Question

这是我的代码：

from ctypes import *
WORD = c_ushort
DWORD = c_ulong
LPBYTE = POINTER(c_ubyte)
LPTSTR = POINTER(c_char)
HANDLE = c_void_p
DEBUG_PROCESS = 0x00000001
CREATE_NEW_CONSOLE = 0x00000010
class STARTUPINFO(Structure):
    _fields_ = [
    ("cb", DWORD),
    ("lpReserved", LPTSTR),
    ("lpDesktop", LPTSTR),
    ("lpTitle", LPTSTR),
    ("dwX", DWORD),
    ("dwY", DWORD),
    ("dwXSize", DWORD),
    ("dwYSize", DWORD),
    ("dwXCountChars", DWORD),
    ("dwYCountChars", DWORD),
    ("dwFillAttribute",DWORD),
    ("dwFlags", DWORD),
    ("wShowWindow", WORD),
    ("cbReserved2", WORD),
    ("lpReserved2", LPBYTE),
    ("hStdInput", HANDLE),
    ("hStdOutput", HANDLE),
    ("hStdError", HANDLE),
    ]
class PROCESS_INFORMATION(Structure):
    _fields_ = [
    ("hProcess", HANDLE),
    ("hThread", HANDLE),
    ("dwProcessId", DWORD),
    ("dwThreadId", DWORD),
    ]


kernel32 = windll.kernel32
class debugger():
    def __init__(self):
        pass

    def load(path_to_exe):
        creation_flags = DEBUG_PROCESS
        startupinfo = STARTUPINFO()
        processinfo = PROCESS_INFORMATION()
        startupinfo.dwFlags = 0x1
        startupinfo.wShowWindow = 0x0
        startupinfo.cb = sizeof(startupinfo)
        if kernel32.CreateProcessA(path_to_exe,None,None,None,None,creation_flags,None,None,byref(startupinfo),byref(processinfo)):
            print("[*] Process launched")
            print("[*] PID: %d" % (PROCESS_INFORMATION.dwProcessId))
        else:
            print("[*] Error: 0x%08x." % (kernel32.GetLastError()))

debugger.load("C:\\WINDOWS\\system32\\calc.exe")

我现在实际上正在按照Grey hat python进行操作，并且在阅读时将代码转换为python2.7。

每当我运行它时，都会出现错误：[*]错误：0x000003e6。

但是当我的朋友在他的计算机上尝试此代码时，他可以获得： []我们已成功启动了该过程！ [] PID：1208

我们两个系统都是64位Windows7。

任何帮助将不胜感激！

Answer 1

你们都安装了64位Python吗？ .argtypes和.restype应该在您的函数中设置，或者ctypes默认为传递32位参数。在64位Python上，它会截断byref值，这些值是64位指针。

作为参考，这是一个经过全面测试的版本，可在32位和64位Python 2和3上运行：

from __future__ import print_function,unicode_literals

from ctypes import *
from ctypes.wintypes import BYTE,WORD,DWORD,LPWSTR,LPCWSTR,HANDLE,LPVOID,BOOL

LPBYTE = POINTER(BYTE)

DEBUG_PROCESS = 0x00000001
CREATE_NEW_CONSOLE = 0x00000010

class STARTUPINFOW(Structure):
    _fields_ = [('cb', DWORD),
                ('lpReserved', LPWSTR),
                ('lpDesktop', LPWSTR),
                ('lpTitle', LPWSTR),
                ('dwX', DWORD),
                ('dwY', DWORD),
                ('dwXSize', DWORD),
                ('dwYSize', DWORD),
                ('dwXCountChars', DWORD),
                ('dwYCountChars', DWORD),
                ('dwFillAttribute',DWORD),
                ('dwFlags', DWORD),
                ('wShowWindow', WORD),
                ('cbReserved2', WORD),
                ('lpReserved2', LPBYTE),
                ('hStdInput', HANDLE),
                ('hStdOutput', HANDLE),
                ('hStdError', HANDLE)]

class PROCESS_INFORMATION(Structure):
    _fields_ = [('hProcess', HANDLE),
                ('hThread', HANDLE),
                ('dwProcessId', DWORD),
                ('dwThreadId', DWORD)]

class SECURITY_ATTRIBUTES(Structure):
    _fields_ = [('nLength', DWORD),
                ('lpSecurityDescriptor', LPVOID),
                ('bInheritHandle', BOOL)]

LPSECURITY_ATTRIBUTES = POINTER(SECURITY_ATTRIBUTES)
LPSTARTUPINFOW = POINTER(STARTUPINFOW)
LPPROCESS_INFORMATION = POINTER(PROCESS_INFORMATION)

kernel32 = WinDLL('kernel32',use_last_error=True)
kernel32.CreateProcessW.argtypes = (LPCWSTR,LPWSTR,LPSECURITY_ATTRIBUTES,LPSECURITY_ATTRIBUTES,
                                    BOOL,DWORD,LPVOID,LPCWSTR,LPSTARTUPINFOW,LPPROCESS_INFORMATION)
kernel32.restype = BOOL

def load(path_to_exe):
    creation_flags = DEBUG_PROCESS
    startupinfo = STARTUPINFOW()
    processinfo = PROCESS_INFORMATION()
    startupinfo.dwFlags = 0x1
    startupinfo.wShowWindow = 0x0
    startupinfo.cb = sizeof(startupinfo)
    if kernel32.CreateProcessW(path_to_exe,None,None,None,False,creation_flags,None,None,byref(startupinfo),byref(processinfo)):
        print('[*] Process launched')
        print('[*] PID: {}'.format(processinfo.dwProcessId))
    else:
        print('[*] Error: 0x{:08x}.'.format(get_last_error()))

load(r'C:\WINDOWS\System32\calc.exe')

为什么是python：kernel32.CreateProcessA（）得到错误0x000003e6

1 个答案: