# 7. `windows.utils` – Windows Utilities

## 7.1. Context Managers

`windows.utils` provides some context managers wrapping standard contextual operations like `VirtualProtect` or `SysWow Redirection`

### 7.1.1. VirtualProtected

class `windows.utils.``VirtualProtected`(addr, size, new_protect)

  A context manager usable like VirtualProtect that will restore the old protection at exit

      with utils.VirtualProtected(IATentry.addr, ctypes.sizeof(PVOID), gdef.PAGE_EXECUTE_READWRITE):
          IATentry.value = 0x42424242

### 7.1.2. DisableWow64FsRedirection

class `windows.utils.``DisableWow64FsRedirection`

  A context manager that disable the SysWow64 Filesystem Redirection

      if is_process_32_bits:
          def pop_calc_64():
              with windows.utils.DisableWow64FsRedirection():
                  return windows.utils.create_process(r"C:\Windows\system32\calc.exe", True)

## 7.2. Helper functions

`windows.utils.``sprint`(struct, name='struct', hexa=True)

  Print recursively the content of a `ctypes` structure

  Example:

        >>> cert
        <Certificate "YOLO2" serial="6f 1d 3e 7d d9 77 59 a9 4c 1c 53 dc 80 db 0c fe">
        >>> windows.utils.sprint(cert)
        struct.dwCertEncodingType -> 0x1L
        struct.pbCertEncoded<deref> -> 0x30
        struct.cbCertEncoded -> 0x1a7L
        struct.pCertInfo<deref>.dwVersion -> 0x2L
        struct.pCertInfo<deref>.SerialNumber.cbData -> 0x10L
        struct.pCertInfo<deref>.SerialNumber.pbData<deref> -> 0xfe
        struct.pCertInfo<deref>.SignatureAlgorithm.pszObjId -> '1.2.840.113549.1.1.5'
        struct.pCertInfo<deref>.SignatureAlgorithm.Parameters.cbData -> 0x2L
        struct.pCertInfo<deref>.SignatureAlgorithm.Parameters.pbData<deref> -> 0x5
        struct.pCertInfo<deref>.Issuer.cbData -> 0x12L
        struct.pCertInfo<deref>.Issuer.pbData<deref> -> 0x30
        struct.pCertInfo<deref>.NotBefore.dwLowDateTime -> 0x718ddc00L
        struct.pCertInfo<deref>.NotBefore.dwHighDateTime -> 0x1d249bbL
        struct.pCertInfo<deref>.NotAfter.dwLowDateTime -> 0x34ef0c00L
        struct.pCertInfo<deref>.NotAfter.dwHighDateTime -> 0x1d368bfL
        ...

`windows.utils.``enable_privilege`(lpszPrivilege, bEnablePrivilege)

  Enable or disable a privilege:

      enable_privilege(SE_DEBUG_NAME, True)

`windows.utils.``check_is_elevated`()

  Return `True` if process is Admin

`windows.utils.``check_debug`()

  Check that kernel is in debug mode (beware of NOUMEX):

  https://msdn.microsoft.com/en-us/library/windows/hardware/ff556253(v=vs.85).aspx#_______noumex______

`windows.utils.``create_process`(path, args=None, dwCreationFlags=0, show_windows=True)

  A convenient wrapper arround `windows.winproxy.CreateProcessA()`

`windows.utils.``create_console`()

  Create a new console displaying STDOUT. Useful in injection of GUI process

`windows.utils.``pop_shell`(locs=None)

  Pop a console with an InterativeConsole

`windows.utils.``create_file_from_handle`(handle, mode='r')

  Return a Python `file` around a `Windows` HANDLE

`windows.utils.``get_handle_from_file`(f)

  Get the `Windows` HANDLE of a python `file`

`windows.utils.``get_short_path`(path)

  Return the short path form for `path`

  Raise: | `WinproxyError` if `path` does not exists
  Parameters: | path (`str` | `unicode`) – a valid Windows path
  Returns: | `str` | `unicode` – same type as `path` parameter

`windows.utils.``get_long_path`(path)

  Return the long path form for `path`.

  Raise: | `WinproxyError` if `path` does not exists
  Parameters: | path (`str` | `unicode`) – a valid Windows path
  Returns: | `str` | `unicode` – same type as `path` parameter