@@ -1083,111 +1083,6 @@ class OSVERSIONINFOEX(Struct):
10831083 return OSVERSIONINFOEX
10841084
10851085
1086- class WindowsStruct :
1087-
1088- def __init__ (self , ql ):
1089- self .ql = ql
1090- self .addr = None
1091- self .ULONG_SIZE = 8
1092- self .LONG_SIZE = 4
1093- self .POINTER_SIZE = self .ql .arch .pointersize
1094- self .INT_SIZE = 2
1095- self .DWORD_SIZE = 4
1096- self .WORD_SIZE = 2
1097- self .SHORT_SIZE = 2
1098- self .BYTE_SIZE = 1
1099- self .USHORT_SIZE = 2
1100-
1101- def write (self , addr ):
1102- # I want to force the subclasses to implement it
1103- raise NotImplementedError
1104-
1105- def read (self , addr ):
1106- # I want to force the subclasses to implement it
1107- raise NotImplementedError
1108-
1109- def generic_write (self , addr : int , attributes : list ):
1110- self .ql .log .debug ("Writing Windows object " + self .__class__ .__name__ )
1111- already_written = 0
1112- for elem in attributes :
1113- (val , size , endianness , typ ) = elem
1114- if typ == int :
1115- value = val .to_bytes (size , endianness )
1116- self .ql .log .debug ("Writing to %#x with value %s" % (addr + already_written , value ))
1117- self .ql .mem .write (addr + already_written , value )
1118- elif typ == bytes :
1119- if isinstance (val , bytearray ):
1120- value = bytes (val )
1121- else :
1122- value = val
1123- self .ql .log .debug ("Writing at addr %#x value %s" % (addr + already_written , value ))
1124-
1125- self .ql .mem .write (addr + already_written , value )
1126- elif issubclass (typ , WindowsStruct ):
1127- val .write (addr )
1128- else :
1129- raise QlErrorNotImplemented ("API not implemented" )
1130-
1131- already_written += size
1132- self .addr = addr
1133-
1134- def generic_read (self , addr : int , attributes : list ):
1135- self .ql .log .debug ("Reading Windows object " + self .__class__ .__name__ )
1136- already_read = 0
1137- for elem in attributes :
1138- (val , size , endianness , type ) = elem
1139- value = self .ql .mem .read (addr + already_read , size )
1140- self .ql .log .debug ("Reading from %#x value %s" % (addr + already_read , value ))
1141- if type == int :
1142- elem [0 ] = int .from_bytes (value , endianness )
1143- elif type == bytes :
1144- elem [0 ] = value
1145- elif issubclass (type , WindowsStruct ):
1146- obj = type (self .ql )
1147- obj .read (addr )
1148- elem [0 ] = obj
1149- else :
1150- raise QlErrorNotImplemented ("API not implemented" )
1151- already_read += size
1152- self .addr = addr
1153-
1154- class AlignedWindowsStruct (WindowsStruct ):
1155- def __init__ (self , ql ):
1156- super ().__init__ (ql )
1157-
1158- def write (self , addr ):
1159- super ().write (addr )
1160-
1161- def read (self , addr ):
1162- super ().read (addr )
1163-
1164- def generic_write (self , addr : int , attributes : list ):
1165- super ().generic_write (addr , attributes )
1166-
1167- def generic_read (self , addr : int , attributes : list ):
1168- self .ql .log .debug ("Reading unpacked Windows object aligned " + self .__class__ .__name__ )
1169- already_read = 0
1170- for elem in attributes :
1171- (val , size , endianness , type , alignment ) = elem
1172- if already_read != 0 :
1173- modulo = already_read % alignment
1174- already_read = already_read + modulo
1175-
1176- value = self .ql .mem .read (addr + already_read , size )
1177- self .ql .log .debug ("Reading from %x value %s" % (addr + already_read , value ))
1178- if type == int :
1179- elem [0 ] = int .from_bytes (value , endianness )
1180- elif type == bytes :
1181- elem [0 ] = value
1182- elif issubclass (type , WindowsStruct ):
1183- obj = type (self .ql )
1184- obj .read (addr )
1185- elem [0 ] = obj
1186- else :
1187- raise QlErrorNotImplemented ("API not implemented" )
1188- already_read += size
1189- self .addr = addr
1190-
11911086class Token :
11921087 class TokenInformationClass (IntEnum ):
11931088 # https://docs.microsoft.com/it-it/windows/win32/api/winnt/ne-winnt-token_information_class
@@ -1461,25 +1356,8 @@ class sockaddr_in6(ctypes.BigEndianStructure):
14611356
14621357 return sockaddr_in6
14631358
1464- # typedef struct _SYSTEM_INFO {
1465- # union {
1466- # DWORD dwOemId;
1467- # struct {
1468- # WORD wProcessorArchitecture;
1469- # WORD wReserved;
1470- # } DUMMYSTRUCTNAME;
1471- # } DUMMYUNIONNAME;
1472- # DWORD dwPageSize;
1473- # LPVOID lpMinimumApplicationAddress;
1474- # LPVOID lpMaximumApplicationAddress;
1475- # DWORD_PTR dwActiveProcessorMask;
1476- # DWORD dwNumberOfProcessors;
1477- # DWORD dwProcessorType;
1478- # DWORD dwAllocationGranularity;
1479- # WORD wProcessorLevel;
1480- # WORD wProcessorRevision;
1481- # } SYSTEM_INFO, *LPSYSTEM_INFO;
14821359
1360+ # https://docs.microsoft.com/en-us/windows/win32/api/sysinfoapi/ns-sysinfoapi-system_info
14831361def make_system_info (archbits : int ):
14841362 native_type = struct .get_native_type (archbits )
14851363 Struct = struct .get_aligned_struct (archbits )
0 commit comments