import sys
import os.path
sys.path.append(os.path.abspath(__file__ + "\..\.."))

import windows
import windows.native_exec.simple_x86 as x86
import windows.native_exec.simple_x64 as x64
# Here is our current process
cp = windows.current_process

print("current process is {cp}".format(cp=windows.current_process))
print("current process is a <{cp.bitness}> bits process".format(cp=cp))
print("current process is a SysWow64 process ? <{cp.is_wow_64}>".format(cp=cp))
print("current process pid <{cp.pid}>  and ppid <{cp.ppid}>".format(cp=cp))
print("Here are the current process threads: <{cp.threads}>".format(cp=cp))

print("Let's execute some native code ! (0x41 + 1)")

if windows.current_process.bitness == 32:
    # Let's generate some native code
    code =  x86.MultipleInstr()
    code += x86.Mov("Eax", 0x41)
    code += x86.Inc("EAX")
    code += x86.Ret()
else:
    code =  x64.MultipleInstr()
    code += x64.Mov("RAX", 0x41)
    code += x64.Inc("RAX")
    code += x64.Ret()

native_code = code.get_code()

v = windows.current_process.execute(native_code)
print("Native code returned <{0}>".format(hex(v)))

print("Allocating memory in current process")
addr = cp.virtual_alloc(0x1000) # Default alloc is RWX (so secure !)
print("Allocated memory is at <{0}>".format(hex(addr)))

print("Writing 'SOME STUFF' in allocation memory")
cp.write_memory(addr, "SOME STUFF")
print("Reading memory : <{0}>".format(repr(cp.read_memory(addr, 20))))

(cmd) python process\current_process.py
current process is <windows.winobject.process.CurrentProcess object at 0x000001DD8BC5CA10>
current process is a <64> bits process
current process is a SysWow64 process ? <False>
current process pid <26976>  and ppid <28256>
Here are the current process threads: <[<WinThread 15220 owner "CurrentProcess" at 0x1dd8d20b0d0>, <WinThread 27912 owner "CurrentProcess" at 0x1dd8d20afd0>, <WinThread 27832 owner "CurrentProcess" at 0x1dd8d20af10>, <WinThread 26820 owner "CurrentProcess" at 0x1dd8d20ae90>]>
Let's execute some native code ! (0x41 + 1)
Native code returned <0x42>
Allocating memory in current process
Allocated memory is at <0x1dd8d2f0000>
Writing 'SOME STUFF' in allocation memory
Reading memory : <b'SOME STUFF\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'>

import sys
import os.path
sys.path.append(os.path.abspath(__file__ + "\..\.."))

import windows
import windows.native_exec.simple_x86 as x86
import windows.native_exec.simple_x64 as x64

print("Creating a notepad") ## Replaced calc.exe by notepad.exe cause of windows 10.
notepad = windows.utils.create_process(r"C:\windows\system32\notepad.exe")
# You don't need to do that in our case, but it's useful to now
print("Looking for notepads in the processes")
all_notepads = [proc for proc in windows.system.processes if proc.name == "notepad.exe"]
print("They are currently <{0}> notepads running on the system".format(len(all_notepads)))

print("Let's play with our notepad: <{notepad}>".format(notepad=notepad))
print("Our notepad pid is {notepad.pid}".format(notepad=notepad))
print("Our notepad is a <{notepad.bitness}> bits process".format(notepad=notepad))
print("Our notepad is a SysWow64 process ? <{notepad.is_wow_64}>".format(notepad=notepad))
print("Our notepad have threads ! <{notepad.threads}>".format(notepad=notepad))

# PEB STUFF
peb = notepad.peb
print("Exploring our notepad PEB ! {peb}".format(peb=peb))
print("Command line is {peb.commandline}".format(peb=peb))
modules = peb.modules
print("Here are 3 loaded modules: {0}".format(modules[:3]))
# See iat_hook.py for module exploration


# Remote alloc / read / write

print("Allocating memory in our notepad")
addr = notepad.virtual_alloc(0x1000)
print("Allocated memory is at <{0}>".format(hex(addr)))
print("Writing 'SOME STUFF' in allocated memory")
notepad.write_memory(addr, "SOME STUFF")
print("Reading allocated memory : <{0}>".format(repr(notepad.read_memory(addr, 20))))


