Skip to content

Commit 8932682

Browse files
hakrilhakril
authored
Merge pull request #76 from hakril/teb_definition
TEB defintion and `Thread.teb` field
2 parents 5d7e074 + b9d54b3 commit 8932682

30 files changed

+2295
-1871
lines changed

‎.github/workflows/tests.yml‎

Lines changed: 11 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,18 @@
1-
# V0.1
21
name: Pytest
32

4-
on: [push, pull_request, workflow_dispatch]
3+
on:
4+
push:
5+
branches:
6+
- 'master'
7+
pull_request:
58
# Allows you to run this workflow manually from the Actions tab
9+
workflow_dispatch:
10+
611

712
jobs:
813
generate_ctypes:
914
runs-on: windows-latest
1015
timeout-minutes: 5
11-
1216
steps:
1317
- uses: actions/checkout@v4
1418
- uses: actions/setup-python@v5
@@ -19,7 +23,6 @@ jobs:
1923
- name: Check generated code can execute
2024
run: py -c "import windows.generated_def"
2125
tests:
22-
# Not a real dependency : but starting tests when ctypes generation is broken is not useful
2326
strategy:
2427
fail-fast: false
2528
matrix:
@@ -32,7 +35,7 @@ jobs:
3235
python-architecture: x86
3336
- python-bitness-to-test: 64
3437
python-architecture: x64
35-
38+
# Not a real dependency : but starting tests when ctypes generation is broken is not useful
3639
needs: generate_ctypes
3740
timeout-minutes: 15
3841
runs-on: ${{ matrix.runs-on }}
@@ -76,11 +79,11 @@ jobs:
7679
py -${{ matrix.python-version}}-64 setup.py install
7780
7881
- name: Installing pytest & capstone-windows
79-
run: py -${{ matrix.python-version}}-${{ matrix.python-bitness-to-test}} -m pip install pytest capstone-windows
82+
run: py -${{ matrix.python-version}}-${{ matrix.python-bitness-to-test}} -m pip install pytest pytest-timeout capstone-windows
8083

8184
# Testing
8285
- name: Testing
83-
run: py -${{ matrix.python-version}}-${{ matrix.python-bitness-to-test}} -m pytest --junitxml=junit/test-results.xml -s -k "not known_to_fail" -v tests/
86+
run: py -${{ matrix.python-version}}-${{ matrix.python-bitness-to-test}} -m pytest --junitxml=junit/test-results.xml -s -v tests/
8487

8588
- name: Publish PyTest Results
8689
uses: EnricoMi/publish-unit-test-result-action/windows@v2
@@ -90,4 +93,4 @@ jobs:
9093
check_name: PyTest Results for ${{ matrix.python-version}}-${{ matrix.python-bitness-to-test}}
9194
secondary_rate_limit_wait_seconds: 90
9295
seconds_between_github_writes: 10
93-
seconds_between_github_reads: 1
96+
seconds_between_github_reads: 1

‎.gitignore‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,12 @@ doctrees
33
*.inv
44
*.pickle
55
*.ignore
6+
*.code-workspace
67

78
.vscode/
89
.cache/
9-
dist/
10+
dist/
11+
build/
12+
docs/BuildDocEnv/
13+
playground/
14+
*egg-info/

‎ctypes_generation/definitions/functions/process.txt‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -63,4 +63,10 @@ HMODULE LoadLibraryExW(
6363

6464
BOOL FreeLibrary(
6565
HMODULE hLibModule
66-
);
66+
);
67+
68+
69+
/* Not documented by seems present since dawn of time (WRK)
70+
I Prefere PVOID as a return value to allow simple cast to PEB subclass in process.py*/
71+
72+
PVOID RtlGetCurrentPeb ();

