in functions/kernel32.py [0:0]
def CreateFileW(self, is_return = False):
if is_return == True:
return f"{hex(funcutils.get_result(self.is_64bit))} => HANDLE"
lpFileNameAddr = funcutils.get_func_args(1, self.is_64bit)
_debug_info = f"lpFileName=" + idc.get_strlit_contents(ea = lpFileNameAddr, strtype=idc.STRTYPE_C16).decode("utf-8")
access = funcutils.get_func_args(2, self.is_64bit) & 0xffffffff
access_result = str()
if access == GENERIC_ALL:
access_result = "GENERIC_ALL"
else:
if access & GENERIC_READ:
access_result += "GENERIC_READ|"
if access & GENERIC_WRITE:
access_result += "GENERIC_WRITE|"
if access & GENERIC_EXECUTE:
access_result += "GENERIC_EXECUTE|"
if access_result.endswith('|'):
access_result = access_result[:-1]
_debug_info += f", dwDesiredAccess={access_result}"
shared_mode = funcutils.get_func_args(3, self.is_64bit) & 0xffffffff
shared_mode_result = str()
if shared_mode == 0:
shared_mode_result = "0"
else:
if shared_mode & FILE_SHARE_READ:
shared_mode_result += "FILE_SHARE_READ|"
if shared_mode & FILE_SHARE_WRITE:
shared_mode_result += "FILE_SHARE_WRITE|"
if shared_mode & FILE_SHARE_DELETE:
shared_mode_result += "FILE_SHARE_DELETE|"
if shared_mode_result.endswith("|"):
shared_mode_result = shared_mode_result[:-1]
_debug_info += f", dwShareMode={shared_mode_result}"
lpSecurityAttributes = funcutils.get_func_args(4, self.is_64bit)
_debug_info += f", lpSecurityAttributes={hex(lpSecurityAttributes)}"
dwCreationDisposition = funcutils.get_func_args(5, self.is_64bit) & 0xffffffff
creation_result = str()
if dwCreationDisposition == CREATE_NEW:
creation_result = "CREATE_NEW"
elif dwCreationDisposition == CREATE_ALWAYS:
creation_result = "CREATE_ALWAYS"
elif dwCreationDisposition == OPEN_EXISTING:
creation_result = "OPEN_EXISTING"
elif dwCreationDisposition == OPEN_ALWAYS:
creation_result = "OPEN_ALWAYS"
elif dwCreationDisposition == TRUNCATE_EXISTING:
creation_result = "TRUNCATE_EXISTING"
_debug_info += f", dwCreationDisposition={creation_result}"
dwFlagsAndAttributes = funcutils.get_func_args(6, self.is_64bit) & 0xffffffff
attr_result = str()
if dwFlagsAndAttributes & FILE_ATTRIBUTE_READONLY:
attr_result += "FILE_ATTRIBUTE_READONLY|"
if dwFlagsAndAttributes & FILE_ATTRIBUTE_HIDDEN:
attr_result += "FILE_ATTRIBUTE_HIDDEN|"
if dwFlagsAndAttributes & FILE_ATTRIBUTE_SYSTEM:
attr_result += "FILE_ATTRIBUTE_SYSTEM|"
if dwFlagsAndAttributes & FILE_ATTRIBUTE_ARCHIVE:
attr_result += "FILE_ATTRIBUTE_ARCHIVE|"
if dwFlagsAndAttributes & FILE_ATTRIBUTE_NORMAL:
attr_result += "FILE_ATTRIBUTE_NORMAL|"
if dwFlagsAndAttributes & FILE_ATTRIBUTE_TEMPORARY:
attr_result += "FILE_ATTRIBUTE_TEMPORARY|"
if dwFlagsAndAttributes & FILE_ATTRIBUTE_OFFLINE:
attr_result += "FILE_ATTRIBUTE_OFFLINE|"
if dwFlagsAndAttributes & FILE_ATTRIBUTE_ENCRYPTED:
attr_result += "FILE_ATTRIBUTE_ENCRYPTED|"
if attr_result.endswith('|'):
attr_result = attr_result[:-1]
_debug_info += f", dwFlagsAndAttributes={attr_result}"
hTemplateFile = funcutils.get_func_args(7, self.is_64bit)
_debug_info += f", hTemplateFile={hex(hTemplateFile)}) = "
return _debug_info