Skip to content

Commit 3588475

Browse files
hakrilhakril
committed
Added some wow64 definition + created functions/syswow64.txt
1 parent 0ea319b commit 3588475

File tree

5 files changed

+208
-70
lines changed

5 files changed

+208
-70
lines changed

‎ctypes_generation/definitions/functions/syswow64.txt‎

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
BOOL IsWow64Process(
2+
[in] HANDLE hProcess,
3+
[out] PBOOL Wow64Process
4+
);
5+
6+
BOOL IsWow64Process2(
7+
[in] HANDLE hProcess,
8+
[out] USHORT *pProcessMachine,
9+
[out, optional] USHORT *pNativeMachine
10+
);
11+
12+
HRESULT IsWow64GuestMachineSupported(
13+
[in] USHORT WowGuestMachine,
14+
[out] BOOL *MachineIsSupported
15+
);
16+
17+
UINT GetSystemWow64DirectoryA(
18+
[out] LPSTR lpBuffer,
19+
[in] UINT uSize
20+
);
21+
22+
UINT GetSystemWow64DirectoryW(
23+
[out] LPWSTR lpBuffer,
24+
[in] UINT uSize
25+
);
26+
27+
UINT GetSystemWow64Directory2A(
28+
[out] LPSTR lpBuffer,
29+
[in] UINT uSize,
30+
[in] WORD ImageFileMachineType
31+
);
32+
33+
UINT GetSystemWow64Directory2W(
34+
[out] LPWSTR lpBuffer,
35+
[in] UINT uSize,
36+
[in] WORD ImageFileMachineType
37+
);
38+
39+
BOOL Wow64DisableWow64FsRedirection(
40+
[out] PVOID *OldValue
41+
);
42+
43+
BOOLEAN Wow64EnableWow64FsRedirection(
44+
BOOLEAN Wow64FsEnableRedirection
45+
);
46+
47+
BOOL Wow64RevertWow64FsRedirection(
48+
[in] PVOID OlValue
49+
);
50+
51+
BOOL Wow64GetThreadContext(
52+
HANDLE hThread,
53+
PWOW64_CONTEXT lpContext
54+
);
55+
56+
BOOL Wow64SetThreadContext(
57+
HANDLE hThread,
58+
WOW64_CONTEXT *lpContext
59+
);
60+
61+
USHORT Wow64SetThreadDefaultGuestMachine(
62+
USHORT Machine
63+
);
64+
65+
DWORD Wow64SuspendThread(
66+
HANDLE hThread
67+
);
68+
69+
NTSTATUS WINAPI NtWow64ReadVirtualMemory64(
70+
_In_ HANDLE hProcess,
71+
_In_ ULONG64 lpBaseAddress,
72+
_Out_ LPVOID lpBuffer,
73+
_In_ ULONG64 nSize,
74+
_Out_ PULONG64 lpNumberOfBytesRead
75+
);
76+
77+
NTSTATUS WINAPI NtWow64WriteVirtualMemory64(
78+
_In_ HANDLE hProcess,
79+
_In_ ULONG64 lpBaseAddress,
80+
_Out_ LPVOID lpBuffer,
81+
_In_ ULONG64 nSize,
82+
_Out_ PULONG64 lpNumberOfBytesWritten
83+
);

‎ctypes_generation/definitions/functions/winfunc.txt‎

Lines changed: 1 addition & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -242,13 +242,6 @@ BOOL WINAPI ReadProcessMemory(
242242
_Out_ SIZE_T *lpNumberOfBytesRead
243243
);
244244

245-
NTSTATUS WINAPI NtWow64ReadVirtualMemory64(
246-
_In_ HANDLE hProcess,
247-
_In_ ULONG64 lpBaseAddress,
248-
_Out_ LPVOID lpBuffer,
249-
_In_ ULONG64 nSize,
250-
_Out_ PULONG64 lpNumberOfBytesRead
251-
);
252245

