python内核 什么写的_Python：kernel32.CreateProcessA()它在做什么？

我目前正在学习调试器以及它们如何停止进程.

这是我的代码：

from ctypes import *

WORD = c_ushort

DWORD = c_ulong

LPBYTE = POINTER(c_ubyte)

LPTSTR = POINTER(c_char)

HANDLE = c_void_p

DEBUG_PROCESS = 0x00000001

CREATE_NEW_CONSOLE = 0x00000010

class STARTUPINFO(Structure):

_fields_ = [

("cb", DWORD),

("lpReserved", LPTSTR),

("lpDesktop", LPTSTR),

("lpTitle", LPTSTR),

("dwX", DWORD),

("dwY", DWORD),

("dwXSize", DWORD),

("dwYSize", DWORD),

("dwXCountChars", DWORD),

("dwYCountChars", DWORD),

("dwFillAttribute",DWORD),

("dwFlags", DWORD),

("wShowWindow", WORD),

("cbReserved2", WORD),

("lpReserved2", LPBYTE),

("hStdInput", HANDLE),

("hStdOutput", HANDLE),

("hStdError", HANDLE),

]

class PROCESS_INFORMATION(Structure):

_fields_ = [

("hProcess", HANDLE),

("hThread", HANDLE),

("dwProcessId", DWORD),

("dwThreadId", DWORD),

]

kernel32 = windll.kernel32

class debugger():

def __init__(self):

pass

def load(path_to_exe):

creation_flags = DEBUG_PROCESS

startupinfo = STARTUPINFO()

processinfo = PROCESS_INFORMATION()

startupinfo.dwFlags = 0x1

startupinfo.wShowWindow = 0x0

startupinfo.cb = sizeof(startupinfo)

if kernel32.CreateProcessA(path_to_exe,None,None,None,None,creation_flags,None,None,byref(startupinfo),byref(processinfo)):

print("[*] Process launched")

print("[*] PID: %d" % (PROCESS_INFORMATION.dwProcessId))

else:

print("[*] Error: 0x%08x." % (kernel32.GetLastError()))

debugger.load("C:\\WINDOWS\\system32\\calc.exe")

每当我运行它,它就会出错. :(我发现它之所以会出现错误的原因是因为kernel32.CreateProcessA返回false.我实际上正在跟随Gray hat python,我正在将此代码转换为python 3它.

我的问题是,kernel32.CreateProcessA正在做什么,为什么它返回false,我怎么能阻止它返回false？

任何帮助将非常感激！

解决方法:

您的代码中有几个错误：

第一个错误是调试器类的加载方法定义错误.在你的情况下,它最可能是staticmethod：

# . . .

# This decorator required to make method static

@staticmethod

def load(path_to_exe):

creation_flags = DEBUG_PROCESS

startupinfo = STARTUPINFO()

processinfo = PROCESS_INFORMATION()

startupinfo.dwFlags = 0x1

# . . .

如果创建了进程,则第二个错误在于打印：

if kernel32.CreateProcessA(path_to_exe,None,None,None,None,

creation_flags,None,None,

byref(startupinfo),byref(processinfo)):

print("[*] Process launched")

# ERROR AT THE LINE BELOW

# Your variant: print("[*] PID: %d" % (PROCESS_INFORMATION.dwProcessId))

# But it should be the structure itself not it "type"

print("[*] PID: %d" % (processinfo.dwProcessId))

else:

print("[*] Error: 0x%08x." % (kernel32.GetLastError()))

在我的情况下它是有效的(Windows XP).如果你的进程没有真正启动,你会得到类似的控制台消息：

[*] Error: 0x00000002

然后,如果你使用Python 3.x,你应该使用CreateProcessA而不是CreateProcessW函数,因为Python 3.x中的所有字符串都是unicode(在WinAPI中,所有函数都以’A’接受asci-strings结束,以’W’结尾接受unicode-字符串).更准确的答案是,如果你写了你的情况下发生了什么错误或异常.

标签：python,ctypes

来源： https://codeday.me/bug/20190729/1568751.html