customWin32

Documentation

Overview

Package customWin32 provides a small subset of win32 bindings. For most win32 purposes, this project uses https://github.com/0xrawsec/golang-win32, however some wrappers are undesirable without exposing the lower level calls, thus these are implemented here.

Index

• Constants
• func ConvertSidToStringSid(sid *syscall.SID) (string, error)
• func CreateRemoteThreadMinimal(hProcess win32.HANDLE, startAddress uintptr) error
• func GetTokenOwner(token syscall.Token) (*syscall.SID, error)
• func ListThreads(pid int) ([]int, error)
• func OpenProcessToken(process syscall.Handle, desiredAccess uint32) (syscall.Token, error)
• func Process32NextW(hSnapshot win32.HANDLE, lpte k32.LPPROCESSENTRY32W) error
• func ReadProcessMemory(hProcess win32.HANDLE, lpBaseAddress win32.LPCVOID, buffer []byte) (int, error)
• func ResumeProcess(pid int) error
• func SuspendProcess(pid int) error
• func Thread32First(hSnapshot win32.HANDLE, lpte k32.LPTHREADENTRY32) error
• func Thread32Next(hSnapshot win32.HANDLE, lpte k32.LPTHREADENTRY32) error
• func UsernameFromSID(sid *syscall.SID) (string, error)
• type MemoryStatusEx
  • func GlobalMemoryStatusEx() (*MemoryStatusEx, error)
• type TokenOwner

Constants

const ERROR_NOT_ENOUGH_MEMORY = 0x8

Functions

func ConvertSidToStringSid

func ConvertSidToStringSid(sid *syscall.SID) (string, error)

BOOL ConvertSidToStringSidW(

PSID   Sid,
LPWSTR *StringSid

);

func CreateRemoteThreadMinimal

func CreateRemoteThreadMinimal(hProcess win32.HANDLE, startAddress uintptr) error

func GetTokenOwner

func GetTokenOwner(token syscall.Token) (*syscall.SID, error)

BOOL GetTokenInformation(

HANDLE                  TokenHandle,
TOKEN_INFORMATION_CLASS TokenInformationClass,
LPVOID                  TokenInformation,
DWORD                   TokenInformationLength,
PDWORD                  ReturnLength

);

func ListThreads

func ListThreads(pid int) ([]int, error)

func OpenProcessToken

func OpenProcessToken(process syscall.Handle, desiredAccess uint32) (syscall.Token, error)

BOOL OpenProcessToken(

HANDLE  ProcessHandle,
DWORD   DesiredAccess,
PHANDLE TokenHandle

);

func Process32NextW

func Process32NextW(hSnapshot win32.HANDLE, lpte k32.LPPROCESSENTRY32W) error

func ReadProcessMemory

func ReadProcessMemory(hProcess win32.HANDLE, lpBaseAddress win32.LPCVOID, buffer []byte) (int, error)

func ResumeProcess

func ResumeProcess(pid int) error

func SuspendProcess

func SuspendProcess(pid int) error

func Thread32First

func Thread32First(hSnapshot win32.HANDLE, lpte k32.LPTHREADENTRY32) error

func Thread32Next

func Thread32Next(hSnapshot win32.HANDLE, lpte k32.LPTHREADENTRY32) error

Thread32Next Win32 API wrapper

func UsernameFromSID

func UsernameFromSID(sid *syscall.SID) (string, error)

BOOL LookupAccountSidW(

LPCWSTR       lpSystemName,
PSID          Sid,
LPWSTR        Name,
LPDWORD       cchName,
LPWSTR        ReferencedDomainName,
LPDWORD       cchReferencedDomainName,
PSID_NAME_USE peUse

);

Types

type MemoryStatusEx

type MemoryStatusEx struct {
	Length               win32.DWORD
	MemoryLoad           win32.DWORD
	TotalPhys            win32.DWORDLONG
	AvailPhys            win32.DWORDLONG
	TotalPageFile        win32.DWORDLONG
	AvailPageFile        win32.DWORDLONG
	TotalVirtual         win32.DWORDLONG
	AvailVirtual         win32.DWORDLONG
	AvailExtendedVirtual win32.DWORDLONG
}

func GlobalMemoryStatusEx

func GlobalMemoryStatusEx() (*MemoryStatusEx, error)

type TokenOwner

type TokenOwner C.TOKEN_OWNER