ntmemoryapi 1.3.0__tar.gz → 1.5.0__tar.gz

{ntmemoryapi-1.3.0 → ntmemoryapi-1.5.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: ntmemoryapi
-Version: 1.3.0
+Version: 1.5.0
 Summary: Simple library for Windows to manipulate process virtual memory with stelthy syscall wraps
 Author: Xenely
 Requires-Dist: psutil>=7.1.3

{ntmemoryapi-1.3.0 → ntmemoryapi-1.5.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "ntmemoryapi"
-version = "1.3.0"
+version = "1.5.0"
 description = "Simple library for Windows to manipulate process virtual memory with stelthy syscall wraps"
 authors = [
     {name = "Xenely"}

{ntmemoryapi-1.3.0 → ntmemoryapi-1.5.0}/src/ntmemoryapi/__init__.py

@@ -13,6 +13,16 @@ import psutil
 from .misc import *
 from .embed import *
 
+# ==-------------------------------------------------------------------== #
+# Static and global variables, constans                                   #
+# ==-------------------------------------------------------------------== #
+syscall_wrapper = DirectSyscallWrapper()
+
+PROCESS_ID = 0x001
+PROCESS_NAME = 0x010
+PROCESS_USERNAME = 0x100
+
+
 # ==-------------------------------------------------------------------== #
 # C-consts                                                                #
 # ==-------------------------------------------------------------------== #
@@ -158,7 +168,7 @@ class MEMORY_BASIC_INFORMATION(ctypes.Structure):
         return self.m_partition_id
 
     @property
-    def region_size(self) -> int:
+    def size(self) -> int:
         """Memory region size."""
 
         return self.m_region_size
@@ -209,28 +219,30 @@ class PatternScanBuffer(ctypes.Structure):
 # ==-------------------------------------------------------------------== #
 # Syscalls                                                                #
 # ==-------------------------------------------------------------------== #
-_nt_close = syscall("NtClose", result_type=ctypes.c_ulong, arguments_types=[ctypes.c_void_p])
-_nt_open_process = syscall("NtOpenProcess", result_type=ctypes.c_ulong, arguments_types=[ctypes.c_void_p, ctypes.c_ulong, ctypes.POINTER(OBJECT_ATTRIBUTES), ctypes.POINTER(CLIENT_ID)])
+syscall_wrapper = DirectSyscallWrapper()
+
+_nt_close = syscall_wrapper.wrap("NtClose", result_type=ctypes.c_ulong, arguments_types=[ctypes.c_void_p])
+_nt_open_process = syscall_wrapper.wrap("NtOpenProcess", result_type=ctypes.c_ulong, arguments_types=[ctypes.c_void_p, ctypes.c_ulong, ctypes.POINTER(OBJECT_ATTRIBUTES), ctypes.POINTER(CLIENT_ID)])
 
-_nt_read_virtual_memory = syscall("NtReadVirtualMemory", result_type=ctypes.c_ulong, arguments_types=[ctypes.c_void_p, ctypes.c_void_p, ctypes.c_void_p, ctypes.c_ulong, ctypes.POINTER(ctypes.c_ulong)])
-_nt_write_virtual_memory = syscall("NtWriteVirtualMemory", result_type=ctypes.c_ulong, arguments_types=[ctypes.c_void_p, ctypes.c_void_p, ctypes.c_void_p, ctypes.c_ulong, ctypes.POINTER(ctypes.c_ulong)])
+_nt_read_virtual_memory = syscall_wrapper.wrap("NtReadVirtualMemory", result_type=ctypes.c_ulong, arguments_types=[ctypes.c_void_p, ctypes.c_void_p, ctypes.c_void_p, ctypes.c_ulong, ctypes.POINTER(ctypes.c_ulong)])
+_nt_write_virtual_memory = syscall_wrapper.wrap("NtWriteVirtualMemory", result_type=ctypes.c_ulong, arguments_types=[ctypes.c_void_p, ctypes.c_void_p, ctypes.c_void_p, ctypes.c_ulong, ctypes.POINTER(ctypes.c_ulong)])
 
-_nt_virtual_query_memory = syscall("NtQueryVirtualMemory", result_type=ctypes.c_ulong, arguments_types=[ctypes.c_void_p, ctypes.c_void_p, ctypes.c_ulong, ctypes.c_void_p, ctypes.c_size_t, ctypes.POINTER(ctypes.c_size_t)])
-_nt_query_information_process = syscall("NtQueryInformationProcess", result_type=ctypes.c_ulong, arguments_types=[ctypes.c_void_p, ctypes.c_ulong, ctypes.c_void_p, ctypes.c_ulong, ctypes.POINTER(ctypes.c_ulong)])
+_nt_virtual_query_memory = syscall_wrapper.wrap("NtQueryVirtualMemory", result_type=ctypes.c_ulong, arguments_types=[ctypes.c_void_p, ctypes.c_void_p, ctypes.c_ulong, ctypes.c_void_p, ctypes.c_size_t, ctypes.POINTER(ctypes.c_size_t)])
+_nt_query_information_process = syscall_wrapper.wrap("NtQueryInformationProcess", result_type=ctypes.c_ulong, arguments_types=[ctypes.c_void_p, ctypes.c_ulong, ctypes.c_void_p, ctypes.c_ulong, ctypes.POINTER(ctypes.c_ulong)])
 