253246

254247
BOOL WINAPI WriteProcessMemory(
@@ -260,13 +253,7 @@ BOOL WINAPI WriteProcessMemory(
260253
);
261254

262255

263-
NTSTATUS WINAPI NtWow64WriteVirtualMemory64(
264-
_In_ HANDLE hProcess,
265-
_In_ ULONG64 lpBaseAddress,
266-
_Out_ LPVOID lpBuffer,
267-
_In_ ULONG64 nSize,
268-
_Out_ PULONG64 lpNumberOfBytesWritten
269-
);
256+
270257

271258

272259

@@ -518,23 +505,6 @@ BOOL WINAPI DeviceIoControl(
518505
);
519506

520507

521-
BOOL WINAPI Wow64DisableWow64FsRedirection(
522-
_Out_ PVOID *OldValue
523-
);
524-
525-
BOOL WINAPI Wow64RevertWow64FsRedirection(
526-
_In_ PVOID OldValue
527-
);
528-
529-
BOOLEAN WINAPI Wow64EnableWow64FsRedirection(
530-
_In_ BOOLEAN Wow64FsEnableRedirection
531-
);
532-
533-
BOOL WINAPI Wow64GetThreadContext(
534-
_In_ HANDLE hThread,
535-
_Inout_ PWOW64_CONTEXT lpContext
536-
);
537-
538508
BOOL WINAPI SetConsoleCtrlHandler(
539509
_In_opt_ PHANDLER_ROUTINE HandlerRoutine,
540510
_In_ BOOL Add
@@ -669,10 +639,6 @@ DWORD WINAPI GetProcessId(
669639
_In_ HANDLE Process
670640
);
671641

672-
BOOL WINAPI Wow64SetThreadContext(
673-
__in HANDLE hThread,
674-
__in CONST WOW64_CONTEXT *lpContext
675-
);
676642

677643
DWORD WINAPI GetMappedFileNameW (
678644
__in HANDLE hProcess,

‎windows/generated_def/meta.py‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14838,6 +14838,10 @@
1483814838
'GetSystemTime',
1483914839
'GetSystemTimeAsFileTime',
1484014840
'GetSystemTimes',
14841+
'GetSystemWow64Directory2A',
14842+
'GetSystemWow64Directory2W',
14843+
'GetSystemWow64DirectoryA',
14844+
'GetSystemWow64DirectoryW',
1484114845
'GetThreadContext',
1484214846
'GetThreadId',
1484314847
'GetTickCount',
@@ -14896,6 +14900,9 @@
1489614900
'IsDebuggerPresent',
1489714901
'IsOS',
1489814902
'IsValidSecurityDescriptor',
14903+
'IsWow64GuestMachineSupported',
14904+
'IsWow64Process',
14905+
'IsWow64Process2',
1489914906
'LdrLoadDll',
1490014907
'LoadLibraryA',
1490114908
'LoadLibraryExA',
@@ -15298,6 +15305,8 @@
1529815305
'Wow64GetThreadContext',
1529915306
'Wow64RevertWow64FsRedirection',
1530015307
'Wow64SetThreadContext',
15308+
'Wow64SetThreadDefaultGuestMachine',
15309+
'Wow64SuspendThread',
1530115310
'WriteFile',
1530215311
'WriteProcessMemory',
1530315312
'ZwDuplicateObject',

‎windows/generated_def/winfuncs.py‎

Lines changed: 80 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -3025,6 +3025,86 @@
30253025
LookupAccountNameWPrototype = WINFUNCTYPE(BOOL, LPCWSTR, LPCWSTR, PSID, LPDWORD, LPWSTR, LPDWORD, PSID_NAME_USE)
30263026
LookupAccountNameWParams = ((1, 'lpSystemName'), (1, 'lpAccountName'), (1, 'Sid'), (1, 'cbSid'), (1, 'ReferencedDomainName'), (1, 'cchReferencedDomainName'), (1, 'peUse'))
30273027

