0.  相关基础知识1. Deviare API Hook Overview2. 使用ctypes调用Windows API3. pydbg4. winappdbg5. dll injection6. process monitor with WMI7. sobek-hids

from ctypes import windll def callc():     # load the some.dll     somelibc = windll.LoadLibrary(some.dll)     print somelibc. helloworld() if __name__== “__main__”:     callc()

http://www.ibm.com/developerworks/cn/linux/l-cn-pythonandc/

该框架使用的是process inline hook的思路，通过writeprocessmemory方式修改指定进程的指定api入口为hook function，待hook function执行完毕后再跳转回原始的被劫持函数

1. Install Python 2.7.32. Register DeviareCOM.dll and DeviareCOM64.dll (if running under an x64 platform).http://www.initdll.de/deviarecom64.dll/en-download-62999.htmlhttp://www.initdll.de/deviarecom.dll/en-download-62982.htmlregsvr32 DeviareCOM.dllregsvr32 DeviareCOM64.dllpushd C:\Windows\System32右键以管理员方式启动cmd.exe，然后调用regsvr32方可成功3. Download and install Python Win32 Extensionshttp://sourceforge.net/projects/pywin32/files/pywin32NOTE: Be careful to download the appropriate version for your platform and Python version.NOTE 2: If you get a message stating that you haven‘t installed Python in your system yet (but you did and you are completely sure that you downloaded the correct Python Win32 Extensions installer) 

https://github.com/nektra/deviare2http://www.nektra.com/products/deviare-api-hook-windows/doc-v2/interface_deviare2_1_1_d_nkt_hook_events.htmlhttp://www.nektra.com/products/deviare-api-hook-windows/design/https://github.com/srw/windows-api-hooking-in-python-with-deviare-samplehttp://blog.nektra.com/main/category/products/deviare-products/

HHOOK WINAPI SetWindowsHookEx(  _In_ int       idHook,  _In_ HOOKPROC  lpfn,  _In_ HINSTANCE hMod,  _In_ DWORD     dwThreadId);1. idHook [in]: The type of hook procedure to be installed. This parameter can be one of the following values    1) WH_CALLWNDPROC: Installs a hook procedure that monitors messages before the system sends them to the destination window procedure.     2) WH_CALLWNDPROCRET: Installs a hook procedure that monitors messages after they have been processed by the destination window procedure.      3) WH_CBT: Installs a hook procedure that receives notifications useful to a CBT application.     4) WH_DEBUG: Installs a hook procedure useful for debugging other hook procedures.     5) WH_FOREGROUNDIDLE: Installs a hook procedure that will be called when the application‘s foreground thread is about to become idle. This hook is useful for performing low priority tasks during idle time.      6) WH_GETMESSAGE: Installs a hook procedure that monitors messages posted to a message queue.      7) WH_JOURNALPLAYBACK: Installs a hook procedure that posts messages previously recorded by a WH_JOURNALRECORD hook procedure     8) WH_JOURNALRECORD: Installs a hook procedure that records input messages posted to the system message queue. This hook is useful for recording macros.     9) WH_KEYBOARD: Installs a hook procedure that monitors keystroke messages.     10) WH_KEYBOARD_LL: Installs a hook procedure that monitors low-level keyboard input events.     11) WH_MOUSE: Installs a hook procedure that monitors mouse messages.      12) WH_MOUSE_LL: Installs a hook procedure that monitors low-level mouse input events.      13) WH_MSGFILTER: Installs a hook procedure that monitors messages generated as a result of an input event in a dialog box, message box, menu, or scroll bar.      14) WH_SHELL: Installs a hook procedure that receives notifications useful to shell applications.     15) WH_SYSMSGFILTER: Installs a hook procedure that monitors messages generated as a result of an input event in a dialog box, message box, menu, or scroll bar. The hook procedure monitors these messages for all applications in the same desktop as the calling thread. 2. lpfn [in] : A pointer to the hook procedure. If the dwThreadId parameter is zero or specifies the identifier of a thread created by a different process, the lpfn parameter must point to a hook procedure in a DLL. Otherwise, lpfn can point to a hook procedure in the code associated with the current process.3. hMod [in]: A handle to the DLL containing the hook procedure pointed to by the lpfn parameter. The hMod parameter must be set to NULL if the dwThreadId parameter specifies a thread created by the current process and if the hook procedure is within the code associated with the current process.4. dwThreadId [in]: The identifier of the thread with which the hook procedure is to be associated. For desktop apps, if this parameter is zero, the hook procedure is associated with all existing threads running in the same desktop as the calling thread.  