# Remote Execution

print("Execution some native code in our notepad (write 0x424242 at allocated address + return 0x1337)")

if notepad.bitness == 32:
    # Let's generate some native code
    code =  x86.MultipleInstr()
    code += x86.Mov(x86.deref(addr), 0x42424242)
    code += x86.Mov("EAX", 0x1337)
    code += x86.Ret()
else:
    code =  x64.MultipleInstr()
    code += x64.Mov('RAX', addr)
    code += x64.Mov(x64.mem("[RAX]"), 0x42424242)
    code += x64.Mov("RAX", 0x1337)
    code += x64.Ret()

print("Executing native code !")
t = notepad.execute(code.get_code())
t.wait()
print("Return code = {0}".format(hex(t.exit_code)))
print("Reading allocated memory : <{0}>".format(repr(notepad.read_memory(addr, 20))))

print("Executing python code !")
# Make 'windows' importable in remote python
notepad.execute_python("import sys; sys.path.append(r'{0}')".format(sys.path[-1]))

notepad.execute_python("import windows")
# Let's write in the notepad 'current_process' memory :)
notepad.execute_python("addr = {addr}; windows.current_process.write_memory(addr, 'HELLO FROM notepad')".format(addr=addr))
print("Reading allocated memory : <{0}>".format(repr(notepad.read_memory(addr, 20))))

# python_execute is 'safe':
# - it waits for the thread completion
# - it raise an error if remote code raised some

try:
    print("Trying to import in remote module 'FAKE_MODULE'")
    notepad.execute_python("def func():\n   import FAKE_MODULE\nfunc()")
except windows.injection.RemotePythonError as e:
    print("Exception in remote process!")
    print(e)

print("That's all ! killing the notepad")
notepad.exit()

(cmd) python process\remote_process.py
Creating a notepad
Looking for notepads in the processes
They are currently <1> notepads running on the system
Let's play with our notepad: <<WinProcess "notepad.exe" pid 8400 at 0x6238510>>
Our notepad pid is 8400
Our notepad is a <32> bits process
Our notepad is a SysWow64 process ? <True>
Our notepad have threads ! <[<WinThread 16028 owner "notepad.exe" at 0x6238f10>, <WinThread 5924 owner "notepad.exe" at 0x6238a10>, <WinThread 11620 owner "notepad.exe" at 0x6238fb0>, <WinThread 3480 owner "notepad.exe" at 0x6238ff0>, <WinThread 200 owner "notepad.exe" at 0x62389b0>, <WinThread 16804 owner "notepad.exe" at 0x62389f0>, <WinThread 13340 owner "notepad.exe" at 0x6238930>]>
Exploring our notepad PEB ! <windows.winobject.process.RemotePEB object at 0x061BDA80>
Command line is <Remote_LSA_UNICODE_STRING ""C:\windows\system32\notepad.exe"" at 0x61bdb20>
Here are 3 loaded modules: [<RemoteLoadedModule "notepad.exe" at 0x61bdad0>, <RemoteLoadedModule "ntdll.dll" at 0x61bd940>, <RemoteLoadedModule "kernel32.dll" at 0x61bd8f0>]
Allocating memory in our notepad
Allocated memory is at <0x6f00000>
Writing 'SOME STUFF' in allocated memory
Reading allocated memory : <'SOME STUFF\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'>
Execution some native code in our notepad (write 0x424242 at allocated address + return 0x1337)
Executing native code !
Return code = 0x1337L
Reading allocated memory : <'BBBB STUFF\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'>
Executing python code !
Reading allocated memory : <'HELLO FROM notepad\x00\x00'>
Trying to import in remote module 'FAKE_MODULE'
Exception in remote process!
Traceback (most recent call last):
  File "<string>", line 3, in <module>
  File "<string>", line 2, in func
ImportError: No module named FAKE_MODULE

That's all ! killing the notepad

import sys
import os.path
sys.path.append(os.path.abspath(__file__ + "\..\.."))

