1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28 """
29 Debugging API wrappers in ctypes.
30
31 @see: U{http://apps.sourceforge.net/trac/winappdbg/wiki/Win32APIWrappers}
32 """
33
34 __revision__ = "$Id: advapi32.py 492 2009-12-01 03:18:32Z qvasimodo $"
35
36 from defines import *
37 from kernel32 import *
38
39
40
41
42 SE_CREATE_TOKEN_NAME = "SeCreateTokenPrivilege"
43 SE_ASSIGNPRIMARYTOKEN_NAME = "SeAssignPrimaryTokenPrivilege"
44 SE_LOCK_MEMORY_NAME = "SeLockMemoryPrivilege"
45 SE_INCREASE_QUOTA_NAME = "SeIncreaseQuotaPrivilege"
46 SE_UNSOLICITED_INPUT_NAME = "SeUnsolicitedInputPrivilege"
47 SE_MACHINE_ACCOUNT_NAME = "SeMachineAccountPrivilege"
48 SE_TCB_NAME = "SeTcbPrivilege"
49 SE_SECURITY_NAME = "SeSecurityPrivilege"
50 SE_TAKE_OWNERSHIP_NAME = "SeTakeOwnershipPrivilege"
51 SE_LOAD_DRIVER_NAME = "SeLoadDriverPrivilege"
52 SE_SYSTEM_PROFILE_NAME = "SeSystemProfilePrivilege"
53 SE_SYSTEMTIME_NAME = "SeSystemtimePrivilege"
54 SE_PROF_SINGLE_PROCESS_NAME = "SeProfileSingleProcessPrivilege"
55 SE_INC_BASE_PRIORITY_NAME = "SeIncreaseBasePriorityPrivilege"
56 SE_CREATE_PAGEFILE_NAME = "SeCreatePagefilePrivilege"
57 SE_CREATE_PERMANENT_NAME = "SeCreatePermanentPrivilege"
58 SE_BACKUP_NAME = "SeBackupPrivilege"
59 SE_RESTORE_NAME = "SeRestorePrivilege"
60 SE_SHUTDOWN_NAME = "SeShutdownPrivilege"
61 SE_DEBUG_NAME = "SeDebugPrivilege"
62 SE_AUDIT_NAME = "SeAuditPrivilege"
63 SE_SYSTEM_ENVIRONMENT_NAME = "SeSystemEnvironmentPrivilege"
64 SE_CHANGE_NOTIFY_NAME = "SeChangeNotifyPrivilege"
65 SE_REMOTE_SHUTDOWN_NAME = "SeRemoteShutdownPrivilege"
66 SE_UNDOCK_NAME = "SeUndockPrivilege"
67 SE_SYNC_AGENT_NAME = "SeSyncAgentPrivilege"
68 SE_ENABLE_DELEGATION_NAME = "SeEnableDelegationPrivilege"
69 SE_MANAGE_VOLUME_NAME = "SeManageVolumePrivilege"
70 SE_IMPERSONATE_NAME = "SeImpersonatePrivilege"
71 SE_CREATE_GLOBAL_NAME = "SeCreateGlobalPrivilege"
72
73 SE_PRIVILEGE_ENABLED_BY_DEFAULT = 0x00000001
74 SE_PRIVILEGE_ENABLED = 0x00000002
75 SE_PRIVILEGE_REMOVED = 0x00000004
76 SE_PRIVILEGE_USED_FOR_ACCESS = 0x80000000
77
78 TOKEN_ADJUST_PRIVILEGES = 0x00000020
79
80 LOGON_WITH_PROFILE = 0x00000001
81 LOGON_NETCREDENTIALS_ONLY = 0x00000002
82
83
84
85
86
87
88
89
90 -class LUID(Structure):
91 _fields_ = [
92 ("LowPart", DWORD),
93 ("HighPart", LONG),
94 ]
95
96 PLUID = POINTER(LUID)
97
98
99
100
101
102
104 _fields_ = [
105 ("Luid", LUID),
106 ("Attributes", DWORD),
107 ]
108
109
110
111
112
113
120
121
122 PTOKEN_PRIVILEGES = POINTER(TOKEN_PRIVILEGES)
123
124
125
126 WCT_MAX_NODE_COUNT = 16
127 WCT_OBJNAME_LENGTH = 128
128 WCT_ASYNC_OPEN_FLAG = 0x1
129 WCTP_OPEN_ALL_FLAGS = WCT_ASYNC_OPEN_FLAG
130 WCT_OUT_OF_PROC_FLAG = 0x1
131 WCT_OUT_OF_PROC_COM_FLAG = 0x2
132 WCT_OUT_OF_PROC_CS_FLAG = 0x4
133 WCTP_GETINFO_ALL_FLAGS = WCT_OUT_OF_PROC_FLAG | WCT_OUT_OF_PROC_COM_FLAG | WCT_OUT_OF_PROC_CS_FLAG
