Python System.scan_processes方法代码示例

# 需要导入模块: from winappdbg import System [as 别名]
# 或者: from winappdbg.System import scan_processes [as 别名]
def get_explorer_pid():
    # Request debug privileges.
    System.request_debug_privileges()

    # Scan for running processes.
    system = System()
    try:
        system.scan_processes()
        #system.scan_process_filenames()
    except WindowsError:
        system.scan_processes_fast()

    # For each running process...
    for process in system.iter_processes():
        try:

            pid = process.get_pid()

            if pid in (0, 4, 8):
                continue

            if dev:
                print "* Process:", process.get_filename(), "Pid:", pid, "Time:", process.get_running_time()
            if process.get_filename() == "explorer.exe":
                if process.get_running_time() < 300000:
                    return pid

        # Skip processes we don't have permission to access.
        except WindowsError, e:
            if e.winerror == ERROR_ACCESS_DENIED:
                continue
            raise

# 需要导入模块: from winappdbg import System [as 别名]
# 或者: from winappdbg.System import scan_processes [as 别名]
def getPidsByImg(img):
	result = []
	system = System()
	system.scan_processes()
	for ( process, name ) in system.find_processes_by_filename( img ):
		result.append(process.get_pid())
	return result

# 需要导入模块: from winappdbg import System [as 别名]
# 或者: from winappdbg.System import scan_processes [as 别名]
def main():
    print "Process string extractor"
    print "by Mario Vilas (mvilas at gmail.com)"
    print

    if len(sys.argv) != 2:
        script = os.path.basename(sys.argv[0])
        print "  %s <pid>" % script
        print "  %s <process.exe>" % script
        return

    System.request_debug_privileges()

    try:
        pid = HexInput.integer(sys.argv[1])
    except Exception, e:
        s = System()
        s.scan_processes()
        pl = s.find_processes_by_filename(sys.argv[1])
        if not pl:
            print "Process not found: %s" % sys.argv[1]
            return
        if len(pl) > 1:
            print "Multiple processes found for %s" % sys.argv[1]
            for p, n in pl:
                print "\t%s: %s" % (p.get_pid(), n)
            return
        pid = pl[0][0].get_pid()
        s.clear()
        del s

# 需要导入模块: from winappdbg import System [as 别名]
# 或者: from winappdbg.System import scan_processes [as 别名]
def main():
    print "Process memory reader"
    print "by Mario Vilas (mvilas at gmail.com)"
    print

    if len(sys.argv) not in (4, 5):
        script = os.path.basename(sys.argv[0])
        print "  %s <pid> <address> <size> [binary output file]" % script
        print "  %s <process.exe> <address> <size> [binary output file]" % script
        return

    System.request_debug_privileges()

    try:
        pid = HexInput.integer(sys.argv[1])
    except:
        s = System()
        s.scan_processes()
        pl = s.find_processes_by_filename(sys.argv[1])
        if not pl:
            print "Process not found: %s" % sys.argv[1]
            return
        if len(pl) > 1:
            print "Multiple processes found for %s" % sys.argv[1]
            for p,n in pl:
                print "\t%s: %s" % (HexDump.integer(p),n)
            return
        pid = pl[0][0].get_pid()

    try:
        address = HexInput.integer(sys.argv[2])
    except Exception:
        print "Invalid value for address: %s" % sys.argv[2]
        return

    try:
        size = HexInput.integer(sys.argv[3])
    except Exception:
        print "Invalid value for size: %s" % sys.argv[3]
        return

    p = Process(pid)
    data = p.read(address, size)
##    data = p.peek(address, size)
    print "Read %d bytes from PID %d" % (len(data), pid)

    if len(sys.argv) == 5:
        filename = sys.argv[4]
        open(filename, 'wb').write(data)
        print "Written %d bytes to %s" % (len(data), filename)
    else:
        if win32.sizeof(win32.LPVOID) == win32.sizeof(win32.DWORD):
            width = 16
        else:
            width = 8
        print
        print HexDump.hexblock(data, address, width = width)

# 需要导入模块: from winappdbg import System [as 别名]
# 或者: from winappdbg.System import scan_processes [as 别名]
def show(search = None, wide = True):
    'show a table with the list of services'

    # Take a snapshot of the running processes.
    s = System()
    s.request_debug_privileges()
    try:
        s.scan_processes()
        s.scan_process_filenames()
    except WindowsError:
        s.scan_processes_fast()
    pid_list = s.get_process_ids()
    pid_list.sort()
    if not pid_list:
        print "Unknown error enumerating processes!"
        return

