lib.common.defines

Package lib :: Package common :: Module defines |
[hide private]
[frames] | no frames]

# Source Code for Module lib.common.defines

      1  # Copyright (C) 2010-2013 Claudio Guarnieri.
      2  # Copyright (C) 2014-2016 Cuckoo Foundation.
      3  # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
      4  # See the file 'docs/LICENSE' for copying permission.
      5
      6  from ctypes import *
      7
      8  NTDLL    = windll.ntdll
      9  KERNEL32 = windll.kernel32
     10  ADVAPI32 = windll.advapi32
     11  USER32   = windll.user32
     12  SHELL32  = windll.shell32
     13
     14  BYTE      = c_ubyte
     15  WORD      = c_ushort
     16  DWORD     = c_ulong
     17  LONG      = c_ulong
     18  LPBYTE    = POINTER(c_ubyte)
     19  LPTSTR    = POINTER(c_char)
     20  HANDLE    = c_void_p
     21  PVOID     = c_void_p
     22  LPVOID    = c_void_p
     23  UINT_PTR  = c_ulong
     24  SIZE_T    = c_ulong
     25  HMODULE   = c_void_p
     26  NULL      = c_int(0)
     27
     28  DEBUG_PROCESS             = 0x00000001
     29  CREATE_NEW_CONSOLE        = 0x00000010
     30  CREATE_SUSPENDED          = 0x00000004
     31  DBG_CONTINUE              = 0x00010002
     32  INFINITE                  = 0xFFFFFFFF
     33  PROCESS_ALL_ACCESS        = 0x001F0FFF
     34  THREAD_ALL_ACCESS         = 0x001f03ff
     35  TOKEN_ALL_ACCESS          = 0x000F01FF
     36  SE_PRIVILEGE_ENABLED      = 0x00000002
     37  STILL_ACTIVE              = 0x00000103
     38
     39  PAGE_EXECUTE_READWRITE    = 0x00000040
     40  PAGE_EXECUTE              = 0x00000010
     41  PAGE_EXECUTE_READ         = 0x00000020
     42  PAGE_READONLY             = 0x00000002
     43  PAGE_READWRITE            = 0x00000004
     44
     45  MEM_COMMIT                = 0x00001000
     46  MEM_RESERVE               = 0x00002000
     47  MEM_DECOMMIT              = 0x00004000
     48  MEM_RELEASE               = 0x00008000
     49  MEM_RESET                 = 0x00080000
     50
     51  MEM_IMAGE                 = 0x01000000
     52  MEM_MAPPED                = 0x00040000
     53  MEM_PRIVATE               = 0x00020000
     54
     55  PAGE_NOACCESS             = 0x00000001
     56  PAGE_READONLY             = 0x00000002
     57  PAGE_READWRITE            = 0x00000004
     58  PAGE_WRITECOPY            = 0x00000008
     59  PAGE_EXECUTE              = 0x00000010
     60  PAGE_EXECUTE_READ         = 0x00000020
     61  PAGE_EXECUTE_READWRITE    = 0x00000040
     62  PAGE_EXECUTE_WRITECOPY    = 0x00000080
     63  PAGE_GUARD                = 0x00000100
     64  PAGE_NOCACHE              = 0x00000200
     65  PAGE_WRITECOMBINE         = 0x00000400
     66
     67  PIPE_ACCESS_INBOUND       = 0x00000001
     68  PIPE_ACCESS_DUPLEX        = 0x00000003
     69  PIPE_TYPE_MESSAGE         = 0x00000004
     70  PIPE_READMODE_MESSAGE     = 0x00000002
     71  PIPE_WAIT                 = 0x00000000
     72  PIPE_UNLIMITED_INSTANCES  = 0x000000ff
     73  PIPE_TYPE_BYTE            = 0x00000000
     74  PIPE_READMODE_BYTE        = 0x00000000
     75  FILE_FLAG_WRITE_THROUGH   = 0x80000000
     76  INVALID_HANDLE_VALUE      = 0xffffffff
     77  ERROR_BROKEN_PIPE         = 0x0000006d
     78  ERROR_MORE_DATA           = 0x000000EA
     79  ERROR_PIPE_CONNECTED      = 0x00000217
     80
     81  WAIT_TIMEOUT              = 0x00000102
     82
     83  FILE_ATTRIBUTE_HIDDEN     = 0x00000002
     84
     85  WM_GETTEXT                = 0x0000000D