134
135 HWCT = LPVOID
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152 WCT_OBJECT_TYPE = DWORD
153
154 WctCriticalSectionType = 1
155 WctSendMessageType = 2
156 WctMutexType = 3
157 WctAlpcType = 4
158 WctComType = 5
159 WctThreadWaitType = 6
160 WctProcessWaitType = 7
161 WctThreadType = 8
162 WctComActivationType = 9
163 WctUnknownType = 10
164 WctMaxType = 11
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181 WCT_OBJECT_STATUS = DWORD
182
183 WctStatusNoAccess = 1
184 WctStatusRunning = 2
185 WctStatusBlocked = 3
186 WctStatusPidOnly = 4
187 WctStatusPidOnlyRpcss = 5
188 WctStatusOwned = 6
189 WctStatusNotOwned = 7
190 WctStatusAbandoned = 8
191 WctStatusUnknown = 9
192 WctStatusError = 10
193 WctStatusMax = 11
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
219
221 _fields_ = [
222 ("ProcessId", DWORD),
223 ("ThreadId", DWORD),
224 ("WaitTime", DWORD),
225 ("ContextSwitches", DWORD),
226 ]
227
233
240
241 PWAITCHAIN_NODE_INFO = POINTER(WAITCHAIN_NODE_INFO)
242
243
244
245
246
247
248
249
259
260
261
262
263
264
265
275
276
277
278
279
280
282 _LookupPrivilegeValueA = windll.advapi32.LookupPrivilegeValueA
283 _LookupPrivilegeValueA.argtypes = [LPSTR, LPSTR, PLUID]
284 _LookupPrivilegeValueA.restype = bool
285 _LookupPrivilegeValueA.errcheck = RaiseIfZero
286
287 lpLuid = LUID()
288 if not lpSystemName:
289 lpSystemName = None
290 _LookupPrivilegeValueA(lpSystemName, lpName, ctypes.byref(lpLuid))
291 return lpLuid
292
294 _LookupPrivilegeValueW = windll.advapi32.LookupPrivilegeValueW
295 _LookupPrivilegeValueW.argtypes = [LPWSTR, LPWSTR, PLUID]
296 _LookupPrivilegeValueW.restype = bool
297 _LookupPrivilegeValueW.errcheck = RaiseIfZero
298
299 lpLuid = LUID()
300 if not lpSystemName:
301 lpSystemName = None
302 _LookupPrivilegeValueW(lpSystemName, lpName, ctypes.byref(lpLuid))
303 return lpLuid
304
305 LookupPrivilegeValue = GuessStringType(LookupPrivilegeValueA, LookupPrivilegeValueW)
306
307
308
309
310
311
312
313
315 _LookupPrivilegeNameA = windll.advapi32.LookupPrivilegeNameA
316 _LookupPrivilegeNameA.argtypes = [LPSTR, PLUID, LPSTR, LPDWORD]
317 _LookupPrivilegeNameA.restype = bool
318 _LookupPrivilegeNameA.errcheck = RaiseIfZero
319
320 cchName = DWORD(0)
321 _LookupPrivilegeNameA(lpSystemName, ctypes.byref(lpLuid), NULL, ctypes.byref(cchName))
322 lpName = ctypes.create_string_buffer("", cchName.value)
323 _LookupPrivilegeNameA(lpSystemName, ctypes.byref(lpLuid), ctypes.byref(lpName), ctypes.byref(cchName))
324 return lpName.value
325
327 _LookupPrivilegeNameW = windll.advapi32.LookupPrivilegeNameW
328 _LookupPrivilegeNameW.argtypes = [LPWSTR, PLUID, LPWSTR, LPDWORD]
329 _LookupPrivilegeNameW.restype = bool
330 _LookupPrivilegeNameW.errcheck = RaiseIfZero
331
332 cchName = DWORD(0)
