python灰帽子--调试基础（结构体及常量定义）

此文章为调试基础篇常量及结构体的定义

# coding=utf-8
from ctypes import *
WORD = c_ushort
DWORD = c_ulong
BYTE = c_ubyte
LPBYTE = POINTER(c_ubyte)
LPTSTR = POINTER(c_char)
HANDLE = c_void_p
PVOID = c_void_p
ULONG_PTR = c_ulong
LPVOID = c_void_p
UINT_PTR = c_ulong
SIZE_T = c_ulong
DWORD64 = c_ulonglong
LONG = c_long

DEBUG_PROCESS = 0X00000001  #以调试状态启动
CREATE_NEW_CONSOLE=0x00000010 #独占一个控制台（以单独进程运行）

######进程权限
DELETE = 0x00010000
READ_CONTROL = 0x00020000
WRITE_OWNER = 0x00080000
SYNCHRONIZE = 0x00100000

PROCESS_CREATE_PROCESS = 0x0080
PROCESS_CREATE_THREAD = 0x0002
PROCESS_DUP_HANDLE = 0x0040
PROCESS_QUERY_INFORMATION = 0x0400
PROCESS_QUERY_LIMITED_INFORMATION = 0x1000
PROCESS_SET_INFORMATION = 0x0200
PROCESS_SET_QUOTA = 0x0100
PROCESS_SUSPEND_RESUME = 0x0800
PROCESS_TERMINATE = 0x0001
PROCESS_VM_OPERATION = 0x0008
PROCESS_VM_READ = 0x0010
PROCESS_VM_WRITE = 0x0020
PROCESS_ALL_ACCESS = 0x001F0FFF #该值表示目标进程的所有访问权限


#####线程权限
THREAD_DIRECT_IMPERSONATION = 0x0200
THREAD_GET_CONTEXT = 0x0008
THREAD_IMPERSONATE = 0x0100
THREAD_QUERY_INFORMATION = 0x0040
THREAD_QUERY_LIMITED_INFORMATION = 0x0800
THREAD_SET_CONTEXT = 0x0010
THREAD_SET_INFORMATION = 0x0020
THREAD_SET_LIMITED_INFORMATION = 0x0400
THREAD_SET_THREAD_TOKEN = 0x0080
THREAD_SUSPEND_RESUME = 0x0002
THREAD_TERMINATE = 0x0001
THREAD_ALL_ACCESS = 0x001F03FF #表示包括以上所有访问权限

######调试状态
INFINITE = 0xffffffff   #表示时间无限
DBG_CONTINUE = 0x00010002
DBG_EXCEPTION_NOT_HANDLE = 0x80010001

######快照信息
TH32CS_INHERIT = 0x80000000
TH32CS_SNAPHEAPLIST = 0x00000001
TH32CS_SNAPMODULE = 0x00000008
TH32CS_SNAPMODULE32 = 0x00000010
TH32CS_SNAPPROCESS = 0x00000002
TH32CS_SNAPTHREAD = 0x00000004  #表示收集进程快照内所有线程

TH32CS_SNAPALL = 0x0000000F #包含进程类型、线程类型、模块类型、堆类型。

##########################

CONTEXT_CONTROL = 0x00010001  #SS:SP, CS:IP, FLAGS, BP
CONTEXT_INTEGER = 0x00010002  #AX, BX, CX, DX, SI, DI
CONTEXT_SEGMENTS = 0x00010004  #DS, ES, FS, GS
CONTEXT_FLOATING_POINT = 0x00010008
CONTEXT_DEBUG_REGISTERS = 0x00010010  #DB 0-3,6,7
CONTEXT_EXTENDED_REGISTERS = 0x00010020
CONTEXT_FULL = 0x00010007

######DEBUG_EVENT事件码定义
EXCEPTION_DEBUG_EVENT = 0x01
CREATE_THREAD_DEBUG_EVENT = 0x2
CREATE_PROCESS_DEBUG_EVENT = 0x3
EXIT_THREAD_DEBUG_EVENT = 0x4
EXIT_PROCESS_DEBUG_EVENT = 0x5
LOAD_DLL_DEBUG_EVENT = 0x6
UNLOAD_DLL_DEBUG_EVENT = 0x7
OUTPUT_DEBUG_STRING_EVENT = 0x8
RIP_EVENT = 0x9

#####异常状态码
EXCEPTION_ACCESS_VIOLATION = 0xC0000005
EXCEPTION_BREAKPOINT = 0x80000003
EXCEPTION_GUARD_PAGE = 0x80000001
EXCEPTION_SINGLE_STEP = 0x80000004

#####调试寄存器DR7标志位
HW_ACCESS = 0X00000003
HW_EXECUTE = 0X00000000
HW_WRITE = 0X00000001

