Light

justasmasiulis / nt_wrapper Goto Github PK

View Code? Open in Web Editor NEW

417.0 21.0 87.0 548 KB

A wrapper library around native windows sytem APIs

License: Apache License 2.0

CMake 0.52% C++ 99.48%

cpp17 modern-cpp windows-internals system low-level reverse-engineering malware obfuscation native-api syscall

nt_wrapper's Introduction

nt_wrapper

A header only wrapper library around native windows system APIs.

WARNING: the API of version 2 is still unstable

Highlights of currently implemented features

System information:

Handles enumeration -> ntw::system::handles
Process enumeration -> ntw::system::processes
- Threads enumeration -> ntw::system::thread_info
Loaded drivers enumeration -> ntw::system::loaded_drivers
Memory operations with RAII constructs -> ntw::memory

Object manipulation:

Process -> ntw::ob::process
Thread -> ntw::ob::thread
File -> ntw::ob::file
Token -> ntw::ob::token
Registry -> ntw::ob::registry And more

Design goals

No exceptions - if a function can fail it will return a status code.
No overhead - every single abstraction is costless and is as fast as it can be.
Ease of developer use - it is a much more consistent and pleasant to work with compared to win32.

Why?

The main reason to choose this library over existing windows constructs are:

Speed - even with lazy_importer your code is likely to be faster compared to win32 API.
Ease of use - the language of choice is c++ and allows you to use modern alternatives to old C.
Obfuscation - it is a lot harder to reverse engineer an application which uses obfuscated imports or direct syscalls.

Installing dependencies using vcpkg

> git clone https://github.com/microsoft/vcpkg
> cd vcpkg
> ./bootstrap-vcpkg.sh
> ./vcpkg install phnt

nt_wrapper's People

Contributors

Stargazers

Watchers

nt_wrapper's Issues

refactor code to use a typedef for unsigned long

The code would get much shorter without the need to type all that.
However the question of ulong vs ulong_t arises

enumerate_regions max address is lower for windows 7

probably need to some other way to acquire max address

Check Valid Pointer

It would be great if you added pointer check.
Thx

Registry key implementation is broken

The registry key implementation is currently broken in default repo (v2), as all functions but create, open & set have been commented out.

Consider using vcpkg

Use span type instead of separate buffer pointer and argument types

Currently most APIs that accept a buffer also take some sort of delimiter. While windows uses byte sizes to acquire the end of buffers in c++ it is usually more idiomatic to have a pair of iterators instead of a pointer and size.

Create wrappers for various basic types

List of things to wrap:

OBJECT_ATTRIBUTES - ntw::obj::attributes, ntw::obj::attribute_options
ACCESS_MASK - ntw::access_builder, ntw::obj::process_access
NTSTATUS - ntw::status, ntw::facility, ntw::severity
UNICODE_STRING
SECURITY_DESCRIPTOR

ntw::system::processes::update() return status 0xC0000005

Add .clang-format file

name_info should get merged into object

Currently OBJECT_NAME_INFORMATION structure has a single UNICODE_STRING member. It would probably be the best to move the query for this straight into the basic_object structure and create a wrapper type around unicode_string that owns a resource.

Get rid of LI_NT calls

every API import call should be replaced with NTW_SYSCALL instead of LI_NT.

The objective of this is to get rid of lazy_importer dependency

Process Creation

Is there process creating feature?

I can't find code for it.

phnt licence

Heya,

The /deps/phnt/ directory needs to include the licence.txt 😄 https://github.com/processhacker/processhacker/blob/master/LICENSE.txt

dmex

Add an nt_status type

Currently functions return NT_STATUS (integer). The goal is to change this into some class type which would have member functions, overloaded operator bool.

Another possible addition to such type would be functional apis that execute given function based on the status value

Set up continuos integration

Should set up appveyor

Add missing tests for various components of the library

at the moment only ntw::system namespace and ntw::memory components are tested.
It would be great to have a test suite that covers most of the library.

Wrap all object API

List of things that should get into the object class

Will probably get turned into a free function:

NtWaitForMultipleObjects

Will probably be in a separate SECURITY_DESCRIPTOR wrapper class

NtSetSecurityObject
NtQuerySecurityObject

Recommend Projects

React

A declarative, efficient, and flexible JavaScript library for building user interfaces.
Vue.js

🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
Typescript

TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
TensorFlow

An Open Source Machine Learning Framework for Everyone
Django

The Web framework for perfectionists with deadlines.
Laravel

A PHP framework for web artisans
D3

Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

javascript

JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
web

Some thing interesting about web. New door for the world.
server

A server is a program made to process requests and deliver data to clients.
Machine learning

Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Visualization

Some thing interesting about visualization, use data art
Game

Some thing interesting about game, make everyone happy.

Recommend Org

Facebook

We are working to build community through open source technology. NB: members must have two-factor auth.
Microsoft

Open source projects and samples from Microsoft.
Google

Google ❤️ Open Source for everyone.
Alibaba

Alibaba Open Source for everyone
D3

Data-Driven Documents codes.
Tencent

China tencent open source team.