    # Get the filename of each process.
    filenames = dict()
    for pid in pid_list:
        p = s.get_process(pid)

        # Special process IDs.
        # PID 0: System Idle Process. Also has a special meaning to the
        #        toolhelp APIs (current process).
        # PID 4: System Integrity Group. See this forum post for more info:
        #        http://tinyurl.com/ycza8jo
        #        (points to social.technet.microsoft.com)
        #        Only on XP and above
        # PID 8: System (?) only in Windows 2000 and below AFAIK.
        #        It's probably the same as PID 4 in XP and above.
        if pid in (0, 4, 8):
            fileName = ""

        # Get the filename for all other processes.
        else:
            fileName = p.get_filename()
            if fileName:
                fileName = PathOperations.pathname_to_filename(fileName)
            else:
                fileName = ""

        # Remember the filename.
        filenames[pid] = fileName

    # Make the search string lowercase if given.
    if search is not None:
        search = search.lower()

    # Get the list of services.
    try:
        services = System.get_services()
    except WindowsError, e:
        print str(e)
        return

# 需要导入模块: from winappdbg import System [as 别名]
# 或者: from winappdbg.System import scan_processes [as 别名]
def main(argv):

    # Print the banner.
    print "SelectMyParent: Start a program with a selected parent process"
    print "by Mario Vilas (mvilas at gmail.com)"
    print "based on a Didier Stevens tool (https://DidierStevens.com)"
    print

    # Check the command line arguments.
    if len(argv) < 3:
        script = os.path.basename(argv[0])
        print "  %s <pid> <process.exe> [arguments]" % script
        return

    # Request debug privileges.
    system = System()
    system.request_debug_privileges()

    # Parse the parent process argument.
    try:
        dwParentProcessId = HexInput.integer(argv[1])
    except ValueError:
        dwParentProcessId = None
    if dwParentProcessId is not None:
        dwMyProcessId = win32.GetProcessId( win32.GetCurrentProcess() )
        if dwParentProcessId != dwMyProcessId:
            system.scan_processes_fast()
            if not system.has_process(dwParentProcessId):
                print "Can't find process ID %d" % dwParentProcessId
                return
    else:
        system.scan_processes()
        process_list = system.find_processes_by_filename(argv[1])
        if not process_list:
            print "Can't find process %r" % argv[1]
            return
        if len(process_list) > 1:
            print "Too many processes found:"
            for process, name in process_list:
                print "\t%d:\t%s" % (process.get_pid(), name)
            return
        dwParentProcessId = process_list[0][0].get_pid()

    # Parse the target process argument.
    filename = argv[2]
    if not os.path.exists(filename):
        try:
            filename = win32.SearchPath(None, filename, '.exe')[0]
        except WindowsError, e:
            print "Error searching for %s: %s" % (filename, str(e))
            return
        argv = list(argv)
        argv[2] = filename

# 需要导入模块: from winappdbg import System [as 别名]
# 或者: from winappdbg.System import scan_processes [as 别名]
 def testRunningProcesses(self):
     validator = MemoryValidatorClass()
     validator.Initialize("c:\\mem\\user\\")
     CounterMonitor.Start()
     System.request_debug_privileges()
     with UpdateCounterForScope("main"):
         system = System()
         system.scan_processes()
         totalProcesses = system.get_process_count()
         for processIndex, process in enumerate(system.iter_processes()):
             fileName = getattr(process, "fileName")
             pid = getattr(process, "dwProcessId")
             if not fileName or not pid:
                 continue
             validator.ImageName = fileName
             logging.info("---------------------------------------------")
             validator.Message = "[{}] fileName:{} pid:{}".format(processIndex, fileName, pid)
             logging.info(validator.Message)
             if not any(s in fileName for s in self.PROCESS_TO_SCAN):
                 continue
             print "------process {}/{} {}-------".format(processIndex, totalProcesses, fileName)
             with validator.ExceptionHandler("Failed comparing {0}".format(fileName)):
                 process.scan_modules()
                 mods = {}
                 for module in process.iter_modules():
                     baseDllName = ntpath.basename(module.get_filename().lower())
                     mod = {
                         "BaseDllName": baseDllName,
                         "FullDllName": module.get_filename().lower(),
                         "StartAddr": module.get_base(),
                         "EndAddr": module.get_base() + module.get_size(),
                         "SizeOfImage": module.get_size(),
                     }
                     if not mods.get(baseDllName):
                         mods[baseDllName] = []
                     mods[baseDllName].append(mod)
                 validator.BuildLoadedModuleAddressesFromWinAppDbg(mods)
                 totalMods = len(mods)
                 for modIndex, modList in enumerate(mods.itervalues()):
                     print "module {}/{} {}".format(modIndex, totalMods, modList[0]["BaseDllName"])
                     for modIndex, mod in enumerate(modList):
                         validator.InitializeModuleInfoFromWinAppDbg(mod)
                         with validator.ExceptionHandler("failed comparing {0}".format(mod)):
                             memoryData = process.read(validator.DllBase, validator.SizeOfImage)
                             if not memoryData:
                                 validator.Warn("failed to read memory data")
                                 continue
                             validator.CompareExe(memoryData, validator.FullDllPath)
     CounterMonitor.Stop()
     validator.DumpFinalStats()

