tlsdump auxiliary module: update to work on 64-bit Python

Author: kevoreilly

analyzer/windows/modules/auxiliary/tlsdump.py

@@ -3,18 +3,21 @@
 # See the file 'docs/LICENSE' for copying permission.
 
 import logging
-from ctypes import byref, c_void_p, sizeof
-
+from ctypes import byref, c_bool, c_void_p, sizeof
 from lib.api.process import Process
 from lib.common.abstracts import Auxiliary
 from lib.common.defines import KERNEL32, PROCESSENTRY32, TH32CS_SNAPPROCESS
 from lib.common.exceptions import CuckooError
 
 log = logging.getLogger(__name__)
+
 INVALID_HANDLE_VALUE_PTR = c_void_p(-1).value
 
 # Ensure snapshot handle is not truncated on 64-bit.
 KERNEL32.CreateToolhelp32Snapshot.restype = c_void_p
+# Ensure bool return types are not sign-extended on 64-bit.
+KERNEL32.Process32First.restype = c_bool
+KERNEL32.Process32Next.restype = c_bool
 
 
 class TLSDumpMasterSecrets(Auxiliary):
@@ -32,22 +35,33 @@ def __init__(self, options, config):
     def start(self):
         proc_info = PROCESSENTRY32()
         proc_info.dwSize = sizeof(PROCESSENTRY32)
+
         snapshot = KERNEL32.CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0)
         if snapshot in (None, INVALID_HANDLE_VALUE_PTR):
             log.warning("Failed to create process snapshot")
+            del self.options["tlsdump"]
             return
+
         flag = KERNEL32.Process32First(snapshot, byref(proc_info))
         pid = 0
+
         while flag:
-            if proc_info.sz_exeFile == b"lsass.exe":
+            exename = proc_info.sz_exeFile
+            if isinstance(exename, bytes):
+                exename = exename.decode("utf-8", errors="replace")
+            if exename == "lsass.exe":
                 pid = proc_info.th32ProcessID
                 log.info("lsass.exe found, pid %d", pid)
-                flag = 0
+                break
             flag = KERNEL32.Process32Next(snapshot, byref(proc_info))
+
         KERNEL32.CloseHandle(snapshot)
+
         if not pid:
             log.warning("Unable to find lsass.exe process")
+            del self.options["tlsdump"]
             return
+
         try:
             p = Process(options=self.options, config=self.config, pid=pid)
             filepath = p.get_filepath()
@@ -56,8 +70,6 @@ def start(self):
             if "process access denied" in e.message:
                 log.warning("You're not running the Agent as Administrator")
             else:
-                log.warning(
-                    "An unknown error occurred while trying to inject into the lsass.exe process to dump TLS master secrets: %s",
-                    e,
-                )
+                log.warning("An unknown error occurred while trying to inject into the lsass.exe process to dump TLS master secrets: %s", e)
+
         del self.options["tlsdump"]