import windows

print("Exploring the current process PEB")
peb = windows.current_process.peb
print("PEB is <{0}>".format(peb))
commandline = peb.commandline
print("Commandline object is {0}".format(commandline))
print("Commandline string is {0}".format(repr(commandline.Buffer)))

imagepath = peb.imagepath
print("Imagepath  {0}".format(imagepath))

modules = peb.modules
print("Printing some modules: {0}".format("\n".join(str(m) for m in modules[:6])))

print("=== K32  ===")
print("Looking for kernel32.dll")
k32 = [m for m in modules if m.name == "kernel32.dll"][0]
print("Kernel32 module: {0}".format(k32))

print("Module name = <{0}> | Fullname = <{1}>".format(k32.name, k32.fullname))
print("Kernel32 is loaded at address {0}".format(hex(k32.baseaddr)))

print("=== K32 PE ===")
k32pe = k32.pe
print("PE Representation of k32: {0}".format(k32pe))
exports = k32pe.exports
some_exports = dict((k,v) for k,v in exports.items() if k in [0, 42, "VirtualAlloc", "CreateFileA"])
print("Here are some exports {0}".format(some_exports))

imports = k32pe.imports
print("Import DLL dependancies are (without api-*): {0}".format([x for x in imports.keys() if not x.startswith("api-")]))

NtCreateFile_iat = [x for x in imports["ntdll.dll"] if x.name == "NtCreateFile"][0]
print("IAT Entry for ntdll!NtCreateFile = {0} | addr = {1}".format(NtCreateFile_iat, hex(NtCreateFile_iat.addr)))
print("Sections: {0}".format(k32pe.sections))

(cmd) python process\peb.py
Exploring the current process PEB
PEB is <<windows.winobject.process.PEB object at 0x05A6F710>>
Commandline object is <_LSA_UNICODE_STRING "C:\Python27\python.exe  process\peb.py" at 0x5a6f8a0>
Commandline string is 47063282
Imagepath  <_LSA_UNICODE_STRING "C:\Python27\python.exe" at 0x5a6f990>
Printing some modules: <LoadedModule "python.exe" at 0x60d2080>
<LoadedModule "ntdll.dll" at 0x60d2030>
<LoadedModule "kernel32.dll" at 0x60d2b20>
<LoadedModule "kernelbase.dll" at 0x60d2b70>
<LoadedModule "python27.dll" at 0x60d2bc0>
<LoadedModule "msvcr90.dll" at 0x60d2c10>
=== K32  ===
Looking for kernel32.dll
Kernel32 module: <LoadedModule "kernel32.dll" at 0x60d2b20>
Module name = <kernel32.dll> | Fullname = <c:\windows\system32\kernel32.dll>
Kernel32 is loaded at address 0x76930000
=== K32 PE ===
PE Representation of k32: <windows.pe_parse.PEFile object at 0x060CCA10>
Here are some exports {0: 1989445168L, 'CreateFileA': 1989795280L, 42: 1989636592L, 'VirtualAlloc': 1989437552L}
Import DLL dependancies are (without api-*): ['kernelbase.dll', 'ntdll.dll']
IAT Entry for ntdll!NtCreateFile = <IATEntry "NtCreateFile" ordinal 272> | addr = 0x769a1a28L
Sections: [<PESection ".text">, <PESection ".rdata">, <PESection ".data">, <PESection ".rsrc">, <PESection ".reloc">]

import windows

print("Computer is a <{0}>".format(windows.system.version_name))

cp = windows.current_process
apism = cp.peb.apisetmap

print("ApiSetMap: {0} (version = {1})".format(apism, apism.version))

# Find the current version of "api-ms-win-core-processthreads" used by windows
dll_demos_fullname = [x for x in windows.current_process.peb.apisetmap.apisetmap_dict if "api-ms-win-core-processthreads" in x][0]
dll_demos_utilname = 'api-ms-win-core-processthreads-l1-1-'

print("Entries in 'apisetmap_dict' are the full api-dll path extracted")
print(" * apisetmap.apisetmap_dict['{0}'] -> {1}".format(dll_demos_fullname, apism.apisetmap_dict[dll_demos_fullname]))
print("Entries in 'resolution_dict' are the contains the util-part check by windows")
print(" * apisetmap.resolution_dict['{0}'] -> {1}".format(dll_demos_utilname, apism.resolution_dict[dll_demos_utilname]))

print("ApiSetMap.resolve resolve a api-dll based on the util part")
for suffix in ["1", "2", "PART_IS_IGNORED"]:
    testname = dll_demos_utilname + suffix
    print(" * apisetmap.resolve('{0}') -> {1}".format(testname, apism.resolve(testname)))

testname = "BAD_DLL-3.dll"
try:
    print(" * apisetmap.resolve('{0}') -> {1}".format(testname, apism.resolve(testname)))
except KeyError as e:
    print(" * apisetmap.resolve('{0}') -> raised: {1!r}".format(testname, e))

