallocation_typeÚallocation_protectr#   r#   r$   Ú
page_alloc³   ó   zProcess.page_allocc                 C   s0   |   |¡}|tkrdn|j}t| j|j||d�S )Nr   )Ú
dwFreeType)rv   ÚMEM_RELEASEr:   r   rR   r7   )r"   r(   Ú	free_typert   Údwsizer#   r#   r$   Ú	page_free¶   s   
zProcess.page_freec                 C   ó   t | j||ƒS r   )r@   rR   )r"   ÚposÚamountr#   r#   r$   Úread»   ó   zProcess.readc                 C   r†   r   )ÚWriteProcessMemoryrR   )r"   r‡   Úbufferr#   r#   r$   Úwrite¾   rŠ   zProcess.writec                 C   s   t | jd d|d dƒS )Nr   )r	   rR   )r"   Ú
start_addrr#   r#   r$   Úcreate_threadÁ   r€   zProcess.create_threadc                 C   sF   t | jƒdkr|  ¡  | jD ]}|j ¡  | ¡ ¡dkr |  S qd S )Nr   rC   )rD   rS   rn   r   rc   rE   )r"   Úmodule_nameÚmoduler#   r#   r$   Úfind_module_by_nameÄ   s   
þþzProcess.find_module_by_nameFc           	      C   s‚   t |ƒ}t||ƒ}ttƒ |ƒ}t ||d ¡}|j| }|  |¡}|d u r<|du r6|  |¡ |  	¡  |  |¡}|d u r<d S |j| S rM   )
r   r   ri   ÚGetCurrentProcessr   r/   r   r’   Úload_dllrn   )	r"   Údll_nameÚfunction_nameÚ
force_loadrk   Úfunction_addr_totalrm   r‘   Úfunction_addr_offsetr#   r#   r$   Úget_remote_function_addrÍ   s   





z Process.get_remote_function_addrr   c                 C   s   | j |d ddd�S )Nr   ÚlittleF)Ú	byteorderÚsigned)Úto_bytes)ÚxÚbitsizer#   r#   r$   Ú
int_to_asmä   s   zProcess.int_to_asmc                 C   s˜   dt  |¡ }dt  |¡ }dt  |¡ }	dt  |¡ }
d}d}dt  |¡ }d}|	| | |
 | | | | }|  ||¡ |  |¡\}}t|ƒ}d S )Nó   H¹ó   Hºó   I¸ó   H¸ó   ÿÐó   H‰Á)rL   r¡   r�   r�   ÚGetExitCodeThread)r"   ÚenclaveÚfnc_addrÚp1_addrÚp2_addrÚp3_addrÚexitthread_addrÚp1Úp2Úp3ÚfncÚcall_fncÚexit_code_setÚthread_exit_fncÚcall_thread_exit_fncÚcodeÚthread_handleÚ	thread_idÚthread_exitr#   r#   r$   Úinvoke_remote_functionè   s    zProcess.invoke_remote_functionc           	      C   sÞ   |d dkr
|d7 }|   dd¡}|   dd¡}|  d¡}|  d¡}|  || d¡¡ d}|d	t |¡ 7 }|d
t |¡ 7 }|d7 }|d7 }|d7 }|d
t |¡ 7 }|d7 }|  ||¡ |  |¡\}}t|dƒ |  |¡ d S )NrC   ú úKernel32.dllr   Ú
ExitThreadi   z	utf-16-leó    r¢   r¥   r¦   r§   éd   )	rš   r   r�   ÚencoderL   r¡   r�   ÚWaitForSingleObjectr…   )	r"   Údll_pathÚloadlibrary_addrr®   Ú	code_caveÚdllname_pager·   r¸   r¹   r#   r#   r$   r”     s&   