-_nt_free_virtual_memory = syscall("NtFreeVirtualMemory", result_type=ctypes.c_ulong, arguments_types=[ctypes.c_void_p, ctypes.POINTER(ctypes.c_void_p), ctypes.POINTER(ctypes.c_ulong), ctypes.c_ulong])
-_nt_allocate_virtual_memory = syscall("NtAllocateVirtualMemory", result_type=ctypes.c_ulong, arguments_types=[ctypes.c_void_p, ctypes.POINTER(ctypes.c_void_p), ctypes.c_ulong, ctypes.POINTER(ctypes.c_ulong), ctypes.c_ulong, ctypes.c_ulong])
-_nt_protect_virtual_memory = syscall("NtProtectVirtualMemory", result_type=ctypes.c_ulong, arguments_types=[ctypes.c_void_p, ctypes.POINTER(ctypes.c_void_p), ctypes.POINTER(ctypes.c_ulong), ctypes.c_ulong, ctypes.POINTER(ctypes.c_ulong)])
+_nt_free_virtual_memory = syscall_wrapper.wrap("NtFreeVirtualMemory", result_type=ctypes.c_ulong, arguments_types=[ctypes.c_void_p, ctypes.POINTER(ctypes.c_void_p), ctypes.POINTER(ctypes.c_ulong), ctypes.c_ulong])
+_nt_allocate_virtual_memory = syscall_wrapper.wrap("NtAllocateVirtualMemory", result_type=ctypes.c_ulong, arguments_types=[ctypes.c_void_p, ctypes.POINTER(ctypes.c_void_p), ctypes.c_ulong, ctypes.POINTER(ctypes.c_ulong), ctypes.c_ulong, ctypes.c_ulong])
+_nt_protect_virtual_memory = syscall_wrapper.wrap("NtProtectVirtualMemory", result_type=ctypes.c_ulong, arguments_types=[ctypes.c_void_p, ctypes.POINTER(ctypes.c_void_p), ctypes.POINTER(ctypes.c_ulong), ctypes.c_ulong, ctypes.POINTER(ctypes.c_ulong)])
 
 
 # ==-------------------------------------------------------------------== #
 # Functions                                                               #
 # ==-------------------------------------------------------------------== #
-def list_processes(include_id: bool = True, include_name: bool = True, include_username: bool = True, current_username_only: bool = True) -> list[dict[str, int | str]]:
+def list_processes(include_process_information: int = PROCESS_ID | PROCESS_NAME | PROCESS_USERNAME, current_username_only: bool = True) -> list[dict[str, int | str]]:
     """List all of the currently active system processes."""
 
     # If `include_id` and `include_name` disabled both
-    if not include_id and not include_name:
+    if not include_process_information & PROCESS_ID and not include_process_information & PROCESS_NAME:
         raise Exception("Unable to disable ID and name including at once")
 
     # Current process username
@@ -250,15 +262,15 @@ def list_processes(include_id: bool = True, include_name: bool = True, include_u
         process_dict = dict()
 
         # If process ID including required
-        if include_id:
+        if include_process_information & PROCESS_ID:
             process_dict |= {"id": process.pid}
 
         # If process ID including required
-        if include_name:
+        if include_process_information & PROCESS_NAME:
             process_dict |= {"name": process.name()}
 
         # If process username including required
-        if include_username:
+        if include_process_information & PROCESS_USERNAME:
             process_dict |= {"username": process.username()}
 
         # Save process information to list
@@ -277,16 +289,16 @@ class Process:
     # Methods                                                                 #
     # ==-------------------------------------------------------------------== #
 
-    def __init__(self, pid_or_name: int | str, access: int = PROCESS_ALL_ACCESS, current_username_only: bool = True) -> None:
+    def __init__(self, name_or_name: int | str, access: int = PROCESS_ALL_ACCESS, current_username_only: bool = True) -> None:
         """Initialize instance to manipulate process."""
 
