Ap3x / WALKWHISPER

Windows API header file parsing tool to generate source code for Windows API hashing

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

WALKWHISPER

A simple tool to parse Windows header files in a Linux development environment. This tool is meant to aid in generating C/C++ code snippets used for Windows API hashing. The hashing method that is used is DJB2.

Usage

usage: walkwhisper.py [-h] --func FUNC [--header HEADER] [--def]

options:
  -h, --help       show this help message and exit
  --func FUNC      A single and/or comma delimited list of Windows API functions to look up
  --header HEADER  A single or comma delimited list of the Windows header file(s) that need to be parsed
  --def            Prints the WinAPI Definition

Example

If we wanted to generate some code snippets for WriteProcessMemory, VirtualAllocEx, and RtlCreateUserThread the following command line usage would look like so:

Screenshot1

NOTICE: When attempting to generate source code for undocumented Windows API functions like RtlCreateUserThread in the example above a notice is provided. It is recommended to utilize the amazing source from to notify the user that this function can not be generated and http://undocumented.ntinternals.net/ to manually create the code.

You can also output the Windows API function definition for further context like so:

Screenshot2

Undocumented Windows Internals

As provided in the usage of WALKWHISPER it is recommended to refer to the following site, but this may not be as reliable at times and it is suggest to review some of the other links below.

For WALKWHISPER it may be better for you to use the source files provided by the following repositories:

You can also check out the following project, but its mainly used for Windows Kernel structures and can still be valuable

Credits

About

Windows API header file parsing tool to generate source code for Windows API hashing

License:Apache License 2.0


Languages

Language:Python 100.0%