Contents
How to do code injection in Python using Ctype?
In order to perform this check, i’ve decided to wrote a little PoC for 32bit systems dedicated to this test. So, using Python and ctype library i’ve developed a simple script which, using CreateRemoteThread windows API, inject a simple shellcode into a trusted process.
How to use ctypes to access a C # DLL in Python?
Use some sort of Python to .NET bridge. Write the DLL in C and use ctypes to call the function and handle the data conversions. Use the Python/C API and create a loadable Python module. I can’t speak to option #1, I have not done it.
How to test for process injection in Python?
One of the crucial step of the test was the proper functioning of memory monitoring feature, useful in case of process injection: infact, when a trusted process has been started, an attacker may use it as vector for inject a malicious code. In order to perform this check, i’ve decided to wrote a little PoC for 32bit systems dedicated to this test.
How is ctypes used to pass parameters by reference?
ctypes exports the byref () function which is used to pass parameters by reference. The same effect can be achieved with the pointer () function, although pointer () does a lot more work since it constructs a real pointer object, so it is faster to use byref () if you don’t need the pointer object in Python itself:
How to access a DLL in Python using ctypes?
I’m trying to access some functions in a dll ( nss3.dll) that ships with Firefox web browser. To handle this task I have used ctypes in Python. The problem is that it fails at the initial point which is when loading the dll in to the memory. This is the code snippet that I have to do so.
What does it mean to hook an API?
API hooking covers a range of techniques for altering or augmenting the behavior of an operating system (OS), application, or other software component by intercepting API function calls, messages, or events passed between software components. Code that handles such interception is called a hook.