         # Open process by it's ID or it's name
-        match pid_or_name:
+        match name_or_name:
 
-            case pid if type(pid_or_name) is int:
+            case pid if type(name_or_name) is int:
                 self.handle, self.name, self.pid = self.__init_with_pid(pid, access, current_username_only)
 
-            case name if type(pid_or_name) is str:
+            case name if type(name_or_name) is str:
                 self.handle, self.name, self.pid = self.__init_with_name(name, access, current_username_only)
 
             case _:
@@ -376,7 +388,7 @@ class Process:
                     raise Exception("NtVirtualQueryMemory failed with status: 0x%s" % hex(result)[2:].upper())
 
             # Move to next memory region
-            if (next_address := current_address + memory_basic_information.region_size) <= current_address:
+            if (next_address := current_address + memory_basic_information.size) <= current_address:
                 break
 
             # Overriding current address
@@ -503,7 +515,7 @@ class Process:
 
             # Region bounds
             region_start = region.base_address
-            region_end = region.base_address + region.region_size
+            region_end = region.base_address + region.size
 
             # If start address is defined
             if start_address is not None and region_end <= start_address:
@@ -546,278 +558,196 @@ class Process:
     def read_int8(self, address: int) -> int:
         """Read 1 byte signed integer value located at given address."""
 
+        # If result failed
         if (result := _nt_read_virtual_memory(self.handle, address, ctypes.byref(buffer := ctypes.c_int8()), ctypes.sizeof(buffer), None)):
-
-            # If result failed due memory protection
-            if result == 0x8000000D:
-                raise Exception("Unable to read value located at `0x%s` address due memory protection" % hex(address)[2:].upper())
-
-            else:
-                raise Exception("NtReadVirtualMemory failed with status: 0x%s" % hex(result)[2:].upper())
+            raise Exception("NtReadVirtualMemory failed with status: 0x%s" % hex(result)[2:].upper())
 
         return buffer.value
 
     def read_int16(self, address: int) -> int:
         """Read 2 byte signed integer value located at given address."""
 
+        # If result failed
         if (result := _nt_read_virtual_memory(self.handle, address, ctypes.byref(buffer := ctypes.c_int16()), ctypes.sizeof(buffer), None)):
-
-            # If result failed due memory protection
-            if result == 0x8000000D:
-                raise Exception("Unable to read value located at `0x%s` address due memory protection" % hex(address)[2:].upper())
-
-            else:
-                raise Exception("NtReadVirtualMemory failed with status: 0x%s" % hex(result)[2:].upper())
+            raise Exception("NtReadVirtualMemory failed with status: 0x%s" % hex(result)[2:].upper())
 
         return buffer.value
 
     def read_int32(self, address: int) -> int:
         """Read 4 byte signed integer value located at given address."""
 
+        # If result failed
         if (result := _nt_read_virtual_memory(self.handle, address, ctypes.byref(buffer := ctypes.c_int32()), ctypes.sizeof(buffer), None)):
-
-            # If result failed due memory protection
-            if result == 0x8000000D:
-                raise Exception("Unable to read value located at `0x%s` address due memory protection" % hex(address)[2:].upper())
-
-            else:
-                raise Exception("NtReadVirtualMemory failed with status: 0x%s" % hex(result)[2:].upper())
+            raise Exception("NtReadVirtualMemory failed with status: 0x%s" % hex(result)[2:].upper())
 
         return buffer.value
 
     def read_int64(self, address: int) -> int:
         """Read 8 byte signed integer value located at given address."""
 
+        # If result failed
         if (result := _nt_read_virtual_memory(self.handle, address, ctypes.byref(buffer := ctypes.c_int64()), ctypes.sizeof(buffer), None)):
-
-            # If result failed due memory protection
-            if result == 0x8000000D:
-                raise Exception("Unable to read value located at `0x%s` address due memory protection" % hex(address)[2:].upper())
-
-            else:
-                raise Exception("NtReadVirtualMemory failed with status: 0x%s" % hex(result)[2:].upper())
+            raise Exception("NtReadVirtualMemory failed with status: 0x%s" % hex(result)[2:].upper())
 
         return buffer.value
 
     def read_uint8(self, address: int) -> int:
         """Read 1 byte unsigned integer value located at given address."""
 
+        # If result failed
         if (result := _nt_read_virtual_memory(self.handle, address, ctypes.byref(buffer := ctypes.c_uint8()), ctypes.sizeof(buffer), None)):
+            raise Exception("NtReadVirtualMemory failed with status: 0x%s" % hex(result)[2:].upper())
 
-            # If result failed due memory protection
-            if result == 0x8000000D:
-                raise Exception("Unable to read value located at `0x%s` address due memory protection" % hex(address)[2:].upper())
-
-            else:
-                raise Exception("NtReadVirtualMemory failed with status: 0x%s" % hex(result)[2:].upper())
+        return buffer.value
 
     def read_uint16(self, address: int) -> int:
         """Read 2 byte unsigned integer value located at given address."""
 
+        # If result failed
         if (result := _nt_read_virtual_memory(self.handle, address, ctypes.byref(buffer := ctypes.c_uint16()), ctypes.sizeof(buffer), None)):
+            raise Exception("NtReadVirtualMemory failed with status: 0x%s" % hex(result)[2:].upper())
 
-            # If result failed due memory protection
-            if result == 0x8000000D:
-                raise Exception("Unable to read value located at `0x%s` address due memory protection" % hex(address)[2:].upper())
-
-            else:
-                raise Exception("NtReadVirtualMemory failed with status: 0x%s" % hex(result)[2:].upper())
+        return buffer.value
 
     def read_uint32(self, address: int) -> int:
         """Read 4 byte unsigned integer value located at given address."""
 