#窗口状态 STARTUPINFO结构， 用于在创建子进程时设置各种属性
class STARTUPINFO(Structure):
    _fields_=[
        ("cb",DWORD),
        ("lpReserved",LPTSTR),
        ("lpDesktop",LPTSTR),
        ("lpTitle",LPTSTR),
        ("dwX",DWORD),
        ("dwY",DWORD),
        ("dwXSize",DWORD),
        ("dwYSize",DWORD),
        ("dwXCountChars",DWORD),
        ("dwYCountChars",DWORD),
        ("dwFillAttribute",DWORD),
        ("dwFlags",DWORD),
        ("wShowWindow",WORD),
        ("cbReserved2",WORD),
        ("lpReserved2",WORD),
        ("lpReserved2",LPBYTE),
        ("hStdInput",HANDLE),
        ("hStdOutpu",HANDLE),
        ("hStdError",HANDLE),
    ]

#进程信息 PROCESS_INFORMATION 结构，用来在进程创建后接收相关信息，该结构由系统填写
class PROCESS_INFORMATION(Structure):
    _fields_=[
        ("hProcess",HANDLE),
        ("hThread",HANDLE),
        ("dwProcessId",DWORD),
        ("dwThreadId",DWORD),
    ]

#################################
#调试事件信息
class EXCEPTION_RECORD(Structure):
    pass
EXCEPTION_RECORD._fields_=[
    ("ExceptionCode",DWORD),
    ("ExceptionFlags",DWORD),
    ("ExceptionRecord",POINTER(EXCEPTION_RECORD)),
    ("ExceptionAddress",PVOID),
    ("NumberParameters",DWORD),
    ("ExceptionInfomation",UINT_PTR*15),
]
class EXCEPTION_DEBUG_INFO(Structure):
    _fields_ = [
        ("ExceptionRecord",EXCEPTION_RECORD),
        ("dwFistChance",DWORD),
    ]

class _DEBUG_EVENT_UNION(Union):
    _fields_=[
        ("Exception",EXCEPTION_DEBUG_INFO),
        #("CreateThread",CREATE_THREAD_DEBUG_INFO),
        #("CreateProcessInfo",CREATE_PROCESS_DEBUG_INFO),
        #("ExitThread",EXIT_THREAD_DEBUG_INFO),
        #("ExitProcess",EXIT_PROCESS_DEBUG_INFO),
        #("LoadDll",LOAD_DLL_DEBUG_INFO),
        #("UnloadDll",UNLOAD_DALL_DEBUG_INFO),
        #("DebugString",OUTPU_DEBUG_STRING_INFO),
        #("RipInfo",RIP_INFO),
    ]
#DEBUG_EVEN结构，描述了调试事件的内容
class DEBUG_EVENT(Structure):
    _fields_=[
        ("dwDebugEventCode",DWORD),
        ("dwProcessId",DWORD),
        ("dwThreadId",DWORD),
        ("u",_DEBUG_EVENT_UNION)
    ]

#THREADENTRY32结构，包含线程的相关信息
class THREADENTRY32(Structure):
    _fields_=[
        ("dwSize",DWORD),
        ("cntUsage",DWORD),
        ("th32ThreadID",DWORD),
        ("th32OwnerProcessID",DWORD),
        ("tpBasePri",LONG),
        ("tpDeltaPri",LONG),
        ("dwFlags",DWORD),
    ]

class M128A(Structure):
    _fields_=[
        ('Low',DWORD64),
        ('High',DWORD64)
    ]
class DUMMYSTRUCTNAME(Structure):
    _fields_ = [
        ("Header",M128A*2),
        ("Legacy", M128A*8),
        ("Xmm0", M128A),
        ("Xmm1", M128A),
        ("Xmm2", M128A),
        ("Xmm3", M128A),
        ("Xmm4", M128A),
        ("Xmm5", M128A),
        ("Xmm6", M128A),
        ("Xmm7", M128A),
        ("Xmm8", M128A),
        ("Xmm9", M128A),
        ("Xmm10", M128A),
        ("Xmm11", M128A),
        ("Xmm12", M128A),
        ("Xmm13", M128A),
        ("Xmm14", M128A),
        ("Xmm15", M128A),
    ]
class XMM_SAVE_AREA32(Structure):
    _pack_ = 1
    _fields_ = [
        ('ControlWord',WORD),
        ('StatusWord',WORD),
        ('TagWord',BYTE),
        ('Reserved1',BYTE),
        ('ErrorOpcode',WORD),
        ('ErrorOffset',DWORD),
        ('ErrorSelector',WORD),
        ('Reserved2',WORD),
        ('DataOffset',DWORD),
        ('DataSelector',WORD),
        ('Reserved3',WORD),
        ('MxCsr',DWORD),
        ('MxCsr_Mask',DWORD),
        ('FloatRegister',M128A*8),
        ('XmmRegister',M128A*16),
        ('Reserved4',BYTE*96)
    ]
class DUMMYUNIONNAME(Union):
    _fields_=[
        ("FltSave",XMM_SAVE_AREA32),
        ("DummyStruct",DUMMYSTRUCTNAME),
    ]
#64位系统CONTEXT结构体
class WOW64_CONTEXT(Structure):
    _pack_=16
    _fields_=[
        ("P1Home",DWORD64),
        ("P2Home",DWORD64),
        ("P3Home",DWORD64),
        ("P4Home",DWORD64),
        ("P5Home",DWORD64),
        ("P6Home",DWORD64),

