Index

_

__init__() (windows.debug.Debugger method) (windows.debug.MemoryBreakpoint method)

A

action (windows.winobject.network.FirewallRule attribute) add_bp() (windows.debug.Debugger method) (windows.debug.LocalDebugger method) additionalinfo (windows.wintrust.SignatureData attribute)

allocated_memory() (windows.winobject.process.CurrentProcess method) (windows.winobject.process.WinProcess method) application_name (windows.winobject.network.FirewallRule attribute) attach() (windows.debug.Debugger class method)

B

base (windows.native_exec.simple_x86.mem_access attribute) baseaddr (windows.winobject.process.LoadedModule attribute) bitness (windows.winobject.process.CurrentProcess attribute) (windows.winobject.process.WinProcess attribute) (windows.winobject.system.System attribute)

break_on_ret() (windows.debug.FunctionBP method) Breakpoint (class in windows.debug)

C

Callback (class in windows.hooks) catalog (windows.wintrust.SignatureData attribute) catalogsigned (windows.wintrust.SignatureData attribute) check_debug() (in module windows.utils) check_is_elevated() (in module windows.utils) check_signature() (in module windows.wintrust) close() (windows.winobject.network.TCP4Connection method) commandline (windows.winobject.process.PEB attribute) computer_name (windows.winobject.system.System attribute) computername (windows.winobject.process.Token attribute) context (windows.winobject.process.WinThread attribute)

context_syswow (windows.winobject.process.WinThread attribute) control_accepted (windows.winobject.service.ServiceStatus attribute) create_console() (in module windows.utils) create_displacement() (in module windows.native_exec.simple_x86) create_file_from_handle() (in module windows.utils) create_function() (in module windows.native_exec) create_process() (in module windows.utils) create_thread() (windows.winobject.process.CurrentProcess method) (windows.winobject.process.WinProcess method) current_profile_types (windows.winobject.network.Firewall attribute) CurrentProcess (class in windows.winobject.process) CurrentThread (class in windows.winobject.process)

D

DeadThread (class in windows.winobject.process) debug() (windows.debug.Debugger class method) Debugger (class in windows.debug) del_bp() (windows.debug.Debugger method) (windows.debug.LocalDebugger method) deref() (in module windows.native_exec.simple_x86) description (windows.winobject.network.FirewallRule attribute) (windows.winobject.service.ServiceA attribute) direction (windows.winobject.network.FirewallRule attribute)

disable() (windows.hooks.IATHook method) disable_all_memory_breakpoints() (windows.debug.Debugger method) DisabledMemoryBreakpoint() (windows.debug.Debugger method) DisableWow64FsRedirection (class in windows.utils) disp (windows.native_exec.simple_x86.mem_access attribute) do_cpuid() (in module windows.native_exec.cpuid) dump() (windows.winobject.exception.ECONTEXT32 method) (windows.winobject.exception.ECONTEXT64 method) (windows.winobject.exception.ECONTEXTWOW64 method) (windows.winobject.exception.EEXCEPTION_POINTERS method)

E

ECONTEXT32 (class in windows.winobject.exception) ECONTEXT64 (class in windows.winobject.exception) ECONTEXTWOW64 (class in windows.winobject.exception) EDr7 (class in windows.winobject.exception) (windows.winobject.exception.ECONTEXT32 attribute) (windows.winobject.exception.ECONTEXT64 attribute) (windows.winobject.exception.ECONTEXTWOW64 attribute) EEflags (class in windows.winobject.exception) EEFlags (windows.winobject.exception.ECONTEXT32 attribute) (windows.winobject.exception.ECONTEXT64 attribute) (windows.winobject.exception.ECONTEXTWOW64 attribute) EEXCEPTION_DEBUG_INFO32 (class in windows.winobject.exception) EEXCEPTION_DEBUG_INFO32.ExceptionRecord (in module windows.winobject.exception) EEXCEPTION_DEBUG_INFO64 (class in windows.winobject.exception) EEXCEPTION_DEBUG_INFO64.ExceptionRecord (in module windows.winobject.exception) EEXCEPTION_POINTERS (class in windows.winobject.exception) EEXCEPTION_POINTERS.ContextRecord (in module windows.winobject.exception) EEXCEPTION_POINTERS.ExceptionRecord (in module windows.winobject.exception) EEXCEPTION_RECORD (class in windows.winobject.exception) EEXCEPTION_RECORD32 (class in windows.winobject.exception) EEXCEPTION_RECORD64 (class in windows.winobject.exception)