+        # If result failed
         if (result := _nt_read_virtual_memory(self.handle, address, ctypes.byref(buffer := ctypes.c_uint32()), ctypes.sizeof(buffer), None)):
+            raise Exception("NtReadVirtualMemory failed with status: 0x%s" % hex(result)[2:].upper())
 
-            # If result failed due memory protection
-            if result == 0x8000000D:
-                raise Exception("Unable to read value located at `0x%s` address due memory protection" % hex(address)[2:].upper())
-
-            else:
-                raise Exception("NtReadVirtualMemory failed with status: 0x%s" % hex(result)[2:].upper())
+        return buffer.value
 
     def read_uint64(self, address: int) -> int:
         """Read 8 byte unsigned integer value located at given address."""
 
+        # If result failed
         if (result := _nt_read_virtual_memory(self.handle, address, ctypes.byref(buffer := ctypes.c_uint64()), ctypes.sizeof(buffer), None)):
+            raise Exception("NtReadVirtualMemory failed with status: 0x%s" % hex(result)[2:].upper())
 
-            # If result failed due memory protection
-            if result == 0x8000000D:
-                raise Exception("Unable to read value located at `0x%s` address due memory protection" % hex(address)[2:].upper())
-
-            else:
-                raise Exception("NtReadVirtualMemory failed with status: 0x%s" % hex(result)[2:].upper())
+        return buffer.value
 
-    def read_float32(self, address: int) -> int:
+    def read_float32(self, address: int) -> float:
         """Read 4 byte floating-point digit value located at given address."""
 
+        # If result failed
         if (result := _nt_read_virtual_memory(self.handle, address, ctypes.byref(buffer := ctypes.c_float()), ctypes.sizeof(buffer), None)):
+            raise Exception("NtReadVirtualMemory failed with status: 0x%s" % hex(result)[2:].upper())
 
-            # If result failed due memory protection
-            if result == 0x8000000D:
-                raise Exception("Unable to read value located at `0x%s` address due memory protection" % hex(address)[2:].upper())
-
-            else:
-                raise Exception("NtReadVirtualMemory failed with status: 0x%s" % hex(result)[2:].upper())
+        return buffer.value
 
-    def read_float64(self, address: int) -> int:
+    def read_float64(self, address: int) -> float:
         """Read 8 byte floating-point digit value located at given address."""
 
+        # If result failed
         if (result := _nt_read_virtual_memory(self.handle, address, ctypes.byref(buffer := ctypes.c_double()), ctypes.sizeof(buffer), None)):
+            raise Exception("NtReadVirtualMemory failed with status: 0x%s" % hex(result)[2:].upper())
 
-            # If result failed due memory protection
-            if result == 0x8000000D:
-                raise Exception("Unable to read value located at `0x%s` address due memory protection" % hex(address)[2:].upper())
-
-            else:
-                raise Exception("NtReadVirtualMemory failed with status: 0x%s" % hex(result)[2:].upper())
+        return buffer.value
 
     def read_bytes(self, address: int, size: int) -> bytes:
         """Read bytes array of variadic size located at given address."""
 
+        # If result failed
         if (result := _nt_read_virtual_memory(self.handle, address, ctypes.byref(buffer := (ctypes.c_int8 * size)()), ctypes.sizeof(buffer), None)):
-
-            # If result failed due memory protection
-            if result == 0x8000000D:
-                raise Exception("Unable to read value located at `0x%s` address due memory protection" % hex(address)[2:].upper())
-
-            else:
-                raise Exception("NtReadVirtualMemory failed with status: 0x%s" % hex(result)[2:].upper())
+            raise Exception("NtReadVirtualMemory failed with status: 0x%s" % hex(result)[2:].upper())
 
         return bytes(buffer)
 
-    def read_buffer[T](self, address: int, buffer: T) -> T:
+    def read_buffer(self, address: int, buffer: typing.Any) -> typing.Any:
         """Read size of buffer byte value located at given address to buffer. Buffer have to be able passed at `ctypes.byref` and `ctype.sizeof`."""
 
+        # If result failed
         if (result := _nt_read_virtual_memory(self.handle, address, ctypes.byref(buffer), ctypes.sizeof(buffer), None)):
-
-            # If result failed due memory protection
-            if result == 0x8000000D:
-                raise Exception("Unable to read value located at `0x%s` address due memory protection" % hex(address)[2:].upper())
-
-            else:
-                raise Exception("NtReadVirtualMemory failed with status: 0x%s" % hex(result)[2:].upper())
+            raise Exception("NtReadVirtualMemory failed with status: 0x%s" % hex(result)[2:].upper())
 
         return buffer
 
     def write_int8(self, address: int, value: int) -> None:
         """Write 1 byte signed integer value at given address."""
 
