ntmemoryapi 1.0.0__py3-none-any.whl

ntmemoryapi/misc.py

@@ -0,0 +1,102 @@
+# +-------------------------------------+
+# |         ~ Author : Xenely ~         |
+# +=====================================+
+# | GitHub: https://github.com/Xenely14 |
+# | Discord: xenely                     |
+# +-------------------------------------+
+
+import ctypes
+import struct
+import typing
+import ctypes.wintypes
+
+# ==-------------------------------------------------------------------== #
+# DLL functions                                                           #
+# ==-------------------------------------------------------------------== #
+
+# DLL libraries loading
+_kernel32 = ctypes.windll.kernel32
+
+# DLL libraries functions loading
+_LoadLibraryA = _kernel32.LoadLibraryA
+_GetProcAddress = _kernel32.GetProcAddress
+_VirtualProtect = _kernel32.VirtualProtect
+
+# Define of DLL libraries functions return type
+_LoadLibraryA.restype = ctypes.wintypes.LPVOID
+_GetProcAddress.restype = ctypes.wintypes.LPVOID
+_VirtualProtect.restype = ctypes.wintypes.BOOL
+
+# Define of DLL libraries functions argument types
+_LoadLibraryA .argtypes = [ctypes.wintypes.LPCSTR]
+_GetProcAddress.argtypes = [ctypes.wintypes.LPVOID, ctypes.wintypes.LPCSTR]
+_VirtualProtect.argtypes = [ctypes.wintypes.LPVOID, ctypes.c_size_t, ctypes.wintypes.DWORD, ctypes.POINTER(ctypes.wintypes.DWORD)]
+
+
+# ==-------------------------------------------------------------------== #
+# Functions                                                               #
+# ==-------------------------------------------------------------------== #
+def syscall(nt_function_name: str, *, result_type: typing.Any, arguments_types: list[typing.Any], module: bytes = b"ntdll.dll") -> ctypes.WINFUNCTYPE:
+    """Finds function in DLL module by it name, retrieves it's syscall ID, wraps it into raw function buffer and casts to `WINFUNCTYPE` to make call shadowed."""
+
+    # Module loading
+    if not (module_handle := _LoadLibraryA(module)):
+        raise Exception("Unable to load module `%s`" % module.decode())
+
+    # Retrieve nt-function pointer
+    if not (nt_function := _GetProcAddress(module_handle, nt_function_name.encode())):
+        raise Exception("Function `%s` not found" % nt_function_name)
+
+    offset = 0
+    syscall_id = None
+
+    # Retrieve syscall ID from nt-function pointer
+    while True:
+
+        # Syscall ID not found
+        if offset > 0x16:
+            break
+
+        # Retrieve syscall ID from memory
+        if ctypes.cast(nt_function + offset, ctypes.POINTER(ctypes.c_ubyte)).contents.value == 0xB8:
+            syscall_id = ctypes.cast(nt_function + offset + 1, ctypes.POINTER(ctypes.c_ushort)).contents.value
+            break
+
+        offset += 1
+
+    # Syscall ID not found
+    if syscall_id is None:
+        raise Exception("Syscall ID for function `%s` not found" % nt_function_name)
+
+    # Convert syscall ID to hex-bytes list
+    syscall_id_bytes = [hex(item)[2:] if len(hex(item)[2:]) == 2 else "0" + hex(item)[2:] for item in struct.pack("<h", syscall_id)]
+
+    # NOTE: I actually don't know why does this code require access `gs` segment.
+    # I've just used this repo as reference: https://github.com/opcode86/SysCaller
+    #
+    # mov rax, gs:[0x60]
+    # mov r10, rcx
+    # mov eax, <syscall id>,
+    # syscall
+    # ret
+    shellcode = bytes.fromhex("""
+        65 48 8B 04 25 60 00
+        00 00
+        4C 8B D1
+        B8 %s %s 00 00
+        0F 05
+        C3
+    """ % tuple([*syscall_id_bytes]))
+
+    # Allocate buffer for function machine code
+    buffer = (ctypes.c_uint8 * len(shellcode))()
+    shellcode_buffer = ctypes.cast(buffer, ctypes.c_void_p)
+
+    # Copy shellcode into function machine code buffer
+    ctypes.memmove(shellcode_buffer, ctypes.create_string_buffer(shellcode, len(shellcode)), len(shellcode))
+
+    # Update of function machine code buffer memory protection to make it executable
+    ctypes.windll.kernel32.VirtualProtect(shellcode_buffer, len(shellcode), 0x40, ctypes.wintypes.LPDWORD(ctypes.wintypes.DWORD()))
+
+    # Return wrapped syscall function
+    return ctypes.cast(shellcode_buffer, ctypes.WINFUNCTYPE(result_type, *arguments_types))

ntmemoryapi-1.0.0.dist-info/METADATA

@@ -0,0 +1,14 @@
+Metadata-Version: 2.3
+Name: ntmemoryapi
+Version: 1.0.0
+Summary: Simple library for Windows to manipulate process virtual memory with stelthy syscall wraps
+Author: Xenely
+Requires-Python: >=3.10
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Description-Content-Type: text/markdown
+
+

ntmemoryapi-1.0.0.dist-info/RECORD

@@ -0,0 +1,6 @@
+ntmemoryapi/__init__.py,sha256=K8YAkx1OKyniDeEkv0u2Ydf89mOE5lL9kDFLkCWDMGo,38893
+ntmemoryapi/embed.py,sha256=CQXFDPwHZDoouMSxveng8YL_PWjyhQsw1akdUEjXnCk,113455
+ntmemoryapi/misc.py,sha256=pG_O8EzddXRNADTYfDPOMUiHwKrxeGGMeJhlAV1xkRQ,4168
+ntmemoryapi-1.0.0.dist-info/METADATA,sha256=sy0rvsFy4r4lyH8-sTtV2sERFaTNoLhV_Q4lJBT6Z0Q,488
+ntmemoryapi-1.0.0.dist-info/WHEEL,sha256=b4K_helf-jlQoXBBETfwnf4B04YC67LOev0jo4fX5m8,88
+ntmemoryapi-1.0.0.dist-info/RECORD,,

ntmemoryapi-1.0.0.dist-info/WHEEL

@@ -0,0 +1,4 @@
+Wheel-Version: 1.0
+Generator: poetry-core 2.1.3
+Root-Is-Purelib: true
+Tag: py3-none-any