enable() (windows.hooks.IATHook method) enable_privilege() (in module windows.utils) enabled (windows.winobject.network.Firewall attribute) (windows.winobject.network.FirewallRule attribute) established (windows.winobject.network.TCP4Connection attribute) (windows.winobject.network.TCP6Connection attribute) ExceptionAddress (windows.winobject.exception.EEXCEPTION_RECORD attribute) (windows.winobject.exception.EEXCEPTION_RECORD32 attribute) (windows.winobject.exception.EEXCEPTION_RECORD64 attribute) ExceptionCode (windows.winobject.exception.EEXCEPTION_RECORD attribute) (windows.winobject.exception.EEXCEPTION_RECORD32 attribute) (windows.winobject.exception.EEXCEPTION_RECORD64 attribute) execute() (windows.winobject.process.CurrentProcess method) (windows.winobject.process.WinProcess method) execute_64bits_code_from_syswow() (in module windows.syswow64) execute_python() (windows.winobject.process.WinProcess method) execute_python_unsafe() (windows.winobject.process.WinProcess method) exit() (windows.winobject.process.CurrentProcess method) (windows.winobject.process.CurrentThread method) (windows.winobject.process.WinProcess method) (windows.winobject.process.WinThread method) exit_code (windows.winobject.process.CurrentProcess attribute) (windows.winobject.process.DeadThread attribute) (windows.winobject.process.WinProcess attribute) (windows.winobject.process.WinThread attribute) export_name (windows.pe_parse.PEFile attribute) exports (windows.pe_parse.PEFile attribute) extract_arguments() (windows.debug.FunctionBP method)

F

fields (windows.native_exec.cpuid.X86CpuidResult attribute) (windows.winobject.exception.ECONTEXT32 attribute) (windows.winobject.exception.ECONTEXT64 attribute) (windows.winobject.exception.ECONTEXTWOW64 attribute) (windows.winobject.exception.EDr7 attribute) (windows.winobject.exception.EEXCEPTION_DEBUG_INFO32 attribute) (windows.winobject.exception.EEXCEPTION_DEBUG_INFO64 attribute) (windows.winobject.exception.EEXCEPTION_RECORD attribute) (windows.winobject.exception.EEXCEPTION_RECORD32 attribute) (windows.winobject.exception.EEXCEPTION_RECORD64 attribute) (windows.winobject.exception.EEflags attribute) (windows.winobject.process.WinUnicodeString attribute) Firewall (class in windows.winobject.network) firewall (windows.winobject.network.Network attribute) FirewallRule (class in windows.winobject.network) flags (windows.winobject.service.ServiceStatus attribute)

full_signature_information() (in module windows.wintrust) fullname (windows.winobject.process.LoadedModule attribute) func_result (windows.winobject.exception.ECONTEXT32 attribute) (windows.winobject.exception.ECONTEXT64 attribute) (windows.winobject.exception.ECONTEXTWOW64 attribute) FunctionBP (class in windows.debug)

G

generate_syswow64_call() (in module windows.syswow64) get() (windows.winobject.registry.PyHKey method) get_exception_bitness() (windows.debug.Debugger method) get_exception_code() (windows.debug.LocalDebugger method) get_exception_context() (windows.debug.LocalDebugger method) get_handle_from_file() (in module windows.utils)

get_mapped_filename() (windows.winobject.process.CurrentProcess method) (windows.winobject.process.WinProcess method) get_memory_breakpoint_at() (windows.debug.Debugger method) get_proc_family_model() (in module windows.native_exec.cpuid) get_vendor_id() (in module windows.native_exec.cpuid) GetPEFile() (in module windows.pe_parse) grouping (windows.winobject.network.FirewallRule attribute)

H

Handle (class in windows.winobject.handle) handle (windows.winobject.process.CurrentProcess attribute) (windows.winobject.process.CurrentThread attribute) (windows.winobject.process.DeadThread attribute) (windows.winobject.process.Token attribute) (windows.winobject.process.WinProcess attribute) (windows.winobject.process.WinThread attribute)

handles (windows.winobject.system.System attribute) HXBreakpoint (class in windows.debug)