https://msdn.microsoft.com/en-us/library/windows/desktop/ms644990(v=vs.85).aspxhttp://stackoverflow.com/questions/31379169/setting-up-a-windowshook-in-python-ctypes-windows-apihttps://github.com/schurpf/pyhk/blob/master/pyhk.pyhttp://www.cnblogs.com/oubo/archive/2011/08/25/2394555.htmlhttp://www.cs.unc.edu/Research/assist/developer.shtmlhttp://reverseengineering.stackexchange.com/questions/2715/api-hooking-using-dll-injection-with-python-c-types

https://github.com/OpenRCE/pydbghttps://github.com/debasishm89/qHooKhttp://blog.csdn.net/cheng_tian/article/details/7652058https://github.com/debasishm89/qHooKhttps://raw.githubusercontent.com/debasishm89/qHooK/master/qHooK.pyhttps://my.oschina.net/dkexcellent/blog/38717

from winappdbg import *from time import time# Using the Debug object in a "with" context ensures proper cleanup.with Debug( bKillOnExit = True ) as dbg:    # Run the Windows Calculator (calc.exe).    dbg.execl(‘calc.exe‘)    # For the extra paranoid: this makes sure calc.exe dies    # even if our own process is killed from the Task Manager.    System.set_kill_on_exit_mode(True)    # The execution time limit is 5 seconds.    maxTime = time() + 5    # Loop while calc.exe is alive and the time limit wasn‘t reached.    while dbg and time() < maxTime:        try:            # Get the next debug event.            dbg.wait(1000)  # 1 second accuracy            # Show the current time on screen.            print time()        # If wait() times out just try again.        # On any other error stop debugging.        except WindowsError, e:            if e.winerror in (win32.ERROR_SEM_TIMEOUT,                              win32.WAIT_TIMEOUT):                continue            raise        # Dispatch the event and continue execution.        try:            dbg.dispatch()        finally:            dbg.cont()

import osimport sysimport zlibimport winappdbgfrom winappdbg import win32try:    import sqlite3 as sqliteexcept ImportError:    from pysqlite2 import dbapi2 as sqlite# Create a snaphot of running processes.system = winappdbg.System()system.request_debug_privileges()system.scan_processes()# Get all processes that match the requested filenames.for filename in sys.argv[1:]:    print "Looking for: %s" % filename    for process, pathname in system.find_processes_by_filename(filename):        pid  = process.get_pid()        bits = process.get_bits()        print "Dumping memory for process ID %d (%d bits)" % (pid, bits)        # Parse the database filename.        dbfile   = ‘%d.db‘ % pid        if os.path.exists(dbfile):            counter = 1            while 1:                dbfile = ‘%d_%.3d.db‘ % (pid, counter)                if not os.path.exists(dbfile):                    break                counter += 1            del counter        print "Creating database %s" % dbfile        # Connect to the database and get a cursor.        database = sqlite.connect(dbfile)        cursor   = database.cursor()        # Create the table for the memory map.        cursor.execute("""            CREATE TABLE MemoryMap (                Address INTEGER PRIMARY KEY,                Size    INTEGER,                State   STRING,                Access  STRING,                Type    STRING,                File    STRING,                Data    BINARY            )        """)        # Get a memory map of the process.        memoryMap       = process.get_memory_map()        mappedFilenames = process.get_mapped_filenames(memoryMap)        # For each memory block in the map...        for mbi in memoryMap:            # Address and size of memory block.            BaseAddress = mbi.BaseAddress            RegionSize  = mbi.RegionSize            # State (free or allocated).            if   mbi.State == win32.MEM_RESERVE:                State   = "Reserved"            elif mbi.State == win32.MEM_COMMIT:                State   = "Commited"            elif mbi.State == win32.MEM_FREE:                State   = "Free"            else:                State   = "Unknown"            # Page protection bits (R/W/X/G).            if mbi.State != win32.MEM_COMMIT:                Protect = ""            else:                if   mbi.Protect & win32.PAGE_NOACCESS:                    Protect = "--- "                elif mbi.Protect & win32.PAGE_READONLY:                    Protect = "R-- "                elif mbi.Protect & win32.PAGE_READWRITE:                    Protect = "RW- "                elif mbi.Protect & win32.PAGE_WRITECOPY:                    Protect = "RC- "                elif mbi.Protect & win32.PAGE_EXECUTE:                    Protect = "--X "                elif mbi.Protect & win32.PAGE_EXECUTE_READ:                    Protect = "R-X "                elif mbi.Protect & win32.PAGE_EXECUTE_READWRITE:                    Protect = "RWX "                elif mbi.Protect & win32.PAGE_EXECUTE_WRITECOPY:                    Protect = "RCX "                else:                    Protect = "??? "                if   mbi.Protect & win32.PAGE_GUARD:                    Protect += "G"                else:                    Protect += "-"                if   mbi.Protect & win32.PAGE_NOCACHE:                    Protect += "N"                else:                    Protect += "-"                if   mbi.Protect & win32.PAGE_WRITECOMBINE:                    Protect += "W"                else:                    Protect += "-"            # Type (file mapping, executable image, or private memory).            if   mbi.Type == win32.MEM_IMAGE:                Type    = "Image"            elif mbi.Type == win32.MEM_MAPPED:                Type    = "Mapped"            elif mbi.Type == win32.MEM_PRIVATE:                Type    = "Private"            elif mbi.Type == 0:                Type    = ""            else:                Type    = "Unknown"            # Mapped file name, if any.            FileName = mappedFilenames.get(BaseAddress, None)            # Read the data contained in the memory block, if any.            Data = None            if mbi.has_content():                print ‘Reading %s-%s‘ % (                    winappdbg.HexDump.address(BaseAddress, bits),                    winappdbg.HexDump.address(BaseAddress + RegionSize, bits)                )                Data = process.read(BaseAddress, RegionSize)                Data = zlib.compress(Data, zlib.Z_BEST_COMPRESSION)                Data = sqlite.Binary(Data)            # Output a row in the table.            cursor.execute(                ‘INSERT INTO MemoryMap VALUES (?, ?, ?, ?, ?, ?, ?)‘,                (BaseAddress, RegionSize, State, Protect, Type, FileName, Data)            )        # Commit the changes, close the cursor and the database.        database.commit()        cursor.close()        database.close()        print "Ok."print "Done."