+        # If result failed
         if (result := _nt_write_virtual_memory(self.handle, address, ctypes.byref(buffer := ctypes.c_int8(value)), ctypes.sizeof(buffer), None)):
-
-            # If result failed due memory protection
-            if result == 0x8000000D:
-                raise Exception("Unable to write value at `0x%s` address due memory protection" % hex(address)[2:].upper())
-
-            else:
-                raise Exception("NtWriteVirtualMemory failed with status: 0x%s" % hex(result)[2:].upper())
+            raise Exception("NtWriteVirtualMemory failed with status: 0x%s" % hex(result)[2:].upper())
 
     def write_int16(self, address: int, value: int) -> None:
         """Write 2 byte signed integer value at given address."""
 
+        # If result failed
         if (result := _nt_write_virtual_memory(self.handle, address, ctypes.byref(buffer := ctypes.c_int16(value)), ctypes.sizeof(buffer), None)):
-
-            # If result failed due memory protection
-            if result == 0x8000000D:
-                raise Exception("Unable to write value at `0x%s` address due memory protection" % hex(address)[2:].upper())
-
-            else:
-                raise Exception("NtWriteVirtualMemory failed with status: 0x%s" % hex(result)[2:].upper())
+            raise Exception("NtWriteVirtualMemory failed with status: 0x%s" % hex(result)[2:].upper())
 
     def write_int32(self, address: int, value: int) -> None:
         """Write 4 byte signed integer value at given address."""
 
+        # If result failed
         if (result := _nt_write_virtual_memory(self.handle, address, ctypes.byref(buffer := ctypes.c_int32(value)), ctypes.sizeof(buffer), None)):
-
-            # If result failed due memory protection
-            if result == 0x8000000D:
-                raise Exception("Unable to write value at `0x%s` address due memory protection" % hex(address)[2:].upper())
-
-            else:
-                raise Exception("NtWriteVirtualMemory failed with status: 0x%s" % hex(result)[2:].upper())
+            raise Exception("NtWriteVirtualMemory failed with status: 0x%s" % hex(result)[2:].upper())
 
     def write_int64(self, address: int, value: int) -> None:
         """Write 8 byte signed integer value at given address."""
 
         if (result := _nt_write_virtual_memory(self.handle, address, ctypes.byref(buffer := ctypes.c_int64(value)), ctypes.sizeof(buffer), None)):
 
-            # If result failed due memory protection
-            if result == 0x8000000D:
-                raise Exception("Unable to write value at `0x%s` address due memory protection" % hex(address)[2:].upper())
-
-            else:
+            # If result failed
+            if (result := _nt_write_virtual_memory(self.handle, address, ctypes.byref(buffer := ctypes.c_int64(value)), ctypes.sizeof(buffer), None)):
                 raise Exception("NtWriteVirtualMemory failed with status: 0x%s" % hex(result)[2:].upper())
 
     def write_uint8(self, address: int, value: int) -> None:
         """Write 1 byte unsigned integer value at given address."""
 
+        # If result failed
         if (result := _nt_write_virtual_memory(self.handle, address, ctypes.byref(buffer := ctypes.c_uint8(value)), ctypes.sizeof(buffer), None)):
-
-            # If result failed due memory protection
-            if result == 0x8000000D:
-                raise Exception("Unable to write value at `0x%s` address due memory protection" % hex(address)[2:].upper())
-
-            else:
-                raise Exception("NtWriteVirtualMemory failed with status: 0x%s" % hex(result)[2:].upper())
+            raise Exception("NtWriteVirtualMemory failed with status: 0x%s" % hex(result)[2:].upper())
 
     def write_uint16(self, address: int, value: int) -> None:
         """Write 2 byte unsigned integer value at given address."""
 
+        # If result failed
         if (result := _nt_write_virtual_memory(self.handle, address, ctypes.byref(buffer := ctypes.c_uint16(value)), ctypes.sizeof(buffer), None)):
-
-            # If result failed due memory protection
-            if result == 0x8000000D:
-                raise Exception("Unable to write value at `0x%s` address due memory protection" % hex(address)[2:].upper())
-
-            else:
-                raise Exception("NtWriteVirtualMemory failed with status: 0x%s" % hex(result)[2:].upper())
+            raise Exception("NtWriteVirtualMemory failed with status: 0x%s" % hex(result)[2:].upper())
 
     def write_uint32(self, address: int, value: int) -> None:
         """Write 4 byte unsigned integer value at given address."""
 