‎ctypes_generation/definitions/structures/simple_structs.txt‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
/* Structures that do not depends on anything other that basic type
2+
Simplify structure dependancy file graph
3+
*/
4+
5+
typedef struct _LIST_ENTRY {
6+
struct _LIST_ENTRY *Flink;
7+
struct _LIST_ENTRY *Blink;
8+
} LIST_ENTRY, *PLIST_ENTRY, *RESTRICTED_POINTER PRLIST_ENTRY;
9+
10+
typedef struct _LSA_UNICODE_STRING {
11+
USHORT Length;
12+
USHORT MaximumLength;
13+
PVOID Buffer; // PVOID to prevent ctypes to automatically read the content of the buffer till a \0
14+
} LSA_UNICODE_STRING, *PLSA_UNICODE_STRING, UNICODE_STRING, *PUNICODE_STRING;
15+
16+
typedef struct _CLIENT_ID{
17+
HANDLE UniqueProcess;
18+
HANDLE UniqueThread;
19+
} CLIENT_ID, *PCLIENT_ID;
20+
21+
typedef struct _CLIENT_ID64{
22+
ULONG64 UniqueProcess;
23+
ULONG64 UniqueThread;
24+
} CLIENT_ID64, *PCLIENT_ID64;
25+
26+
typedef struct _CLIENT_ID32{
27+
ULONG UniqueProcess;
28+
ULONG UniqueThread;
29+
} CLIENT_ID32, *PCLIENT_ID32;