# 需要导入模块: from winappdbg import System [as 别名]
# 或者: from winappdbg.System import scan_processes [as 别名]
def main():
    print "Process memory writer"
    print "by Mario Vilas (mvilas at gmail.com)"
    print

    if len(sys.argv) < 4:
        script = os.path.basename(sys.argv[0])
        print "  %s <pid> <address> {binary input file / hex data}" % script
        print "  %s <process.exe> <address> {binary input file / hex data}" % script
        return

    System.request_debug_privileges()

    try:
        pid = HexInput.integer(sys.argv[1])
    except Exception:
        s = System()
        s.scan_processes()
        pl = s.find_processes_by_filename(sys.argv[1])
        if not pl:
            print "Process not found: %s" % sys.argv[1]
            return
        if len(pl) > 1:
            print "Multiple processes found for %s" % sys.argv[1]
            for p,n in pl:
                print "\t%s: %s" % (HexDump.integer(p),n)
            return
        pid = pl[0][0].get_pid()

    try:
        address = HexInput.integer(sys.argv[2])
    except Exception:
        print "Invalid value for address: %s" % sys.argv[2]
        return

    filename = ' '.join(sys.argv[3:])
    if os.path.exists(filename):
        data = open(filename, 'rb').read()
        print "Read %d bytes from %s" % (len(data), filename)
    else:
        try:
            data = HexInput.hexadecimal(filename)
        except Exception:
            print "Invalid filename or hex block: %s" % filename
            return

    p = Process(pid)
    p.write(address, data)
    print "Written %d bytes to PID %d" % (len(data), pid)

# 需要导入模块: from winappdbg import System [as 别名]
# 或者: from winappdbg.System import scan_processes [as 别名]
def main():
    print "Process DLL injector"
    print "by Mario Vilas (mvilas at gmail.com)"
    print

    if len(sys.argv) != 3:
        script = os.path.basename(sys.argv[0])
        print "Injects a DLL into a running process."
        print "  %s <pid> <library.dll>" % script
        print "  %s <process.exe> <library.dll>" % script
        return

    System.request_debug_privileges()

    try:
        pid = HexInput.integer(sys.argv[1])
    except Exception:
        s = System()
        s.scan_processes()
        pl = s.find_processes_by_filename(sys.argv[1])
        if not pl:
            print "Process not found: %s" % sys.argv[1]
            return
        if len(pl) > 1:
            print "Multiple processes found for %s" % sys.argv[1]
            for p,n in pl:
                print "\t%12d: %s" % (p,n)
            return
        pid = pl[0][0].get_pid()
    print "Using PID %d (0x%x)" % (pid, pid)

    dll = sys.argv[2]
    print "Using DLL %s" % dll

    p = Process(pid)
    b = p.get_bits()
    if b != System.bits:
        print (
            "Cannot inject into a %d bit process from a %d bit Python VM!"
            % (b, System.bits)
        )
        return
    p.scan_modules()
    p.inject_dll(dll)

# 需要导入模块: from winappdbg import System [as 别名]
# 或者: from winappdbg.System import scan_processes [as 别名]
def find_hook_pid( procname ):
    global gpid
    global xp
    global oldpid

    s = System()
    s.request_debug_privileges()
    
    try:
        s.scan_processes()
        s.scan_process_filenames()
    except WindowsError:
        s.scan_processes_fast()
        
    pid_list = s.get_process_ids()
    pid_list.sort(reverse=True)
    
    if not pid_list:
        print "Unknown error enumerating processes!"
        # s = raw_input()
        sys.exit(1)
    
    for pid in pid_list:
        p = s.get_process(pid)
        fileName = p.get_filename()
        fname = str(fileName).lower()
        if dev:
            print "Process:", fname, "Pid:", pid
        if fname.find(procname) >= 0:
            if int(pid) != int(gpid):
                oldpid = gpid
                gpid = pid
                if procname.find("svchost.exe") >= 0:
                    gpid = int(get_svchost_pid())
                    return gpid
                elif procname.find("explorer.exe") >= 0:
                    gpid = int(get_explorer_pid())
                    return gpid
                else:
                    return pid
    return 0