+        # If result failed
         if (result := _nt_write_virtual_memory(self.handle, address, ctypes.byref(buffer := ctypes.c_uint32(value)), ctypes.sizeof(buffer), None)):
-
-            # If result failed due memory protection
-            if result == 0x8000000D:
-                raise Exception("Unable to write value at `0x%s` address due memory protection" % hex(address)[2:].upper())
-
-            else:
-                raise Exception("NtWriteVirtualMemory failed with status: 0x%s" % hex(result)[2:].upper())
+            raise Exception("NtWriteVirtualMemory failed with status: 0x%s" % hex(result)[2:].upper())
 
     def write_uint64(self, address: int, value: int) -> None:
         """Write 8 byte unsigned integer value at given address."""
 
+        # If result failed
         if (result := _nt_write_virtual_memory(self.handle, address, ctypes.byref(buffer := ctypes.c_uint64(value)), ctypes.sizeof(buffer), None)):
+            raise Exception("NtWriteVirtualMemory failed with status: 0x%s" % hex(result)[2:].upper())
 
-            # If result failed due memory protection
-            if result == 0x8000000D:
-                raise Exception("Unable to write value at `0x%s` address due memory protection" % hex(address)[2:].upper())
+    def write_float32(self, address: int, value: float | int) -> float:
+        """Write 4 byte floating-point digit value at given address."""
 
-            else:
-                raise Exception("NtWriteVirtualMemory failed with status: 0x%s" % hex(result)[2:].upper())
+        # If result failed
+        if (result := _nt_write_virtual_memory(self.handle, address, ctypes.byref(buffer := ctypes.c_float(value)), ctypes.sizeof(buffer), None)):
+            raise Exception("NtWriteVirtualMemory failed with status: 0x%s" % hex(result)[2:].upper())
+
+    def write_float64(self, address: int, value: float | int) -> float:
+        """Write 8 byte floating-point digit value at given address."""
+
+        # If result failed
+        if (result := _nt_write_virtual_memory(self.handle, address, ctypes.byref(buffer := ctypes.c_double(value)), ctypes.sizeof(buffer), None)):
+            raise Exception("NtWriteVirtualMemory failed with status: 0x%s" % hex(result)[2:].upper())
 
     def write_bytes(self, address: int, value: bytes) -> None:
         """Write bytes array of variadic size at given address."""
 
+        # If result failed
         if (result := _nt_write_virtual_memory(self.handle, address, value, len(value), None)):
-
-            # If result failed due memory protection
-            if result == 0x8000000D:
-                raise Exception("Unable to write value at `0x%s` address due memory protection" % hex(address)[2:].upper())
-
-            else:
-                raise Exception("NtReadVirtualMemory failed with status: 0x%s" % hex(result)[2:].upper())
+            raise Exception("NtReadVirtualMemory failed with status: 0x%s" % hex(result)[2:].upper())
 
     def write_buffer(self, address: int, buffer: typing.Any) -> None:
         """Write size of buffer byte value at given address. Buffer have to be able passed at `ctypes.byref` and `ctype.sizeof`."""
 
+        # If result failed
         if (result := _nt_write_virtual_memory(self.handle, address, ctypes.byref(buffer), ctypes.sizeof(buffer), None)):
-
-            # If result failed due memory protection
-            if result == 0x8000000D:
-                raise Exception("Unable to write value at `0x%s` address due memory protection" % hex(address)[2:].upper())
-
-            else:
-                raise Exception("NtReadVirtualMemory failed with status: 0x%s" % hex(result)[2:].upper())
+            raise Exception("NtReadVirtualMemory failed with status: 0x%s" % hex(result)[2:].upper())
 
     def close(self) -> None:
         """Close opened process using it's handle, have to be called once on stop interacting with process."""