(cmd) python process\apisetmap.py
Computer is a <Windows 10>
ApiSetMap: <windows.winobject.apisetmap.ApiSetMapVersion6 object at 0x0645ECB0> (version = 6)
Entries in 'apisetmap_dict' are the full api-dll path extracted
 * apisetmap.apisetmap_dict['api-ms-win-core-processthreads-l1-1-3'] -> kernelbase.dll
Entries in 'resolution_dict' are the contains the util-part check by windows
 * apisetmap.resolution_dict['api-ms-win-core-processthreads-l1-1-'] -> kernelbase.dll
ApiSetMap.resolve resolve a api-dll based on the util part
 * apisetmap.resolve('api-ms-win-core-processthreads-l1-1-1') -> kernelbase.dll
 * apisetmap.resolve('api-ms-win-core-processthreads-l1-1-2') -> kernelbase.dll
 * apisetmap.resolve('api-ms-win-core-processthreads-l1-1-PART_IS_IGNORED') -> kernelbase.dll
 * apisetmap.resolve('BAD_DLL-3.dll') -> raised: KeyError('BAD_DLL-',)

import sys
import os.path
sys.path.append(os.path.abspath(__file__ + "\..\.."))

try:
    import winreg
except ImportError:
    import _winreg as winreg
import windows

# Here is a demo of IAT hooking in python
# We will hook the 'RegOpenKeyExA' entry of Python27.dll because it is easy to trigger !

# First: let's create our hook
# windows.hooks.RegOpenKeyExACallback is generated based on windows.generated_def.winfuncs
@windows.hooks.RegOpenKeyExACallback
def open_reg_hook(hKey, lpSubKey, ulOptions, samDesired, phkResult, real_function):
    print("<in hook> Hook called | hKey = {0} | lpSubKey = <{1}>".format(hex(hKey), lpSubKey.value))
    # Our hook can choose to call the real_function or not
    if "SECRET" in lpSubKey.value:
        print("<in hook> Secret key asked, returning magic handle 0x12345678")
        # We must respect the hooked method return-value interface
        phkResult[0] = 0x12345678
        return 0
    if "FAIL" in lpSubKey.value:
        print("<in hook> Asked for a failing key: returning 0x2a")
        return 42
    print("<in hook> Non-secret key : calling normal function")
    return real_function()

## Wide version of the Hook for python3 !
@windows.hooks.RegOpenKeyExWCallback
def open_reg_hookw(hKey, lpSubKey, ulOptions, samDesired, phkResult, real_function):
    print("<in hook> Hook called | hKey = {0} | lpSubKey = <{1}>".format(hex(hKey), lpSubKey.value))
    # Our hook can choose to call the real_function or not
    if "SECRET" in lpSubKey.value:
        print("<in hook> Secret key asked, returning magic handle 0x12345678")
        # We must respect the hooked method return-value interface
        phkResult[0] = 0x12345678
        return 0
    if "FAIL" in lpSubKey.value:
        print("<in hook> Asked for a failing key: returning 0x2a")
        return 42
    print("<in hook> Non-secret key : calling normal function")
    return real_function()


# Get the peb of our process
peb = windows.current_process.peb

# Get the pythonxx.dll module
pythondll_module = [m for m in peb.modules if m.name.startswith("python") and m.name.endswith(".dll")][0]

# Get the iat entries for DLL advapi32.dll
adv_imports = pythondll_module.pe.imports['advapi32.dll']

# Get RegOpenKeyExA iat entry
RegOpenKeyEx_iat = [n for n in adv_imports if n.name == "RegOpenKeyExA"]
if not RegOpenKeyEx_iat: # Py3
    RegOpenKeyEx_iat = [n for n in adv_imports if n.name == "RegOpenKeyExW"]
    open_reg_hook = open_reg_hookw

RegOpenKeyEx_iat = RegOpenKeyEx_iat[0]
# Setup our hook
RegOpenKeyEx_iat.set_hook(open_reg_hook)