zProcess.load_dllc                 C   s    dt  |d ¡ }|  |||¡S )Nr   )ÚmathÚceilÚdpapi_memory_unprotect_x64)r"   Úprotected_blob_addrÚprotected_blob_sizerw   r#   r#   r$   Údpapi_memory_unprotect)  s   zProcess.dpapi_memory_unprotectc                 C   sÊ  |   ddd¡}|   ddd¡}|   dd¡}|   dd¡}|  d	¡}|  |d
 ¡}	d}
|
dt |¡ 7 }
|
dt |¡ 7 }
|
dt |¡ 7 }
|
dt |¡ 7 }
|
d7 }
|
d7 }
|
dt |	¡ 7 }
|
dt |¡ 7 }
|
dt |¡ 7 }
|
dt |¡ 7 }
|
d7 }
|
d7 }
|
dt |¡ 7 }
|
dt |¡ 7 }
|
dt |¡ 7 }
|
dt |¡ 7 }
|
d7 }
|
d7 }
|
d7 }
|
dt |¡ 7 }
|
d7 }
|  ||
¡ |  |¡\}}t|dƒ t|ƒ}|  |	|¡}|  	|¡ |  	|	¡ |S )NzCrypt32.dllÚCryptProtectMemoryTÚCryptUnprotectMemoryr½   r¾   z	NtDll.dllÚRtlCopyMemoryi   é
   r¿   r¢   r£   r¤   r¥   r¦   r§   rÀ   )
rš   r   rL   r¡   r�   r�   rÂ   r¨   r‰   r…   )r"   rÊ   rË   rw   Úprotectmemory_addrÚunprotectmemory_addrr®   Úcopymemory_addrrÅ   Úresult_caver·   r¸   r¹   Úthread_exit_codeÚresultr#   r#   r$   rÉ   -  sH   



z"Process.dpapi_memory_unprotect_x64c                 C   s   t | j|ƒS r   )r
   rR   )r"   ÚdwDesiredAccessr#   r#   r$   Úget_process_tokenl  s   zProcess.get_process_tokenr   c                 C   s(   t | jtƒ}t||||d�}t|ƒ |S )N)r×   ÚImpersonationLevelÚ	TokenType)r
   rR   ÚTOKEN_DUPLICATEr   ÚCloseHandle)r"   r×   rÙ   rÚ   Útoken_handleÚcloned_tokenr#   r#   r$   Úduplicate_tokeno  s   üzProcess.duplicate_token)F)r   )r   )r2   r3   r4   ÚPROCESS_ALL_ACCESSr%   rT   rn   rs   rv   ÚPAGE_EXECUTE_READWRITErx   Ú
MEM_COMMITÚMEM_RESERVEr   r‚   r…   r‰   r�   r�   r’   rš   r5   r¡   r»   r”   rÌ   rÉ   ÚTOKEN_ALL_ACCESSrØ   ÚSecurityImpersonationrß   r#   r#   r#   r$   rL   n   s,    	

	%

?rL   Ú__main__il?  )rN   l   °rIø	)Úsame_process)0Úcommon.versionÚcommon.live_reader_ctypesÚ4pypykatz.commons.winapi.local.function_defs.kernel32r   r   r   r   r   r	   Ú4pypykatz.commons.winapi.local.function_defs.advapi32r
   r   Úpypykatzr   Ú!minidump.streams.SystemInfoStreamr   ra   re   rÇ   Ú!PROCESS_QUERY_LIMITED_INFORMATIONÚTOKEN_ASSIGN_PRIMARYrÛ   ÚTOKEN_IMPERSONATEÚTOKEN_QUERYÚTOKEN_QUERY_SOURCEÚTOKEN_ADJUST_PRIVILEGESÚTOKEN_ADJUST_GROUPSÚTOKEN_ADJUST_DEFAULTÚTOKEN_ADJUST_SESSIONIDÚSTANDARD_RIGHTS_READÚ
TOKEN_READÚSTANDARD_RIGHTS_REQUIREDrä   ÚSecurityAnonymousÚSecurityIdentificationrå   ÚSecurityDelegationÚTokenPrimaryÚTokenImpersonationr   r6   rL   r2   Úcalcrs   rn   ÚprintrÌ   r#   r#   r#   r$   Ú<module>   sp     ÿÿÿÿþþþý(  
<¿