ntmemoryapi-1.5.0/src/ntmemoryapi/misc.py

@@ -0,0 +1,138 @@
+# +-------------------------------------+
+# |         ~ Author : Xenely ~         |
+# +=====================================+
+# | GitHub: https://github.com/Xenely14 |
+# | Discord: xenely                     |
+# +-------------------------------------+
+
+import ctypes
+import typing
+
+# ==-------------------------------------------------------------------== #
+# DLL functions                                                           #
+# ==-------------------------------------------------------------------== #
+
+# DLL libraries loading
+_kernel32 = ctypes.windll.kernel32
+
+# DLL libraries functions loading
+_LoadLibraryA = _kernel32.LoadLibraryA
+_GetProcAddress = _kernel32.GetProcAddress
+_VirtualFree = _kernel32.VirtualFree
+_VirtualAlloc = _kernel32.VirtualAlloc
+_VirtualProtect = _kernel32.VirtualProtect
+
+# Define of DLL libraries functions return type
+_LoadLibraryA.restype = ctypes.c_void_p
+_GetProcAddress.restype = ctypes.c_void_p
+_VirtualFree.restype = ctypes.c_long
+_VirtualAlloc.restype = ctypes.c_void_p
+_VirtualProtect.restype = ctypes.c_long
+
+# Define of DLL libraries functions argument types
+_LoadLibraryA .argtypes = [ctypes.c_char_p]
+_GetProcAddress.argtypes = [ctypes.c_void_p, ctypes.c_char_p]
+_VirtualFree.argtypes = [ctypes.c_void_p, ctypes.c_size_t, ctypes.c_ulong]
+_VirtualAlloc.argtypes = [ctypes.c_void_p, ctypes.c_size_t, ctypes.c_ulong, ctypes.c_ulong]
+_VirtualProtect.argtypes = [ctypes.c_void_p, ctypes.c_size_t, ctypes.c_ulong, ctypes.POINTER(ctypes.c_ulong)]
+
+
+# ==-------------------------------------------------------------------== #
+# Classes                                                                 #
+# ==-------------------------------------------------------------------== #
+class DirectSyscallWrapper:
+    """Class to create syscall wrappers to make syscall calls """
+
+    # Table containing all syscall wrappers allocations
+    registred_syscalls_table = dict()
+
+    def __init__(self) -> None:
+        """Creates wrapper instance to wrap syscalls."""
+
+        # Create list of wrapped syscalls allocations and save it into syscall table to free memory on instance delete
+        self.registred_syscalls_table[id(self)] = dict()
+
+    def __del__(self) -> None:
+
+        # Get all wrapper allocations addresses and deallocate them
+        for address in self.registred_syscalls_table[id(self)].copy().values():
+            print(_VirtualFree(address, 0, 0x8000))
+
+        # Clean up syscall table
+        del self.registred_syscalls_table[id(self)]
+
+    def wrap(self, function_name: str, *, result_type: typing.Any, arguments_types: list[typing.Any], search_module: bytes = b"ntdll.dll") -> ctypes.WINFUNCTYPE:
+        """Retrieves syscall ID by function name, wraps it into raw function buffer and casts to `WINFUNCTYPE` to make stealthy-callable."""
+
+        # If syscall wrap already exists
+        if (syscall_wrap := self.registred_syscalls_table[id(self)].get(function_name)) is not None:
+            return syscall_wrap
+
+        # Module loading
+        if not (module_handle := _LoadLibraryA(search_module)):
+            raise Exception("Unable to load module `%s`" % search_module.decode())
+
+        # Retrieve function pointer
+        if not (serach_function := _GetProcAddress(module_handle, function_name.encode())):
+            raise Exception("Function `%s` not found" % function_name)
+
+        # Syscall id
+        syscall_id = None
+
+        # Retrieve syscall ID from function pointer
+        for index in range(0x16 + 1):
+
+            # If syscall ID found
+            if ctypes.cast(serach_function + index, ctypes.POINTER(ctypes.c_ubyte)).contents.value == 0xB8:
+
+                syscall_id = ctypes.cast(serach_function + index + 1, ctypes.POINTER(ctypes.c_ushort)).contents.value
+                break
+
+        # If syscall ID not found
+        if syscall_id is None:
+            raise Exception("Syscall ID for function `%s` not found" % function_name)
+
+        # Convert syscall ID to hex-bytes list
+        syscall_id_bytes = [hex(item)[2:] if len(hex(item)[2:]) == 2 else "0" + hex(item)[2:] for item in bytes(ctypes.c_ushort(syscall_id))]
+
+        # Create bytes buffer with syscall ID inlined
+        # NOTE: `ntdll.dll` functions begins the same way, so it's just replica to behave the same.
+        #
+        # mov r10, rcx
+        # mov eax, <syscall id>,
+        # syscall
+        # ret
+        shellcode = bytes.fromhex("""
+            4C 8B D1
+            B8 %s %s 00 00
+            0F 05
+            C3
+        """ % tuple([*syscall_id_bytes]))
+
+        # Allocate buffer for function machine code
+        if not (shellcode_buffer := _VirtualAlloc(0, len(shellcode), 0x1000 | 0x2000, 0x04)):
+            raise Exception("Unable to alloate memory for shellcode")
+
+        # Save allocated buffer into wrapped syscalls table
+        self.registred_syscalls_table[id(self)][function_name] = shellcode_buffer
+
+        # Copy shellcode into function machine code buffer
+        ctypes.memmove(shellcode_buffer, ctypes.create_string_buffer(shellcode, len(shellcode)), len(shellcode))
+
+        # Update of function machine code buffer memory protection to make it executable
+        ctypes.windll.kernel32.VirtualProtect(shellcode_buffer, len(shellcode), 0x20, ctypes.byref(ctypes.c_ulong()))
+
+        # Return wrapped syscall function
+        return ctypes.cast(shellcode_buffer, ctypes.WINFUNCTYPE(result_type, *arguments_types))
+
+    def clean_up(self, function_name: str) -> None:
+        """Cleans up syscall wrapper, deallocates it's shellcode buffer."""
+
+        # If function found
+        if (address := self.registred_syscalls_table[id(self)].get(function_name)) is not None:
+
+            # Deallocate syscall byffer
+            _VirtualFree(address)
+
+            # Clean up syscall table
+            del self.registred_syscalls_table[id(self)][function_name]