3028+
#def IsWow64Process(hProcess, Wow64Process):
3029+
# return IsWow64Process.ctypes_function(hProcess, Wow64Process)
3030+
IsWow64ProcessPrototype = WINFUNCTYPE(BOOL, HANDLE, PBOOL)
3031+
IsWow64ProcessParams = ((1, 'hProcess'), (1, 'Wow64Process'))
3032+
3033+
#def IsWow64Process2(hProcess, pProcessMachine, pNativeMachine):
3034+
# return IsWow64Process2.ctypes_function(hProcess, pProcessMachine, pNativeMachine)
3035+
IsWow64Process2Prototype = WINFUNCTYPE(BOOL, HANDLE, POINTER(USHORT), POINTER(USHORT))
3036+
IsWow64Process2Params = ((1, 'hProcess'), (1, 'pProcessMachine'), (1, 'pNativeMachine'))
3037+
3038+
#def IsWow64GuestMachineSupported(WowGuestMachine, MachineIsSupported):
3039+
# return IsWow64GuestMachineSupported.ctypes_function(WowGuestMachine, MachineIsSupported)
3040+
IsWow64GuestMachineSupportedPrototype = WINFUNCTYPE(HRESULT, USHORT, POINTER(BOOL))
3041+
IsWow64GuestMachineSupportedParams = ((1, 'WowGuestMachine'), (1, 'MachineIsSupported'))
3042+
3043+
#def GetSystemWow64DirectoryA(lpBuffer, uSize):
3044+
# return GetSystemWow64DirectoryA.ctypes_function(lpBuffer, uSize)
3045+
GetSystemWow64DirectoryAPrototype = WINFUNCTYPE(UINT, LPSTR, UINT)
3046+
GetSystemWow64DirectoryAParams = ((1, 'lpBuffer'), (1, 'uSize'))
3047+
3048+
#def GetSystemWow64DirectoryW(lpBuffer, uSize):
3049+
# return GetSystemWow64DirectoryW.ctypes_function(lpBuffer, uSize)
3050+
GetSystemWow64DirectoryWPrototype = WINFUNCTYPE(UINT, LPWSTR, UINT)
3051+
GetSystemWow64DirectoryWParams = ((1, 'lpBuffer'), (1, 'uSize'))
3052+
3053+
#def GetSystemWow64Directory2A(lpBuffer, uSize, ImageFileMachineType):
3054+
# return GetSystemWow64Directory2A.ctypes_function(lpBuffer, uSize, ImageFileMachineType)
3055+
GetSystemWow64Directory2APrototype = WINFUNCTYPE(UINT, LPSTR, UINT, WORD)
3056+
GetSystemWow64Directory2AParams = ((1, 'lpBuffer'), (1, 'uSize'), (1, 'ImageFileMachineType'))
3057+
3058+
#def GetSystemWow64Directory2W(lpBuffer, uSize, ImageFileMachineType):
3059+
# return GetSystemWow64Directory2W.ctypes_function(lpBuffer, uSize, ImageFileMachineType)
3060+
GetSystemWow64Directory2WPrototype = WINFUNCTYPE(UINT, LPWSTR, UINT, WORD)
3061+
GetSystemWow64Directory2WParams = ((1, 'lpBuffer'), (1, 'uSize'), (1, 'ImageFileMachineType'))
3062+
3063+
#def Wow64DisableWow64FsRedirection(OldValue):
3064+
# return Wow64DisableWow64FsRedirection.ctypes_function(OldValue)
3065+
Wow64DisableWow64FsRedirectionPrototype = WINFUNCTYPE(BOOL, POINTER(PVOID))
3066+
Wow64DisableWow64FsRedirectionParams = ((1, 'OldValue'),)
3067+
3068+
#def Wow64EnableWow64FsRedirection(Wow64FsEnableRedirection):
3069+
# return Wow64EnableWow64FsRedirection.ctypes_function(Wow64FsEnableRedirection)
3070+
Wow64EnableWow64FsRedirectionPrototype = WINFUNCTYPE(BOOLEAN, BOOLEAN)
3071+
Wow64EnableWow64FsRedirectionParams = ((1, 'Wow64FsEnableRedirection'),)
3072+
3073+
#def Wow64RevertWow64FsRedirection(OlValue):
3074+
# return Wow64RevertWow64FsRedirection.ctypes_function(OlValue)
3075+
Wow64RevertWow64FsRedirectionPrototype = WINFUNCTYPE(BOOL, PVOID)
3076+
Wow64RevertWow64FsRedirectionParams = ((1, 'OlValue'),)
3077+
3078+
#def Wow64GetThreadContext(hThread, lpContext):
3079+
# return Wow64GetThreadContext.ctypes_function(hThread, lpContext)
3080+
Wow64GetThreadContextPrototype = WINFUNCTYPE(BOOL, HANDLE, PWOW64_CONTEXT)
3081+
Wow64GetThreadContextParams = ((1, 'hThread'), (1, 'lpContext'))
3082+
3083+
#def Wow64SetThreadContext(hThread, lpContext):
3084+
# return Wow64SetThreadContext.ctypes_function(hThread, lpContext)
3085+
Wow64SetThreadContextPrototype = WINFUNCTYPE(BOOL, HANDLE, POINTER(WOW64_CONTEXT))
3086+
Wow64SetThreadContextParams = ((1, 'hThread'), (1, 'lpContext'))
3087+
3088+
#def Wow64SetThreadDefaultGuestMachine(Machine):
3089+
# return Wow64SetThreadDefaultGuestMachine.ctypes_function(Machine)
3090+
Wow64SetThreadDefaultGuestMachinePrototype = WINFUNCTYPE(USHORT, USHORT)
3091+
Wow64SetThreadDefaultGuestMachineParams = ((1, 'Machine'),)
3092+
3093+
#def Wow64SuspendThread(hThread):
3094+
# return Wow64SuspendThread.ctypes_function(hThread)
3095+
Wow64SuspendThreadPrototype = WINFUNCTYPE(DWORD, HANDLE)
3096+
Wow64SuspendThreadParams = ((1, 'hThread'),)
3097+
3098+
#def NtWow64ReadVirtualMemory64(hProcess, lpBaseAddress, lpBuffer, nSize, lpNumberOfBytesRead):
3099+
# return NtWow64ReadVirtualMemory64.ctypes_function(hProcess, lpBaseAddress, lpBuffer, nSize, lpNumberOfBytesRead)
3100+
NtWow64ReadVirtualMemory64Prototype = WINFUNCTYPE(NTSTATUS, HANDLE, ULONG64, LPVOID, ULONG64, PULONG64)
3101+
NtWow64ReadVirtualMemory64Params = ((1, 'hProcess'), (1, 'lpBaseAddress'), (1, 'lpBuffer'), (1, 'nSize'), (1, 'lpNumberOfBytesRead'))
3102+
3103+
#def NtWow64WriteVirtualMemory64(hProcess, lpBaseAddress, lpBuffer, nSize, lpNumberOfBytesWritten):
3104+
# return NtWow64WriteVirtualMemory64.ctypes_function(hProcess, lpBaseAddress, lpBuffer, nSize, lpNumberOfBytesWritten)
3105+
NtWow64WriteVirtualMemory64Prototype = WINFUNCTYPE(NTSTATUS, HANDLE, ULONG64, LPVOID, ULONG64, PULONG64)
3106+
NtWow64WriteVirtualMemory64Params = ((1, 'hProcess'), (1, 'lpBaseAddress'), (1, 'lpBuffer'), (1, 'nSize'), (1, 'lpNumberOfBytesWritten'))
3107+
30283108
#def FileTimeToSystemTime(lpFileTime, lpSystemTime):
30293109
# return FileTimeToSystemTime.ctypes_function(lpFileTime, lpSystemTime)
30303110
FileTimeToSystemTimePrototype = WINFUNCTYPE(BOOL, POINTER(FILETIME), LPSYSTEMTIME)
@@ -3415,21 +3495,11 @@
34153495
ReadProcessMemoryPrototype = WINFUNCTYPE(BOOL, HANDLE, LPCVOID, LPVOID, SIZE_T, POINTER(SIZE_T))
34163496
ReadProcessMemoryParams = ((1, 'hProcess'), (1, 'lpBaseAddress'), (1, 'lpBuffer'), (1, 'nSize'), (1, 'lpNumberOfBytesRead'))
34173497