‎ctypes_generation/definitions/structures/teb_peb.txt‎

Lines changed: 237 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,237 @@
1+
/* This is the part of RTL_USER_PROCESS_PARAMETERS that works from XP to Windows 10
2+
http://terminus.rewolf.pl/terminus/structures/ntdll/_RTL_USER_PROCESS_PARAMETERS_x86.html
3+
*/
4+
5+
typedef struct _CURDIR
6+
{
7+
UNICODE_STRING DosPath;
8+
PVOID Handle;
9+
} CURDIR, *PCURDIR;
10+
11+
typedef struct _RTL_DRIVE_LETTER_CURDIR
12+
{
13+
WORD Flags;
14+
WORD Length;
15+
ULONG TimeStamp;
16+
UNICODE_STRING DosPath;
17+
} RTL_DRIVE_LETTER_CURDIR, *PRTL_DRIVE_LETTER_CURDIR;
18+
19+
typedef struct _RTL_USER_PROCESS_PARAMETERS
20+
{
21+
ULONG MaximumLength;
22+
ULONG Length;
23+
ULONG Flags;
24+
ULONG DebugFlags;
25+
PVOID ConsoleHandle;
26+
ULONG ConsoleFlags;
27+
PVOID StandardInput;
28+
PVOID StandardOutput;
29+
PVOID StandardError;
30+
CURDIR CurrentDirectory;
31+
UNICODE_STRING DllPath;
32+
UNICODE_STRING ImagePathName;
33+
UNICODE_STRING CommandLine;
34+
PVOID Environment;
35+
ULONG StartingX;
36+
ULONG StartingY;
37+
ULONG CountX;
38+
ULONG CountY;
39+
ULONG CountCharsX;
40+
ULONG CountCharsY;
41+
ULONG FillAttribute;
42+
ULONG WindowFlags;
43+
ULONG ShowWindowFlags;
44+
UNICODE_STRING WindowTitle;
45+
UNICODE_STRING DesktopInfo;
46+
UNICODE_STRING ShellInfo;
47+
UNICODE_STRING RuntimeData;
48+
RTL_DRIVE_LETTER_CURDIR CurrentDirectores[32];
49+
} RTL_USER_PROCESS_PARAMETERS, *PRTL_USER_PROCESS_PARAMETERS;
50+
51+
// PEB: Thank to
52+
// https://msdn.microsoft.com/en-us/library/windows/desktop/aa813706(v=vs.85).aspx
53+
// http://blog.rewolf.pl/blog/?p=573
54+
// http://terminus.rewolf.pl/terminus/structures/ntdll/_PEB_combined.html
55+
56+
typedef struct _LDR_DATA_TABLE_ENTRY {
57+
PVOID Reserved1[2];
58+
LIST_ENTRY InMemoryOrderLinks;
59+
PVOID Reserved2[2];
60+
PVOID DllBase;
61+
PVOID EntryPoint;
62+
PVOID SizeOfImage;
63+
UNICODE_STRING FullDllName;
64+
UNICODE_STRING BaseDllName;
65+
PVOID Reserved5[3];
66+
ULONG CheckSum;
67+
ULONG TimeDateStamp;
68+
} LDR_DATA_TABLE_ENTRY, *PLDR_DATA_TABLE_ENTRY;
69+
70+
/* Definition of WinXP : Still same base in win11 with some extra field */
71+
72+
typedef struct _PEB_LDR_DATA {
73+
ULONG Length;
74+
BYTE Initialized;
75+
PVOID SsHandle;
76+
_LIST_ENTRY InLoadOrderModuleList;
77+
_LIST_ENTRY InMemoryOrderModuleList;
78+
_LIST_ENTRY InInitializationOrderModuleList;
79+
PVOID EntryInProgress;
80+
// BYTE ShutdownInProgress; // New field
81+
// PVOID ShutdownThreadId; // New field
82+
}PEB_LDR_DATA, *PPEB_LDR_DATA;
83+
84+
85+
86+
typedef union _ANON_PEB_SYSTEM_DEPENDENT_02 {
87+
PVOID FastPebLockRoutine;
88+
PVOID SparePtr1;
89+
PVOID AtlThunkSListPtr;
90+
};
91+
92+
typedef union _ANON_PEB_SYSTEM_DEPENDENT_03 {
93+
PVOID FastPebUnlockRoutine;
94+
PVOID SparePtr2;
95+
PVOID IFEOKey;
96+
};
97+
98+
99+
typedef union _ANON_PEB_SYSTEM_DEPENDENT_06 {
100+
PVOID FreeList;
101+
PVOID SparePebPtr0;
102+
PVOID ApiSetMap;
103+
};
104+
105+
typedef union _ANON_PEB_SYSTEM_DEPENDENT_07 {
106+
PVOID ReadOnlySharedMemoryHeap;
107+
PVOID HotpatchInformation;
108+
PVOID SparePvoid0;
109+
};
110+
111+
112+
typedef union _ANON_PEB_UNION_1 {
113+
PVOID KernelCallbackTable;
114+
PVOID UserSharedInfoPtr;
115+
};
116+
117+
typedef union _ANON_PEB_UNION_2 {
118+
PVOID ImageProcessAffinityMask;
119+
PVOID ActiveProcessAffinityMask;
120+
};
121+
122+
typedef struct _PEB {
123+