ntmemoryapi-1.3.0/src/ntmemoryapi/misc.py

@@ -1,102 +0,0 @@
-# +-------------------------------------+
-# |         ~ Author : Xenely ~         |
-# +=====================================+
-# | GitHub: https://github.com/Xenely14 |
-# | Discord: xenely                     |
-# +-------------------------------------+
-
-import ctypes
-import struct
-import typing
-import ctypes.wintypes
-
-# ==-------------------------------------------------------------------== #
-# DLL functions                                                           #
-# ==-------------------------------------------------------------------== #
-
-# DLL libraries loading
-_kernel32 = ctypes.windll.kernel32
-
-# DLL libraries functions loading
-_LoadLibraryA = _kernel32.LoadLibraryA
-_GetProcAddress = _kernel32.GetProcAddress
-_VirtualProtect = _kernel32.VirtualProtect
-
-# Define of DLL libraries functions return type
-_LoadLibraryA.restype = ctypes.wintypes.LPVOID
-_GetProcAddress.restype = ctypes.wintypes.LPVOID
-_VirtualProtect.restype = ctypes.wintypes.BOOL
-
-# Define of DLL libraries functions argument types
-_LoadLibraryA .argtypes = [ctypes.wintypes.LPCSTR]
-_GetProcAddress.argtypes = [ctypes.wintypes.LPVOID, ctypes.wintypes.LPCSTR]
-_VirtualProtect.argtypes = [ctypes.wintypes.LPVOID, ctypes.c_size_t, ctypes.wintypes.DWORD, ctypes.POINTER(ctypes.wintypes.DWORD)]
-
-
-# ==-------------------------------------------------------------------== #
-# Functions                                                               #
-# ==-------------------------------------------------------------------== #
-def syscall(nt_function_name: str, *, result_type: typing.Any, arguments_types: list[typing.Any], module: bytes = b"ntdll.dll") -> ctypes.WINFUNCTYPE:
-    """Finds function in DLL module by it name, retrieves it's syscall ID, wraps it into raw function buffer and casts to `WINFUNCTYPE` to make call shadowed."""
-
-    # Module loading
-    if not (module_handle := _LoadLibraryA(module)):
-        raise Exception("Unable to load module `%s`" % module.decode())
-
-    # Retrieve nt-function pointer
-    if not (nt_function := _GetProcAddress(module_handle, nt_function_name.encode())):
-        raise Exception("Function `%s` not found" % nt_function_name)
-
-    offset = 0
-    syscall_id = None
-
-    # Retrieve syscall ID from nt-function pointer
-    while True:
-
-        # Syscall ID not found
-        if offset > 0x16:
-            break
-
-        # Retrieve syscall ID from memory
-        if ctypes.cast(nt_function + offset, ctypes.POINTER(ctypes.c_ubyte)).contents.value == 0xB8:
-            syscall_id = ctypes.cast(nt_function + offset + 1, ctypes.POINTER(ctypes.c_ushort)).contents.value
-            break
-
-        offset += 1
-
-    # Syscall ID not found
-    if syscall_id is None:
-        raise Exception("Syscall ID for function `%s` not found" % nt_function_name)
-
-    # Convert syscall ID to hex-bytes list
-    syscall_id_bytes = [hex(item)[2:] if len(hex(item)[2:]) == 2 else "0" + hex(item)[2:] for item in struct.pack("<h", syscall_id)]
-
-    # NOTE: I actually don't know why does this code require access `gs` segment.
-    # I've just used this repo as reference: https://github.com/opcode86/SysCaller
-    #
-    # mov rax, gs:[0x60]
-    # mov r10, rcx
-    # mov eax, <syscall id>,
-    # syscall
-    # ret
-    shellcode = bytes.fromhex("""
-        65 48 8B 04 25 60 00
-        00 00
-        4C 8B D1
-        B8 %s %s 00 00
-        0F 05
-        C3
-    """ % tuple([*syscall_id_bytes]))
-
-    # Allocate buffer for function machine code
-    buffer = (ctypes.c_uint8 * len(shellcode))()
-    shellcode_buffer = ctypes.cast(buffer, ctypes.c_void_p)
-
-    # Copy shellcode into function machine code buffer
-    ctypes.memmove(shellcode_buffer, ctypes.create_string_buffer(shellcode, len(shellcode)), len(shellcode))
-
-    # Update of function machine code buffer memory protection to make it executable
-    ctypes.windll.kernel32.VirtualProtect(shellcode_buffer, len(shellcode), 0x40, ctypes.wintypes.LPDWORD(ctypes.wintypes.DWORD()))
-
-    # Return wrapped syscall function
-    return ctypes.cast(shellcode_buffer, ctypes.WINFUNCTYPE(result_type, *arguments_types))