### !!!! You must keep the iat_entry alive !!!!
### If the hook is garbage collected while active -> python will crash

# Use python native module _winreg that call 'RegOpenKeyExA'
print("Asking for <MY_SECRET_KEY>")
v = winreg.OpenKey(1234567, "MY_SECRET_KEY")
print("Result = " + hex(v.handle))

print("")
print("Asking for <MY_FAIL_KEY>")
try:
    v = winreg.OpenKey(1234567, "MY_FAIL_KEY")
    print("Result = " + hex(v.handle))
except WindowsError as e:
    print(repr(e))

print("")
print("Asking for <HKEY_CURRENT_USER/Software>")
try:
    v = winreg.OpenKey(winreg.HKEY_CURRENT_USER, "Software")
    print("Result = " + hex(v.handle))
except WindowsError as e:
    print(repr(e))

(cmd) python process\iat_hook.py
Asking for <MY_SECRET_KEY>
<in hook> Hook called | hKey = 0x12d687 | lpSubKey = <MY_SECRET_KEY>
<in hook> Secret key asked, returning magic handle 0x12345678
Result = 0x12345678

Asking for <MY_FAIL_KEY>
<in hook> Hook called | hKey = 0x12d687 | lpSubKey = <MY_FAIL_KEY>
<in hook> Asked for a failing key: returning 0x2a
WindowsError(42, 'Windows Error 0x2A')

Asking for <HKEY_CURRENT_USER/Software>
<in hook> Hook called | hKey = 0x80000001L | lpSubKey = <Software>
<in hook> Non-secret key : calling normal function
Result = 0x428

# Some python interpreters run in environments with restrictive ACLs (no Users/* execute) on bundled DLLs.
# The Microsoft Store version of python is the prime example of this.
#
# Remote execution of python is still possible by creating a minimal set of the dependencies outside of the restricted directory.
#
# This can be very helpful when operating PFW in environments with restrive GPOs / AppLocker.


import ctypes
import glob
import os
import shutil
import tempfile
import time
import sys
import struct

import windows
from windows.generated_def.ntstatus import STATUS_THREAD_IS_TERMINATING
from windows.generated_def.windef import CREATE_SUSPENDED
from windows.generated_def.winstructs import PROCESS_INFORMATION, STARTUPINFOW
from windows.injection import RemotePythonError, \
    find_python_dll_to_inject, get_dll_name_from_python_version, inject_python_command, load_dll_in_remote_process, retrieve_exc


print("Executable is: {0}".format(sys.executable))

CACHE_DIR = os.path.join(tempfile.gettempdir(), 'pfw_dllcache')
INTERPRETER_DIR = os.path.dirname(find_python_dll_to_inject(64)) # Tailor bitness to your needs


def mspython_acl_workaround(target, pydll_path):
    """
    Works around mspython ACL restrictions on mspython interpreters
    by copying the critical DLLs to a TEMP dir and orienting the interpreter
    against that TEMP dir.
    """

    if not os.path.exists(CACHE_DIR):
        os.mkdir(CACHE_DIR)

    for dll in [os.path.join(INTERPRETER_DIR, 'vcruntime140.dll'), pydll_path]:
        cache_dll_path = os.path.join(CACHE_DIR, os.path.basename(dll))
        try:
            # Creates a copy of the DLL without bringing over restrictive ACLs
            shutil.copyfile(dll, cache_dll_path)
        except Exception as e:
            # If its not writeable good chance these DLLs are just already loaded somewhere
            print(e)

        # Preloading python DLL and vcruntime so they don't get loaded from the path tree with restrictive ACLs
        print("Injecting: {0}".format(cache_dll_path))
        load_dll_in_remote_process(target, cache_dll_path)

    for dll in glob.glob(os.path.join(INTERPRETER_DIR, 'dlls', '*')):
        cache_dll_path = os.path.join(CACHE_DIR, os.path.basename(dll))
        try:
            # Dynamic lib DLLs with restrictive ACLs copied to unrestricted parent
            shutil.copyfile(dll, cache_dll_path)
        except Exception as e:
            print(e)

    target._workaround_applied = True


# Adapted from windows\winobject\process.py
def execute_python_code(process, code):
    py_dll_name = get_dll_name_from_python_version()
    pydll_path = find_python_dll_to_inject(process.bitness)

    if not getattr(process, "_workaround_applied", None):
        mspython_acl_workaround(process, pydll_path)
    shellcode, pythoncode = inject_python_command(process, code, py_dll_name)
    t = process.create_thread(shellcode, pythoncode)
    return t


def safe_execute_python(process, code):
    t = execute_python_code(process, code)
    t.wait() # Wait termination of the thread
    if t.exit_code == 0:
        return True
    if t.exit_code == STATUS_THREAD_IS_TERMINATING or process.is_exit:
        raise WindowsError("{0} died during execution of python command".format(process))
    if t.exit_code != 0xffffffff:
        raise ValueError("Unknown exit code {0}".format(hex(t.exit_code)))
    data = retrieve_last_exception_data(process)
    raise RemotePythonError(data)