# 需要导入模块: from winappdbg import System [as 别名]
# 或者: from winappdbg.System import scan_processes [as 别名]
def get_processes_list():
    """Take a snapshot and return the list of processes"""

    if sys.platform == 'win32':
        # (based on winappdbg examples)
        # Create a system snaphot
        system = System()

        # The snapshot is initially empty, so populate it
        system.scan_processes()

        process_ids = list(system.iter_process_ids())
        # winappdbg does not include our pid, add it manually
        process_ids.append(get_current_process_id())
        process_ids.sort()

        # Return the processes in the system snapshot (iterator)
        return (WinProcess(pid) for pid in process_ids)
    else:
        pids = psi.process.ProcessTable()

        return (LinuxProcess(pid) for pid in pids)

# 需要导入模块: from winappdbg import System [as 别名]
# 或者: from winappdbg.System import scan_processes [as 别名]

#.........这里部分代码省略.........
                        help="Create a new console process [default]")
    parser.add_option_group(commands)

    # Tracing options
    tracing = optparse.OptionGroup(parser, "Tracing options")
    tracing.add_option("--trace", action="store_const", const="trace",
                                                               dest="mode",
                      help="Set the single step mode [default]")
    if System.arch == win32.ARCH_I386:
        tracing.add_option("--branch", action="store_const", const="branch",
                                                                   dest="mode",
                          help="Set the step-on-branch mode (doesn't work on virtual machines)")
        tracing.add_option("--syscall", action="store_const", const="syscall",
                                                                   dest="mode",
                          help="Set the syscall trap mode")
##    tracing.add_options("--module", action="append", metavar="MODULES",
##                                                            dest="modules",
##                   help="only trace into these modules (comma-separated)")
##    debugging.add_option("--from-start", action="store_true",
##                  help="start tracing when the process is created [default]")
##    debugging.add_option("--from-entry", action="store_true",
##                  help="start tracing when the entry point is reached")
    parser.add_option_group(tracing)

    # Debugging options
    debugging = optparse.OptionGroup(parser, "Debugging options")
    debugging.add_option("--autodetach", action="store_true",
                  help="automatically detach from debugees on exit [default]")
    debugging.add_option("--follow", action="store_true",
                  help="automatically attach to child processes [default]")
    debugging.add_option("--trusted", action="store_false", dest="hostile",
                  help="treat debugees as trusted code [default]")
    debugging.add_option("--dont-autodetach", action="store_false",
                                                         dest="autodetach",
                  help="don't automatically detach from debugees on exit")
    debugging.add_option("--dont-follow", action="store_false",
                                                             dest="follow",
                  help="don't automatically attach to child processes")
    debugging.add_option("--hostile", action="store_true",
                  help="treat debugees as hostile code")
    parser.add_option_group(debugging)

    # Defaults
    parser.set_defaults(
        autodetach  = True,
        follow      = True,
        hostile     = False,
        windowed    = list(),
        console     = list(),
        attach      = list(),
##        modules     = list(),
        mode        = "trace",
    )

    # Parse and validate the command line options
    if len(argv) == 1:
        argv = argv + [ '--help' ]
    (options, args) = parser.parse_args(argv)
    args = args[1:]
    if not options.windowed and not options.console and not options.attach:
        if not args:
            parser.error("missing target application(s)")
        options.console = [ args ]
    else:
        if args:
            parser.error("don't know what to do with extra parameters: %s" % args)