3418-
#def NtWow64ReadVirtualMemory64(hProcess, lpBaseAddress, lpBuffer, nSize, lpNumberOfBytesRead):
3419-
# return NtWow64ReadVirtualMemory64.ctypes_function(hProcess, lpBaseAddress, lpBuffer, nSize, lpNumberOfBytesRead)
3420-
NtWow64ReadVirtualMemory64Prototype = WINFUNCTYPE(NTSTATUS, HANDLE, ULONG64, LPVOID, ULONG64, PULONG64)
3421-
NtWow64ReadVirtualMemory64Params = ((1, 'hProcess'), (1, 'lpBaseAddress'), (1, 'lpBuffer'), (1, 'nSize'), (1, 'lpNumberOfBytesRead'))
3422-
34233498
#def WriteProcessMemory(hProcess, lpBaseAddress, lpBuffer, nSize, lpNumberOfBytesWritten):
34243499
# return WriteProcessMemory.ctypes_function(hProcess, lpBaseAddress, lpBuffer, nSize, lpNumberOfBytesWritten)
34253500
WriteProcessMemoryPrototype = WINFUNCTYPE(BOOL, HANDLE, LPVOID, LPCVOID, SIZE_T, POINTER(SIZE_T))
34263501
WriteProcessMemoryParams = ((1, 'hProcess'), (1, 'lpBaseAddress'), (1, 'lpBuffer'), (1, 'nSize'), (1, 'lpNumberOfBytesWritten'))
34273502