# Adapted from windows\injection.py
def retrieve_last_exception_data(process):
    with process.allocated_memory(0x1000) as mem:
        execute_python_code(process, retrieve_exc.format(mem)).wait()
        size = struct.unpack("<I", process.read_memory(mem, ctypes.sizeof(ctypes.c_uint)))[0]
        data = process.read_memory(mem + ctypes.sizeof(ctypes.c_uint), size)
    return data

# First: show what happen when injecting mspython normally
print("Trying normal execute_python()")
proc1 = windows.utils.create_process(r"C:\Windows\system32\winver.exe")
try:
    proc1.execute_python("2 + 2 == 5")
except Exception as e:
    print("    Exception during proc1.execute_python():")
    print("    {0}".format(repr(e)))
proc1.exit()

print("Trying mspython workaround:")
proc_info = PROCESS_INFORMATION()
StartupInfo = STARTUPINFOW()
StartupInfo.cb = ctypes.sizeof(StartupInfo)
windows.winproxy.CreateProcessW(
    r"C:\Windows\system32\winver.exe",
    dwCreationFlags=CREATE_SUSPENDED,
    # Point PYTHONHOME to the interpreter dir so non-DLL libs can load
    # Point PYTHONPATH to the newly created cache directory so DLL libs are loaded from there
    lpEnvironment=('\0'.join('{}={}'.format(e, v) for e, v in os.environ.items()) + \
                   '\0PYTHONHOME={}\0PYTHONPATH={}\0\0'.format(INTERPRETER_DIR, CACHE_DIR)).encode(),
    lpProcessInformation=ctypes.byref(proc_info),
    lpStartupInfo=ctypes.byref(StartupInfo))

process = windows.winobject.process.WinProcess(pid=proc_info.dwProcessId, handle=proc_info.hProcess)

print("    Executing python code!")
safe_execute_python(process, """
import windows
windows.utils.create_console()
print('hello from inside the suspended process!', flush=True)
""")

process.threads[0].resume()

print("    Executing more python code!")
safe_execute_python(process, """
print('hello from inside the resumed process!', flush=True)
""")

print("    Executing an error python code!")
try:
    safe_execute_python(process, """BAD_VARIABLE""")
except RemotePythonError as e:
    print("        Expected error during safe_execute_python")
    print("        {0}".format(e))

print("   Sleeping a little")
time.sleep(5)
print("   Killing target process !")
process.exit()

PS C:\Users\hakril\PythonForWindows> py .\samples\process\msstore_interpreter_remote_python.py
Executable is: C:\Users\hakril\AppData\Local\Microsoft\WindowsApps\PythonSoftwareFoundation.Python.3.13_qbz5n2kfra8p0\python.exe
Trying normal execute_python()
    Exception during proc1.execute_python():
    InjectionFailedError('Injection of <c:\\program files\\windowsapps\\pythonsoftwarefoundation.python.3.13_3.13.496.0_x64__qbz5n2kfra8p0\\vcruntime140.dll> failed')
Trying mspython workaround:
    Executing python code!
Injecting: C:\Users\hakril\AppData\Local\Temp\pfw_dllcache\vcruntime140.dll
Injecting: C:\Users\hakril\AppData\Local\Temp\pfw_dllcache\python313.dll
    Executing more python code!
    Executing an error python code!
        Expected error during safe_execute_python
        b'Traceback (most recent call last):\n  File "<string>", line 1, in <module>\nNameError: name \'BAD_VARIABLE\' is not defined\n'
   Sleeping a little
   Killing target process !