        ("ContextFlags",DWORD),
        ("MxCsr",DWORD),

        ("SegCs",WORD),
        ("SegDs",WORD),
        ("SegEs",WORD),
        ("SegFs",WORD),
        ("SegGs",WORD),
        ("SegSs",WORD),
        ("EFlags",DWORD),

        ("Dr0",DWORD64),
        ("Dr1",DWORD64),
        ("Dr2",DWORD64),
        ("Dr3",DWORD64),
        ("Dr6",DWORD64),
        ("Dr7",DWORD64),

        ("Rax",DWORD64),
        ("Rcx",DWORD64),
        ("Rdx",DWORD64),
        ("Rbx",DWORD64),
        ("Rsp",DWORD64),
        ("Rbp",DWORD64),
        ("Rsi",DWORD64),
        ("Rdi",DWORD64),
        ("R8",DWORD64),
        ("R9",DWORD64),
        ("R10",DWORD64),
        ("R11", DWORD64),
        ("R12", DWORD64),
        ("R13", DWORD64),
        ("R14", DWORD64),
        ("R15", DWORD64),
        ("Rip",DWORD64),

        ("DebugControl",DWORD64),
        ("LastBranchToRip", DWORD64),
        ("LastBranchFromRip", DWORD64),
        ("LastExceptionToRip", DWORD64),
        ("LastExceptionFromRip", DWORD64),

        ("DUMMYUNIONNAME",DUMMYUNIONNAME),

        ("VectorRegister",M128A * 26),
        ("VectorControl",DWORD64)
    ]

class FLOATING_SAVE_AREA(Structure):
    _fields_ = [

        ("ControlWord", DWORD),
        ("StatusWord", DWORD),
        ("TagWord", DWORD),
        ("ErrorOffset", DWORD),
        ("ErrorSelector", DWORD),
        ("DataOffset", DWORD),
        ("DataSelector", DWORD),
        ("RegisterArea", BYTE * 80),
        ("Cr0NpxState", DWORD),
    ]
#32位系统CONTEXT结构体
class CONTEXT(Structure):
    _fields_ = [
        ("ContextFlags", DWORD),
        ("Dr0", DWORD),
        ("Dr1", DWORD),
        ("Dr2", DWORD),
        ("Dr3", DWORD),
        ("Dr6", DWORD),
        ("Dr7", DWORD),
        ("FloatSave", FLOATING_SAVE_AREA),
        ("SegGs", DWORD),
        ("SegFs", DWORD),
        ("SegEs", DWORD),
        ("SegDs", DWORD),
        ("Edi", DWORD),
        ("Esi", DWORD),
        ("Ebx", DWORD),
        ("Edx", DWORD),
        ("Ecx", DWORD),
        ("Eax", DWORD),
        ("Ebp", DWORD),
        ("Eip", DWORD),
        ("SegCs", DWORD),
        ("EFlags", DWORD),
        ("Esp", DWORD),
        ("SegSs", DWORD),
        ("ExtendedRegisters", BYTE * 512),
    ]
    
class PROC_STRUCT(Structure):
    _fields_ = [
        ("wProcessorArchitecture", WORD),
        ("wReserved", WORD),
    ]
class SYSTEM_INFO_UNION(Union):
    _fields_ = [
        ("dsOemId", DWORD),
        ("sProcStruc", PROC_STRUCT),
    ]
class SYSTEM_INFO(Structure):
    _fields_ = [
        ("uSysInfo", SYSTEM_INFO_UNION),
        ("dwPageSize", DWORD),
        ("lpMinimumApplicationAddress", LPVOID),
        ("lpMaximumApplicationAddress", LPVOID),
        ("dwActiveProcessMask", DWORD),
        ("dwNumberOfProcessors", DWORD),
        ("dwProcessorType", DWORD),
        ("dwAllocationGranularity", DWORD),
        ("wProcessorLevel", WORD),
        ("wProcessorRevision", WORD),
    ]
class MEMORY_BASIC_INFORMATION(Structure):
    _fields_ = [
        ("BaseAddress", PVOID),
        ("AllocationBase", PVOID),
        ("AllocationProtect", DWORD),
        ("RegionSize",SIZE_T),
        ("State", DWORD),
        ("Protect", DWORD),
        ("Type", DWORD),
    ]