I

IATEntry (class in windows.pe_parse) IATEntry.addr (in module windows.pe_parse) IATEntry.name (in module windows.pe_parse) IATEntry.ord (in module windows.pe_parse) IATEntry.value (in module windows.pe_parse) IATHook (class in windows.hooks) imagepath (windows.winobject.process.PEB attribute) imports (windows.pe_parse.PEFile attribute) index (windows.native_exec.simple_x86.mem_access attribute) integrity (windows.winobject.process.Token attribute)

interface_types (windows.winobject.network.FirewallRule attribute) ipv4 (windows.winobject.network.Network attribute) ipv6 (windows.winobject.network.Network attribute) is_amd_proc() (in module windows.native_exec.cpuid) is_elevated (windows.winobject.process.Token attribute) is_exit (windows.winobject.process.CurrentProcess attribute) (windows.winobject.process.DeadThread attribute) (windows.winobject.process.WinProcess attribute) (windows.winobject.process.WinThread attribute) is_intel_proc() (in module windows.native_exec.cpuid) is_signed() (in module windows.wintrust) is_wow_64 (windows.winobject.process.CurrentProcess attribute) (windows.winobject.process.WinProcess attribute)

K

KeyValue (class in windows.winobject.registry)

L

LdrLoadDll_32_to_64() (in module windows.syswow64) load_library() (windows.winobject.process.WinProcess method) LoadedModule (class in windows.winobject.process) local_addr (windows.winobject.network.TCP4Connection attribute) (windows.winobject.network.TCP6Connection attribute) local_address (windows.winobject.network.FirewallRule attribute) local_handle (windows.winobject.handle.Handle attribute)

local_port (windows.winobject.network.FirewallRule attribute) (windows.winobject.network.TCP4Connection attribute) (windows.winobject.network.TCP6Connection attribute) LocalDebugger (class in windows.debug) LogicalDrive (class in windows.winobject.volume) LogicalDrive.name (in module windows.winobject.volume) logicaldrives (windows.winobject.system.System attribute) loop() (windows.debug.Debugger method)

M

mem() (in module windows.native_exec.simple_x86) mem_access (class in windows.native_exec.simple_x86) memory_state() (windows.winobject.process.CurrentProcess method) (windows.winobject.process.WinProcess method)

MemoryBreakpoint (class in windows.debug) modules (windows.winobject.process.PEB attribute)

N

name (windows.winobject.handle.Handle attribute) (windows.winobject.network.FirewallRule attribute) (windows.winobject.process.LoadedModule attribute) (windows.winobject.process.WinProcess attribute) (windows.winobject.registry.KeyValue attribute) (windows.winobject.service.ServiceA attribute) Network (class in windows.winobject.network) network (windows.winobject.system.System attribute) new_aligned() (windows.winobject.exception.ECONTEXT64 class method) NtCreateThreadEx_32_to_64() (in module windows.syswow64)

NtGetContextThread_32_to_64() (in module windows.syswow64) NtQueryInformationProcess_32_to_64() (in module windows.syswow64) NtQueryInformationThread_32_to_64() (in module windows.syswow64) NtQueryVirtualMemory_32_to_64() (in module windows.syswow64) NtSetContextThread_32_to_64() (in module windows.syswow64)

O

on_create_process() (windows.debug.Debugger method) on_create_thread() (windows.debug.Debugger method) on_exception() (windows.debug.Debugger method) (windows.debug.LocalDebugger method) on_exit_process() (windows.debug.Debugger method) on_exit_thread() (windows.debug.Debugger method) on_load_dll() (windows.debug.Debugger method)

on_output_debug_string() (windows.debug.Debugger method) on_rip() (windows.debug.Debugger method) on_single_step() (windows.debug.Debugger method) on_unload_dll() (windows.debug.Debugger method) open_subkey() (windows.winobject.registry.PyHKey method) owner (windows.winobject.process.CurrentThread attribute) (windows.winobject.process.WinThread attribute)

P

path (windows.winobject.volume.LogicalDrive attribute) pc (windows.winobject.exception.ECONTEXT32 attribute) (windows.winobject.exception.ECONTEXT64 attribute) (windows.winobject.exception.ECONTEXTWOW64 attribute) pe (windows.winobject.process.LoadedModule attribute) PEB (class in windows.winobject.process) peb (windows.winobject.process.CurrentProcess attribute) (windows.winobject.process.WinProcess attribute) peb_addr (windows.winobject.process.WinProcess attribute) peb_syswow (windows.winobject.process.CurrentProcess attribute) (windows.winobject.process.WinProcess attribute) PEFile (class in windows.pe_parse) pid (windows.winobject.process.CurrentProcess attribute) (windows.winobject.process.WinProcess attribute) pop_shell() (in module windows.utils)

ppid (windows.winobject.process.CurrentProcess attribute) (windows.winobject.process.WinProcess attribute) prefix (windows.native_exec.simple_x86.mem_access attribute) process (windows.winobject.handle.Handle attribute) (windows.winobject.service.ServiceA attribute) processes (windows.winobject.system.System attribute) product_type (windows.winobject.system.System attribute) protocol (windows.winobject.network.FirewallRule attribute) PyHKey (class in windows.winobject.registry) PyHKey.__call__() (in module windows.winobject.registry) PyHKey.__getitem__() (in module windows.winobject.registry) PyHKey.__setitem__() (in module windows.winobject.registry)