# A python script able to install itself as a service

import sys
import os.path
import argparse
import datetime
import ctypes

import windows
import windows.generated_def as gdef

SERVICE_NAME = u"PFW_SERVICE_DEMO"
SERVICE_DESCRIPTION = u"PythonForWindows demo service"

SERVICE_LOGFILE = os.path.join(os.path.dirname(__file__), "pfw_service_logs.txt")

SERVICE_HANDLE = None

def install_demo_service():
    path = "{executable} {pyfile} --run".format(executable=sys.executable, pyfile=__file__)
    print("Registering service <{0}> as : <{1}>".format(SERVICE_NAME, path))
    newservice = windows.system.services.create(
        name=SERVICE_NAME,
        description=SERVICE_DESCRIPTION,
        access=gdef.SERVICE_ALL_ACCESS,
        type=gdef.SERVICE_WIN32_OWN_PROCESS,
        start=gdef.SERVICE_DEMAND_START,
        path=path,
        user=None
    )
    print(newservice)
    return

def uninstall_demo_service():
    print("Deleting service")
    print(windows.system.services[SERVICE_NAME].delete())



def log(s):
    with open(SERVICE_LOGFILE, "a") as f:
        f.write("[{time}] {s}\n".format(time=datetime.datetime.now(), s=s))


@ctypes.WINFUNCTYPE(gdef.DWORD, gdef.DWORD, gdef.DWORD, gdef.PVOID, gdef.PVOID)
def service_handlerex(dwControl, dwEventType, lpEventData, lpContext):
    log("in service_handlerex")
    log("service_handlerex: called with {0}".format(dwControl))
    if dwControl == gdef.SERVICE_CONTROL_STOP:
        log("Stopping the service")
        running_status = gdef.SERVICE_STATUS(
            dwServiceSpecificExitCode=0,
            dwServiceType =gdef.SERVICE_WIN32_OWN_PROCESS,
            dwCurrentState=gdef.SERVICE_STOPPED,
            dwWin32ExitCode=gdef.NO_ERROR,
            dwControlsAccepted=0
        )
        try:
            windows.winproxy.SetServiceStatus(SERVICE_HANDLE, running_status)
        except Exception as e:
            log(str(e))
    return 0

@ctypes.WINFUNCTYPE(gdef.PVOID, gdef.DWORD, ctypes.POINTER(gdef.LPWSTR))
def service_main(dwNumServicesArgs, lpServiceArgVectors):
    global SERVICE_HANDLE
    log("In service_main")
    log("service_main: {0}".format(dwNumServicesArgs))
    log("service_main: {0}".format(lpServiceArgVectors[0]))

    try:
        log("Calling RegisterServiceCtrlHandlerExW")
        SERVICE_HANDLE = windows.winproxy.RegisterServiceCtrlHandlerExW(SERVICE_NAME, ctypes.cast(service_handlerex, gdef.PVOID), None)
        log("RegisterServiceCtrlHandlerExW handle: {0}".format(SERVICE_HANDLE))

        running_status = gdef.SERVICE_STATUS(
            dwServiceSpecificExitCode=0,
            dwServiceType =gdef.SERVICE_WIN32_OWN_PROCESS,
            dwCurrentState=gdef.SERVICE_RUNNING,
            dwWin32ExitCode=gdef.NO_ERROR,
            dwControlsAccepted=gdef.SERVICE_ACCEPT_STOP | gdef.SERVICE_ACCEPT_PAUSE_CONTINUE
        )
        res = windows.winproxy.SetServiceStatus(SERVICE_HANDLE, running_status)
        log("Service is running : {0}".format(res))
    except Exception as e:
        log(str(e))
        raise

    return None

def run_demo_service():
    log("start of run_demo_service()")
    try:
        SERVICE_TABLE = (gdef.SERVICE_TABLE_ENTRYW * 2)(
            gdef.SERVICE_TABLE_ENTRYW(SERVICE_NAME, ctypes.cast(service_main, gdef.PVOID)),
            gdef.SERVICE_TABLE_ENTRYW(None, None),
        )
        log("Calling: StartServiceCtrlDispatcherW()")
        result = windows.winproxy.StartServiceCtrlDispatcherW(SERVICE_TABLE)
        log("StartServiceCtrlDispatcherW returned: {0}".format(result))
        log("Quitting")
    except Exception as e:
        log(str(e))
        raise



parser = argparse.ArgumentParser(prog=__file__, formatter_class=argparse.ArgumentDefaultsHelpFormatter)
group = parser.add_mutually_exclusive_group(required=True)
group.add_argument("--install",   action="store_true", help="Install the service in registry")
group.add_argument("--uninstall", action="store_true", help="UnInstall the service in registry")
group.add_argument("--run",     action="store_true", help="Called by the services.exe to run the service")


if __name__ == "__main__":
    args = parser.parse_args()
    if args.install:
        install_demo_service()
    elif args.uninstall:
        uninstall_demo_service()
    elif args.run:
        log("calling run_demo_service()")
        log(sys.argv)
        run_demo_service()
    else:
        raise ValueError("Unknown argument")