3428-
#def NtWow64WriteVirtualMemory64(hProcess, lpBaseAddress, lpBuffer, nSize, lpNumberOfBytesWritten):
3429-
# return NtWow64WriteVirtualMemory64.ctypes_function(hProcess, lpBaseAddress, lpBuffer, nSize, lpNumberOfBytesWritten)
3430-
NtWow64WriteVirtualMemory64Prototype = WINFUNCTYPE(NTSTATUS, HANDLE, ULONG64, LPVOID, ULONG64, PULONG64)
3431-
NtWow64WriteVirtualMemory64Params = ((1, 'hProcess'), (1, 'lpBaseAddress'), (1, 'lpBuffer'), (1, 'nSize'), (1, 'lpNumberOfBytesWritten'))
3432-
34333503
#def GetCurrentProcess():
34343504
# return GetCurrentProcess.ctypes_function()
34353505
GetCurrentProcessPrototype = WINFUNCTYPE(HANDLE)
@@ -3660,26 +3730,6 @@
36603730
DeviceIoControlPrototype = WINFUNCTYPE(BOOL, HANDLE, DWORD, LPVOID, DWORD, LPVOID, DWORD, LPDWORD, LPOVERLAPPED)
36613731
DeviceIoControlParams = ((1, 'hDevice'), (1, 'dwIoControlCode'), (1, 'lpInBuffer'), (1, 'nInBufferSize'), (1, 'lpOutBuffer'), (1, 'nOutBufferSize'), (1, 'lpBytesReturned'), (1, 'lpOverlapped'))
36623732

3663-
#def Wow64DisableWow64FsRedirection(OldValue):
3664-
# return Wow64DisableWow64FsRedirection.ctypes_function(OldValue)
3665-
Wow64DisableWow64FsRedirectionPrototype = WINFUNCTYPE(BOOL, POINTER(PVOID))
3666-
Wow64DisableWow64FsRedirectionParams = ((1, 'OldValue'),)
3667-
3668-
#def Wow64RevertWow64FsRedirection(OldValue):
3669-
# return Wow64RevertWow64FsRedirection.ctypes_function(OldValue)
3670-
Wow64RevertWow64FsRedirectionPrototype = WINFUNCTYPE(BOOL, PVOID)
3671-
Wow64RevertWow64FsRedirectionParams = ((1, 'OldValue'),)
3672-
3673-
#def Wow64EnableWow64FsRedirection(Wow64FsEnableRedirection):
3674-
# return Wow64EnableWow64FsRedirection.ctypes_function(Wow64FsEnableRedirection)
3675-
Wow64EnableWow64FsRedirectionPrototype = WINFUNCTYPE(BOOLEAN, BOOLEAN)
3676-
Wow64EnableWow64FsRedirectionParams = ((1, 'Wow64FsEnableRedirection'),)
3677-
3678-
#def Wow64GetThreadContext(hThread, lpContext):
3679-
# return Wow64GetThreadContext.ctypes_function(hThread, lpContext)
3680-
Wow64GetThreadContextPrototype = WINFUNCTYPE(BOOL, HANDLE, PWOW64_CONTEXT)
3681-
Wow64GetThreadContextParams = ((1, 'hThread'), (1, 'lpContext'))
3682-
36833733
#def SetConsoleCtrlHandler(HandlerRoutine, Add):
36843734
# return SetConsoleCtrlHandler.ctypes_function(HandlerRoutine, Add)
36853735
SetConsoleCtrlHandlerPrototype = WINFUNCTYPE(BOOL, PHANDLER_ROUTINE, BOOL)
@@ -3815,11 +3865,6 @@
38153865
GetProcessIdPrototype = WINFUNCTYPE(DWORD, HANDLE)
38163866
GetProcessIdParams = ((1, 'Process'),)
38173867