https://pypi.python.org/pypi/winappdbg/1.5https://sourceforge.net/p/winappdbg/mailman/message/23259562/http://winappdbg.sourceforge.net/index.htmlhttp://winappdbg.sourceforge.net/MoreExamples.html

[Dynamic, Provider("CIMWin32"), SupportsCreate, CreateBy("Create"), SupportsDelete, DeleteBy("DeleteInstance"), UUID("{8502C4DC-5FBB-11D2-AAC1-006008C78BC7}"), DisplayName("Processes"), AMENDMENT]class Win32_Process : CIM_Process{  string   CreationClassName;  string   Caption;  string   CommandLine;  datetime CreationDate;  string   CSCreationClassName;  string   CSName;  string   Description;  string   ExecutablePath;  uint16   ExecutionState;  string   Handle;  uint32   HandleCount;  datetime InstallDate;  uint64   KernelModeTime;  uint32   MaximumWorkingSetSize;  uint32   MinimumWorkingSetSize;  string   Name;  string   OSCreationClassName;  string   OSName;  uint64   OtherOperationCount;  uint64   OtherTransferCount;  uint32   PageFaults;  uint32   PageFileUsage;  uint32   ParentProcessId;  uint32   PeakPageFileUsage;  uint64   PeakVirtualSize;  uint32   PeakWorkingSetSize;  uint32   Priority = NULL;  uint64   PrivatePageCount;  uint32   ProcessId;  uint32   QuotaNonPagedPoolUsage;  uint32   QuotaPagedPoolUsage;  uint32   QuotaPeakNonPagedPoolUsage;  uint32   QuotaPeakPagedPoolUsage;  uint64   ReadOperationCount;  uint64   ReadTransferCount;  uint32   SessionId;  string   Status;  datetime TerminationDate;  uint32   ThreadCount;  uint64   UserModeTime;  uint64   VirtualSize;  string   WindowsVersion;  uint64   WorkingSetSize;  uint64   WriteOperationCount;  uint64   WriteTransferCount;};

import win32conimport win32apiimport win32securityimport wmiimport sysimport isapidef log_to_file(message):    fd = open(‘process_monitor_log.csv‘, ‘ab‘)    fd.write("%s\r\n" % message)    fd.close()log_to_file("time,user,executable,commandline,pid,parent,pid,privileges")c = wmi.WMI()process_watcher = c.Win32_Process.watch_for(‘creation‘)while True:    try:        new_process = process_watcher()        cmdlline = new_process.CommandLine        print cmdlline    except:        pass

https://books.google.com.hk/books?id=9MS9BQAAQBAJ&pg=PA139&lpg=PA139&dq=windows+python+api+hook+createprocess&source=bl&ots=tYgj5EYO1D&sig=f8fDHsUanrebdAsWrg_GfWVBIFw&hl=zh-CN&sa=X&ved=0ahUKEwiSq9Luw9zQAhUHOCYKHeWyDlcQ6AEIUTAH#v=onepage&q=windows%20python%20api%20hook%20createprocess&f=falsehttps://books.google.com.hk/books?id=9MS9BQAAQBAJ&pg=PA139&lpg=PA139&dq=windows+python+api+hook+createprocess&source=bl&ots=tYgj5EYO1D&sig=f8fDHsUanrebdAsWrg_GfWVBIFw&hl=zh-CN&sa=X&ved=0ahUKEwiSq9Luw9zQAhUHOCYKHeWyDlcQ6AEIUTAH#v=onepage&q&f=falsehttps://technodesk.wordpress.com/2009/09/25/python-monitor-process-cpu-using-wmi/https://msdn.microsoft.com/en-us/library/aa394372%28v=vs.85%29.aspxhttp://python.jobbole.com/86349/https://code.google.com/archive/p/sobek-hids/downloadshttps://msdn.microsoft.com/en-us/library/aa393035(v=vs.85).aspxhttps://pypi.python.org/pypi/watchdoghttps://github.com/gorakhargosh/watchdoghttp://stackoverflow.com/questions/20610005/how-to-watch-the-windows-registry-for-changes-with-pythonhttps://msdn.microsoft.com/en-us/library/aa394394(v=vs.85).aspx