333 _LookupPrivilegeNameW(lpSystemName, ctypes.byref(lpLuid), NULL, ctypes.byref(cchName))
334 lpName = ctypes.create_unicode_buffer(u"", cchName.value)
335 _LookupPrivilegeNameW(lpSystemName, ctypes.byref(lpLuid), ctypes.byref(lpName), ctypes.byref(cchName))
336 return lpName.value
337
338 LookupPrivilegeName = GuessStringType(LookupPrivilegeNameA, LookupPrivilegeNameW)
339
340
341
342
343
344
345
346
347
349 _AdjustTokenPrivileges = windll.advapi32.AdjustTokenPrivileges
350 _AdjustTokenPrivileges.argtypes = [HANDLE, BOOL, LPVOID, DWORD, LPVOID, LPVOID]
351 _AdjustTokenPrivileges.restype = bool
352 _AdjustTokenPrivileges.errcheck = RaiseIfZero
353
354
355
356
357
358
359
360 if not NewState:
361 _AdjustTokenPrivileges(TokenHandle, TRUE, NULL, 0, NULL, NULL)
362 else:
363 success = True
364 for (privilege, enabled) in NewState:
365 if not isinstance(privilege, LUID):
366 privilege = LookupPrivilegeValue(NULL, privilege)
367 if enabled == True:
368 flags = SE_PRIVILEGE_ENABLED
369 elif enabled == False:
370 flags = SE_PRIVILEGE_REMOVED
371 elif enabled == None:
372 flags = 0
373 else:
374 flags = enabled
375 laa = LUID_AND_ATTRIBUTES(privilege, flags)
376 tp = TOKEN_PRIVILEGES(1, laa)
377 _AdjustTokenPrivileges(TokenHandle, FALSE, ctypes.byref(tp), sizeof(tp), NULL, NULL)
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392 -def CreateProcessWithLogonW(lpUsername = None, lpDomain = None, lpPassword = None, dwLogonFlags = 0, lpApplicationName = None, lpCommandLine = None, dwCreationFlags = 0, lpEnvironment = None, lpCurrentDirectory = None, lpStartupInfo = None):
393 _CreateProcessWithLogonW = windll.advapi32.CreateProcessWithLogonW
394 _CreateProcessWithLogonW.argtypes = [LPWSTR, LPWSTR, LPWSTR, DWORD, LPWSTR, LPWSTR, DWORD, LPVOID, LPWSTR, LPSTARTUPINFOW, LPPROCESS_INFORMATION]
395 _CreateProcessWithLogonW.restype = bool
396 _CreateProcessWithLogonW.errcheck = RaiseIfZero
397
398 if not lpStartupInfo:
399 lpStartupInfo = STARTUPINFO()
400 lpStartupInfo.cb = sizeof(STARTUPINFO)
401 lpStartupInfo.lpReserved = 0
402 lpStartupInfo.lpDesktop = 0
403 lpStartupInfo.lpTitle = 0
404 lpStartupInfo.dwFlags = 0
405 lpStartupInfo.cbReserved2 = 0
406 lpStartupInfo.lpReserved2 = 0
407 lpProcessInformation = PROCESS_INFORMATION()
408 lpProcessInformation.hProcess = INVALID_HANDLE_VALUE
409 lpProcessInformation.hThread = INVALID_HANDLE_VALUE
410 lpProcessInformation.dwProcessId = 0
411 lpProcessInformation.dwThreadId = 0
412 _CreateProcessWithLogonW(lpUsername, lpDomain, lpPassword, dwLogonFlags, lpApplicationName, lpCommandLine, dwCreationFlags, lpEnvironment, lpCurrentDirectory, ctypes.byref(lpStartupInfo), ctypes.byref(lpProcessInformation))
413 return ProcessInformation(lpProcessInformation)
414
415 CreateProcessWithLogonA = MakeANSIVersion(CreateProcessWithLogonW)