BYTE Reserved1[2];
124+
BYTE BeingDebugged;
125+
BYTE Reserved2[1];
126+
PVOID Mutant;
127+
PVOID ImageBaseAddress;
128+
PPEB_LDR_DATA Ldr;
129+
PRTL_USER_PROCESS_PARAMETERS ProcessParameters;
130+
PVOID SubSystemData;
131+
PVOID ProcessHeap;
132+
PVOID FastPebLock;
133+
_ANON_PEB_SYSTEM_DEPENDENT_02 _SYSTEM_DEPENDENT_02;
134+
_ANON_PEB_SYSTEM_DEPENDENT_03 _SYSTEM_DEPENDENT_03;
135+
PVOID _SYSTEM_DEPENDENT_04;
136+
union {
137+
PVOID KernelCallbackTable;
138+
PVOID UserSharedInfoPtr;
139+
};
140+
DWORD SystemReserved;
141+
DWORD _SYSTEM_DEPENDENT_05;
142+
_ANON_PEB_SYSTEM_DEPENDENT_06 _SYSTEM_DEPENDENT_06;
143+
PVOID TlsExpansionCounter;
144+
PVOID TlsBitmap;
145+
DWORD TlsBitmapBits[2];
146+
PVOID ReadOnlySharedMemoryBase;
147+
_ANON_PEB_SYSTEM_DEPENDENT_07 _SYSTEM_DEPENDENT_07;
148+
PVOID ReadOnlyStaticServerData;
149+
PVOID AnsiCodePageData;
150+
PVOID OemCodePageData;
151+
PVOID UnicodeCaseTableData;
152+
DWORD NumberOfProcessors;
153+
DWORD NtGlobalFlag;
154+
LARGE_INTEGER CriticalSectionTimeout;
155+
PVOID HeapSegmentReserve;
156+
PVOID HeapSegmentCommit;
157+
PVOID HeapDeCommitTotalFreeThreshold;
158+
PVOID HeapDeCommitFreeBlockThreshold;
159+
DWORD NumberOfHeaps;
160+
DWORD MaximumNumberOfHeaps;
161+
PVOID ProcessHeaps;
162+
PVOID GdiSharedHandleTable;
163+
PVOID ProcessStarterHelper;
164+
PVOID GdiDCAttributeList;
165+
PVOID LoaderLock;
166+
DWORD OSMajorVersion;
167+
DWORD OSMinorVersion;
168+
WORD OSBuildNumber;
169+
WORD OSCSDVersion;
170+
DWORD OSPlatformId;
171+
DWORD ImageSubsystem;
172+
DWORD ImageSubsystemMajorVersion;
173+
PVOID ImageSubsystemMinorVersion;
174+
union {
175+
PVOID ImageProcessAffinityMask;
176+
PVOID ActiveProcessAffinityMask;
177+
};
178+
PVOID GdiHandleBuffer[26];
179+
BYTE GdiHandleBuffer2[32];
180+
PVOID PostProcessInitRoutine;
181+
PVOID TlsExpansionBitmap;
182+
DWORD TlsExpansionBitmapBits[32];
183+
PVOID SessionId;
184+
ULARGE_INTEGER AppCompatFlags;
185+
ULARGE_INTEGER AppCompatFlagsUser;
186+
PVOID pShimData;
187+
PVOID AppCompatInfo;
188+
UNICODE_STRING CSDVersion;
189+
PVOID ActivationContextData;
190+
PVOID ProcessAssemblyStorageMap;
191+
PVOID SystemDefaultActivationContextData;
192+
PVOID SystemAssemblyStorageMap;
193+
PVOID MinimumStackCommit;
194+
} PEB, *PPEB;
195+
196+
197+
/* Partial TEB description
198+
Based on:
199+
- fields that did not move since XP
200+
- https://learn.microsoft.com/en-us/windows/win32/api/winternl/ns-winternl-teb
201+
*/
202+
203+
typedef struct _EXCEPTION_REGISTRATION_RECORD {
204+
_EXCEPTION_REGISTRATION_RECORD *Next;
205+
PVOID Handler;
206+
};
207+
208+
typedef struct _NT_TIB {
209+
struct _EXCEPTION_REGISTRATION_RECORD *ExceptionList;
210+
PVOID StackBase;
211+
PVOID StackLimit;
212+
PVOID SubSystemTib;
213+
union {
214+
PVOID FiberData;
215+
ULONG Version;
216+
};
217+
PVOID ArbitraryUserPointer;
218+
struct _NT_TIB *Self;
219+
} NT_TIB;
220+
221+
typedef struct _TEB {
222+
_NT_TIB NtTib;
223+
PVOID EnvironmentPointer;
224+
_CLIENT_ID ClientId;
225+
PVOID ActiveRpcHandle;
226+
PVOID ThreadLocalStoragePointer;
227+
_PEB *ProcessEnvironmentBlock;
228+
ULONG LastErrorValue;
229+
ULONG CountOfOwnedCriticalSections;
230+
PVOID CsrClientThread;
231+
PVOID Win32ThreadInfo;
232+
ULONG User32Reserved[26];
233+
ULONG UserReserved[5];
234+
PVOID WOW32Reserved;
235+
ULONG CurrentLocale;
236+
ULONG FpSoftwareStatusRegister;
237+
} TEB;

0 commit comments

Comments
 (0)