(cmd-admin) sc.exe query PFW_SERVICE_DEMO
[SC] EnumQueryServicesStatus:OpenService FAILED 1060:

The specified service does not exist as an installed service.

(cmd-admin) py .\service\python_service.py --install
Registering service <PFW_SERVICE_DEMO> as : <C:\Users\cleme\AppData\Local\Programs\Python\Python311\python.exe C:\Users\cleme\Documents\projets\PythonForWindows\samples\service\python_service.py --run>
<Service "PFW_SERVICE_DEMO" SERVICE_STOPPED(0x1)>

(cmd-admin) sc.exe start PFW_SERVICE_DEMO
SERVICE_NAME: PFW_SERVICE_DEMO
        TYPE               : 10  WIN32_OWN_PROCESS
        STATE              : 2  START_PENDING
                                (NOT_STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
        WIN32_EXIT_CODE    : 0  (0x0)
        SERVICE_EXIT_CODE  : 0  (0x0)
        CHECKPOINT         : 0x0
        WAIT_HINT          : 0x7d0
        PID                : 21132
        FLAGS              :

(cmd-admin) sc.exe query PFW_SERVICE_DEMO
SERVICE_NAME: PFW_SERVICE_DEMO
        TYPE               : 10  WIN32_OWN_PROCESS
        STATE              : 4  RUNNING
                                (STOPPABLE, PAUSABLE, IGNORES_SHUTDOWN)
        WIN32_EXIT_CODE    : 0  (0x0)
        SERVICE_EXIT_CODE  : 0  (0x0)
        CHECKPOINT         : 0x0
        WAIT_HINT          : 0x0

(cmd-admin) cat .\service\pfw_service_logs.txt
[2024-12-31 10:34:36.033158] calling run_demo_service()
[2024-12-31 10:34:36.033158] ['C:\\Users\\XXX\\PythonForWindows\\samples\\service\\python_service.py', '--run']
[2024-12-31 10:34:36.033158] start of run_demo_service()
[2024-12-31 10:34:36.033158] Calling: StartServiceCtrlDispatcherW()
[2024-12-31 10:34:36.033158] In service_main
[2024-12-31 10:34:36.033158] service_main: 1
[2024-12-31 10:34:36.033158] service_main: PFW_SERVICE_DEMO
[2024-12-31 10:34:36.033158] Calling RegisterServiceCtrlHandlerExW
[2024-12-31 10:34:36.033158] RegisterServiceCtrlHandlerExW handle: 2591650953424
[2024-12-31 10:34:36.038274] Service is running : 1

(cmd-admin) sc.exe stop PFW_SERVICE_DEMO
SERVICE_NAME: PFW_SERVICE_DEMO
        TYPE               : 10  WIN32_OWN_PROCESS
        STATE              : 1  STOPPED
        WIN32_EXIT_CODE    : 0  (0x0)
        SERVICE_EXIT_CODE  : 0  (0x0)
        CHECKPOINT         : 0x0
        WAIT_HINT          : 0x0

(cmd-admin) cat .\service\pfw_service_logs.txt
[...]
[2024-12-31 10:34:36.038274] Service is running : 1
[2024-12-31 10:34:53.422375] in service_handlerex
[2024-12-31 10:34:53.422375] service_handlerex: called with 1
[2024-12-31 10:34:53.432530] Stopping the service
[2024-12-31 10:34:53.433035] StartServiceCtrlDispatcherW returned: 1
[2024-12-31 10:34:53.433035] Quitting

(cmd-admin) py .\service\python_service.py --uninstall
Deleting service
1

(cmd-admin) sc.exe query PFW_SERVICE_DEMO
[SC] EnumQueryServicesStatus:OpenService FAILED 1060:

The specified service does not exist as an installed service.