416 CreateProcessWithLogon = CreateProcessWithLogonA
417
418
419
420
421
422
423
424
425
426
427
428
429 -def CreateProcessWithTokenW(hToken = None, dwLogonFlags = 0, lpApplicationName = None, lpCommandLine = None, dwCreationFlags = 0, lpEnvironment = None, lpCurrentDirectory = None, lpStartupInfo = None):
430 _CreateProcessWithTokenW = windll.advapi32.CreateProcessWithTokenW
431 _CreateProcessWithTokenW.argtypes = [HANDLE, DWORD, LPWSTR, LPWSTR, DWORD, LPVOID, LPWSTR, LPSTARTUPINFOW, LPPROCESS_INFORMATION]
432 _CreateProcessWithTokenW.restype = bool
433 _CreateProcessWithTokenW.errcheck = RaiseIfZero
434
435 if not lpStartupInfo:
436 lpStartupInfo = STARTUPINFO()
437 lpStartupInfo.cb = sizeof(STARTUPINFO)
438 lpStartupInfo.lpReserved = 0
439 lpStartupInfo.lpDesktop = 0
440 lpStartupInfo.lpTitle = 0
441 lpStartupInfo.dwFlags = 0
442 lpStartupInfo.cbReserved2 = 0
443 lpStartupInfo.lpReserved2 = 0
444 lpProcessInformation = PROCESS_INFORMATION()
445 lpProcessInformation.hProcess = INVALID_HANDLE_VALUE
446 lpProcessInformation.hThread = INVALID_HANDLE_VALUE
447 lpProcessInformation.dwProcessId = 0
448 lpProcessInformation.dwThreadId = 0
449 _CreateProcessWithTokenW(hToken, dwLogonFlags, lpApplicationName, lpCommandLine, dwCreationFlags, lpEnvironment, lpCurrentDirectory, ctypes.byref(lpStartupInfo), ctypes.byref(lpProcessInformation))
450 return ProcessInformation(lpProcessInformation)
451
452 CreateProcessWithTokenA = MakeANSIVersion(CreateProcessWithTokenW)
453 CreateProcessWithToken = CreateProcessWithTokenA
454
455
456
457
458
459
460
461
462
463 PWAITCHAINCALLBACK = WINFUNCTYPE(HWCT, LPVOID, DWORD, LPDWORD, PWAITCHAIN_NODE_INFO, LPBOOL)
464
465
466
467
468
470 _OpenThreadWaitChainSession = windll.advapi32.OpenThreadWaitChainSession
471 _OpenThreadWaitChainSession.argtypes = [DWORD, PVOID]
472 _OpenThreadWaitChainSession.restype = HWCT
473 _OpenThreadWaitChainSession.errcheck = RaiseIfZero
474 if callback is not None:
475 callback = PWAITCHAINCALLBACK(callback)
476 return _OpenThreadWaitChainSession(Flags, callback)
477
478
479
480
481
482
483
484
485
486
488 _GetThreadWaitChain = windll.advapi32.GetThreadWaitChain
489 _GetThreadWaitChain.argtypes = [HWCT, LPVOID, DWORD, DWORD, LPDWORD, PWAITCHAIN_NODE_INFO, LPBOOL]
490 _GetThreadWaitChain.restype = BOOL
491
492 NodeCount = DWORD(WCT_MAX_NODE_COUNT)
493 NodeInfoArray = (WAITCHAIN_NODE_INFO * WCT_MAX_NODE_COUNT)()
494 IsCycle = BOOL(FALSE)
495 _GetThreadWaitChain(WctHandle, Context, Flags, ThreadId, ctypes.byref(NodeCount), ctypes.cast(ctypes.pointer(NodeInfoArray), PWAITCHAIN_NODE_INFO), ctypes.byref(IsCycle))
496 NodeInfoArray = [ NodeInfoArray[index] for index in xrange(0, NodeCount.value) ]
497 IsCycle = bool(IsCycle)
498 return NodeInfoArray, IsCycle
499
500
501
502
507