     86  WM_GETTEXTLENGTH          = 0x0000000E
     87  BM_CLICK                  = 0x000000F5
     88
     89  SHARD_PATHA               = 0x00000002
     90
     91 -class STARTUPINFO(Structure):
     92      _fields_ = [
     93          ("cb",            DWORD),
     94          ("lpReserved",    LPTSTR),
     95          ("lpDesktop",     LPTSTR),
     96          ("lpTitle",       LPTSTR),
     97          ("dwX",           DWORD),
     98          ("dwY",           DWORD),
     99          ("dwXSize",       DWORD),
    100          ("dwYSize",       DWORD),
    101          ("dwXCountChars", DWORD),
    102          ("dwYCountChars", DWORD),
    103          ("dwFillAttribute",DWORD),
    104          ("dwFlags",       DWORD),
    105          ("wShowWindow",   WORD),
    106          ("cbReserved2",   WORD),
    107          ("lpReserved2",   LPBYTE),
    108          ("hStdInput",     HANDLE),
    109          ("hStdOutput",    HANDLE),
    110          ("hStdError",     HANDLE),
    111      ]
    112
    113 -class PROCESS_INFORMATION(Structure):
    114      _fields_ = [
    115          ("hProcess",    HANDLE),
    116          ("hThread",     HANDLE),
    117          ("dwProcessId", DWORD),
    118          ("dwThreadId",  DWORD),
    119      ]
    120
    121 -class LUID(Structure):
    122      _fields_ = [
    123          ("LowPart", DWORD),
    124          ("HighPart", LONG),
    125      ]
    126
    127 -class LUID_AND_ATTRIBUTES(Structure):
    128      _fields_ = [
    129          ("Luid", LUID),
    130          ("Attributes", DWORD),
    131      ]
    132
    133 -class TOKEN_PRIVILEGES(Structure):
    134      _fields_ = [
    135          ("PrivilegeCount", DWORD),
    136          ("Privileges", LUID_AND_ATTRIBUTES),
    137      ]
    138
    139 -class MEMORY_BASIC_INFORMATION(Structure):
    140      _fields_ = [
    141          ("BaseAddress", PVOID),
    142          ("AllocationBase", PVOID),
    143          ("AllocationProtect", DWORD),
    144          ("RegionSize", SIZE_T),
    145          ("State", DWORD),
    146          ("Protect", DWORD),
    147          ("Type", DWORD),
    148      ]
    149
    150 -class PROC_STRUCT(Structure):
    151      _fields_ = [
    152          ("wProcessorArchitecture", WORD),
    153          ("wReserved", WORD),
    154      ]
    155
    156 -class SYSTEM_INFO_UNION(Union):
    157      _fields_ = [
    158          ("dwOemId", DWORD),
    159          ("sProcStruc", PROC_STRUCT),
    160      ]
    161
    162 -class SYSTEM_INFO(Structure):
    163      _fields_ = [
    164          ("uSysInfo", SYSTEM_INFO_UNION),
    165          ("dwPageSize", DWORD),
    166          ("lpMinimumApplicationAddress", LPVOID),
    167          ("lpMaximumApplicationAddress", LPVOID),
    168          ("dwActiveProcessorMask", DWORD),
    169          ("dwNumberOfProcessors", DWORD),
    170          ("dwProcessorType", DWORD),
    171          ("dwAllocationGranularity", DWORD),
    172          ("wProcessorLevel", WORD),
    173          ("wProcessorRevision", WORD),
    174      ]
    175
    176 -class SYSTEMTIME(Structure):
    177      _pack_ = 1
    178      _fields_ = [
    179          ("wYear", WORD),
    180          ("wMonth", WORD),
    181          ("wDayOfWeek", WORD),
    182          ("wDay", WORD),
    183          ("wHour", WORD),
    184          ("wMinute", WORD),
    185          ("wSecond", WORD),
    186          ("wMilliseconds", WORD),
    187      ]
    188