    # Get the list of attach targets
    system = System()
    system.request_debug_privileges()
    system.scan_processes()
    attach_targets = list()
    for token in options.attach:
        try:
            dwProcessId = HexInput.integer(token)
        except ValueError:
            dwProcessId = None
        if dwProcessId is not None:
            if not system.has_process(dwProcessId):
                parser.error("can't find process %d" % dwProcessId)
            try:
                process = Process(dwProcessId)
                process.open_handle()
                process.close_handle()
            except WindowsError, e:
                parser.error("can't open process %d: %s" % (dwProcessId, e))
            attach_targets.append(dwProcessId)
        else:
            matched = system.find_processes_by_filename(token)
            if not matched:
                parser.error("can't find process %s" % token)
            for process, name in matched:
                dwProcessId = process.get_pid()
                try:
                    process = Process(dwProcessId)
                    process.open_handle()
                    process.close_handle()
                except WindowsError, e:
                    parser.error("can't open process %d: %s" % (dwProcessId, e))
                attach_targets.append( process.get_pid() )

# 需要导入模块: from winappdbg import System [as 别名]
# 或者: from winappdbg.System import scan_processes [as 别名]
def getPidByImg(img):
	system = System()
	system.scan_processes()
	for ( process, name ) in system.find_processes_by_filename( img ):
		return process.get_pid()
	return 0

# 需要导入模块: from winappdbg import System [as 别名]
# 或者: from winappdbg.System import scan_processes [as 别名]
def main(argv):
    'Main function.'

    # Print the banner.
    print "Process enumerator"
    print "by Mario Vilas (mvilas at gmail.com)"
    print

    # Parse the command line options.
    (options, argv)  = parse_cmdline(argv)
    showFilenameOnly = not options.full_path
    searchString     = options.search

    # Windows filenames are case insensitive.
    if searchString:
        searchString = searchString.lower()

    # Take a snapshot of the running processes.
    s = System()
    s.request_debug_privileges()
    try:
        s.scan_processes()
        if not showFilenameOnly:
            s.scan_process_filenames()
    except WindowsError:
        s.scan_processes_fast()
    pid_list = s.get_process_ids()
    pid_list.sort()
    if not pid_list:
        print "Unknown error enumerating processes!"
        return

    # Get the filename of each process.
    filenames = dict()
    for pid in pid_list:
        p = s.get_process(pid)
        fileName = p.get_filename()

        # Special process IDs.
        # PID 0: System Idle Process. Also has a special meaning to the
        #        toolhelp APIs (current process).
        # PID 4: System Integrity Group. See this forum post for more info:
        #        http://tinyurl.com/ycza8jo
        #        (points to social.technet.microsoft.com)
        #        Only on XP and above
        # PID 8: System (?) only in Windows 2000 and below AFAIK.
        #        It's probably the same as PID 4 in XP and above.
        if pid == 0:
            fileName = "[System Idle Process]"
        elif pid == 4:
            fileName = "[System Integrity Group]"
        elif pid == 8:
            fileName = "[System]"

        # Filename not available.
        elif not fileName:
            fileName = ""

        # Get the process pathname instead, if requested.
        elif showFilenameOnly:
            fileName = PathOperations.pathname_to_filename(fileName)

        # Filter the output with the search string.
        if searchString and searchString not in fileName.lower():
            continue

        # Remember the filename.
        filenames[pid] = fileName

    # Get the window captions if requested.
    # TODO: show window handles too if possible
    captions = dict()
    if options.windows:
        for w in s.get_windows():
            try:
                pid = w.get_pid()
                text = w.get_text()
            except WindowsError:
                continue
            try:
                captions[pid].add(text)
            except KeyError:
                capset = set()
                capset.add(text)
                captions[pid] = capset

    # Get the services if requested.
    services = dict()
    if options.services:
        try:
            for descriptor in s.get_services():
                try:
                    services[descriptor.ProcessId].add(descriptor.ServiceName)
                except KeyError:
                    srvset = set()
                    srvset.add(descriptor.ServiceName)
                    services[descriptor.ProcessId] = srvset
        except WindowsError, e:
            print "Error getting the list of services: %s" % str(e)
            return

# 需要导入模块: from winappdbg import System [as 别名]
# 或者: from winappdbg.System import scan_processes [as 别名]
                            ERROR_ACCESS_DENIED

# Prepare the table.
header = ( " PID ", "DEP ", "DEP-ATL ", "Permanent ", "Filename " )
separator = [ " " * len(x) for x in header ]
table = Table()
table.addRow( *header )
table.addRow( *separator )

# Request debug privileges.
System.request_debug_privileges()

# Scan for running processes.
system = System()
try:
    system.scan_processes()
    #system.scan_process_filenames()
except WindowsError:
    system.scan_processes_fast()

# For each running process...
for process in system.iter_processes():
    try:

        # Get the process ID.
        pid = process.get_pid()

        # Skip "special" process IDs.
        if pid in (0, 4, 8):
            continue