Merge pull request #230 from cecio/master

Implementation of ShellExecuteEx
mandiant · Mar 2, 2023 · 5c0a507 · 5c0a507
2 parents 08ac824 + 71043bf
commit 5c0a507
Show file tree

Hide file tree

Showing 2 changed files with 47 additions and 0 deletions.
diff --git a/speakeasy/winenv/api/usermode/shell32.py b/speakeasy/winenv/api/usermode/shell32.py
@@ -96,6 +96,32 @@ def ShellExecute(self, emu, argv, ctx={}):
 
         return 33
 
+    @apihook('ShellExecuteEx', argc=1)
+    def ShellExecuteEx(self, emu, argv, ctx={}):
+        '''
+        BOOL ShellExecuteExA(
+            [in, out] SHELLEXECUTEINFOA *pExecInfo
+        );
+        '''
+        lpShellExecuteInfo, = argv
+
+        sei = shell32_defs.SHELLEXECUTEINFOA(emu.get_ptr_size())
+        sei_struct = self.mem_cast(sei, lpShellExecuteInfo)
+
+        self.ShellExecute(
+            emu,
+            [
+                0,
+                sei_struct.lpVerb,
+                sei_struct.lpFile,
+                sei_struct.lpParameters, sei_struct.lpDirectory,
+                0
+            ], 
+            ctx
+        )
+
+        return True
+
     @apihook('IsUserAnAdmin', argc=0, ordinal=680)
     def IsUserAnAdmin(self, emu, argv, ctx={}):
         """

diff --git a/speakeasy/winenv/defs/windows/shell32.py b/speakeasy/winenv/defs/windows/shell32.py
@@ -1,4 +1,6 @@
+import ctypes as ct
 
+from speakeasy.struct import EmuStruct, Ptr
 
 CSIDL = {
     0x00: "CSIDL_DESKTOP",
@@ -63,3 +65,22 @@
     0x43: "CSIDL_SAMPLE_VIDEOS",
     0x45: "CSIDL_PHOTOALBUMS",
 }
+
+class SHELLEXECUTEINFOA(EmuStruct):
+    def __init__(self, ptr_size):
+        super().__init__(ptr_size)
+        self.cbSize = ct.c_uint32
+        self.fMask = ct.c_uint32
+        self.hwnd = Ptr
+        self.lpVerb = Ptr
+        self.lpFile = Ptr
+        self.lpParameters = Ptr
+        self.lpDirectory = Ptr
+        self.nShow = ct.c_int32
+        self.hInstApp = Ptr
+        self.lpIDList = Ptr
+        self.lpClass = Ptr
+        self.hkeyClass = Ptr
+        self.dwHotKey = ct.c_uint32
+        self.DummyUnionName = Ptr
+        self.handle = Ptr