3818-
#def Wow64SetThreadContext(hThread, lpContext):
3819-
# return Wow64SetThreadContext.ctypes_function(hThread, lpContext)
3820-
Wow64SetThreadContextPrototype = WINFUNCTYPE(BOOL, HANDLE, POINTER(WOW64_CONTEXT))
3821-
Wow64SetThreadContextParams = ((1, 'hThread'), (1, 'lpContext'))
3822-
38233868
#def GetMappedFileNameW(hProcess, lpv, lpFilename, nSize):
38243869
# return GetMappedFileNameW.ctypes_function(hProcess, lpv, lpFilename, nSize)
38253870
GetMappedFileNameWPrototype = WINFUNCTYPE(DWORD, HANDLE, LPVOID, PVOID, DWORD)

‎windows/winproxy/apis/kernel32.py‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -503,6 +503,41 @@ def Wow64GetThreadContext(hThread, lpContext):
503503
def Wow64SetThreadContext(hThread, lpContext):
504504
return Wow64SetThreadContext.ctypes_function(hThread, lpContext)
505505

506+
@Kernel32Proxy()
507+
def IsWow64Process(hProcess, Wow64Process):
508+
return IsWow64Process.ctypes_function(hProcess, Wow64Process)
509+
510+
@Kernel32Proxy()
511+
def IsWow64Process2(hProcess, pProcessMachine, pNativeMachine):
512+
return IsWow64Process2.ctypes_function(hProcess, pProcessMachine, pNativeMachine)
513+
514+
@Kernel32Proxy()
515+
def IsWow64GuestMachineSupported(WowGuestMachine, MachineIsSupported):
516+
return IsWow64GuestMachineSupported.ctypes_function(WowGuestMachine, MachineIsSupported)
517+
518+
@Kernel32Proxy()
519+
def GetSystemWow64DirectoryA(lpBuffer, uSize):
520+
return GetSystemWow64DirectoryA.ctypes_function(lpBuffer, uSize)
521+
522+
@Kernel32Proxy()
523+
def GetSystemWow64DirectoryW(lpBuffer, uSize):
524+
return GetSystemWow64DirectoryW.ctypes_function(lpBuffer, uSize)
525+
526+
@Kernel32Proxy()
527+
def GetSystemWow64Directory2A(lpBuffer, uSize, ImageFileMachineType):
528+
return GetSystemWow64Directory2A.ctypes_function(lpBuffer, uSize, ImageFileMachineType)
529+
530+
@Kernel32Proxy()
531+
def GetSystemWow64Directory2W(lpBuffer, uSize, ImageFileMachineType):
532+
return GetSystemWow64Directory2W.ctypes_function(lpBuffer, uSize, ImageFileMachineType)
533+
534+
@Kernel32Proxy()
535+
def Wow64SetThreadDefaultGuestMachine(Machine):
536+
return Wow64SetThreadDefaultGuestMachine.ctypes_function(Machine)
537+
538+
@Kernel32Proxy()
539+
def Wow64SuspendThread(hThread):
540+
return Wow64SuspendThread.ctypes_function(hThread)
506541

507542

508543
## File

0 commit comments

Comments
 (0)