Q

query_memory() (windows.winobject.process.CurrentProcess method) (windows.winobject.process.WinProcess method)

R

raw (windows.winobject.exception.EEflags attribute) read_byte() (windows.winobject.process.CurrentProcess method) (windows.winobject.process.WinProcess method) read_dword() (windows.winobject.process.CurrentProcess method) (windows.winobject.process.WinProcess method) read_memory() (windows.winobject.process.CurrentProcess method) (windows.winobject.process.WinProcess method) read_memory_into() (windows.winobject.process.WinProcess method) read_ptr() (windows.winobject.process.CurrentProcess method) (windows.winobject.process.WinProcess method) read_qword() (windows.winobject.process.CurrentProcess method) (windows.winobject.process.WinProcess method) read_short() (windows.winobject.process.CurrentProcess method) (windows.winobject.process.WinProcess method) read_string() (windows.winobject.process.CurrentProcess method) (windows.winobject.process.WinProcess method) read_wstring() (windows.winobject.process.CurrentProcess method) (windows.winobject.process.WinProcess method) Registry (class in windows.winobject.registry) registry (windows.winobject.system.System attribute)

regs() (windows.winobject.exception.ECONTEXT32 method) (windows.winobject.exception.ECONTEXT64 method) (windows.winobject.exception.ECONTEXTWOW64 method) remote_addr (windows.winobject.network.TCP4Connection attribute) (windows.winobject.network.TCP6Connection attribute) remote_address (windows.winobject.network.FirewallRule attribute) remote_host (windows.winobject.network.TCP4Connection attribute) (windows.winobject.network.TCP6Connection attribute) remote_port (windows.winobject.network.FirewallRule attribute) (windows.winobject.network.TCP4Connection attribute) (windows.winobject.network.TCP6Connection attribute) remote_proto (windows.winobject.network.TCP4Connection attribute) (windows.winobject.network.TCP6Connection attribute) remove_hook() (windows.pe_parse.IATEntry method) restore_all_memory_breakpoints() (windows.debug.Debugger method) resume() (windows.winobject.process.WinThread method) ret_trigger() (windows.debug.FunctionBP method) rules (windows.winobject.network.Firewall attribute)

S

scale (windows.native_exec.simple_x86.mem_access attribute) select() (windows.winobject.wmi.WmiRequester method) service_name (windows.winobject.network.FirewallRule attribute) ServiceA (class in windows.winobject.service) services (windows.winobject.system.System attribute) ServiceStatus (class in windows.winobject.service) set() (windows.winobject.registry.PyHKey method) set_context() (windows.winobject.process.WinThread method) set_hook() (windows.pe_parse.IATEntry method) set_syswow_context() (windows.winobject.process.WinThread method) SignatureData (class in windows.wintrust)

signed (windows.wintrust.SignatureData attribute) single_step() (windows.debug.Debugger method) (windows.debug.LocalDebugger method) sp (windows.winobject.exception.ECONTEXT32 attribute) (windows.winobject.exception.ECONTEXT64 attribute) (windows.winobject.exception.ECONTEXTWOW64 attribute) start_address (windows.winobject.process.WinThread attribute) state (windows.winobject.service.ServiceStatus attribute) status (windows.winobject.service.ServiceA attribute) str (windows.winobject.process.WinUnicodeString attribute) subkeys (windows.winobject.registry.PyHKey attribute) suspend() (windows.winobject.process.WinThread method) System (class in windows.winobject.system) Syswow64ApiProxy (class in windows.syswow64)

T

TCP4Connection (class in windows.winobject.network) TCP6Connection (class in windows.winobject.network) teb_base (windows.winobject.process.WinThread attribute) threads (windows.winobject.process.CurrentProcess attribute) (windows.winobject.process.WinProcess attribute) (windows.winobject.system.System attribute) tid (windows.winobject.process.CurrentThread attribute) (windows.winobject.process.WinThread attribute) time_info (windows.winobject.process.CurrentProcess attribute) (windows.winobject.process.WinProcess attribute) Token (class in windows.winobject.process)

token (windows.winobject.process.CurrentProcess attribute) (windows.winobject.process.WinProcess attribute) transform_type_to_remote32bits() (in module windows.remotectypes) transform_type_to_remote64bits() (in module windows.remotectypes) trigger() (windows.debug.Breakpoint method) (windows.debug.FunctionBP method) (windows.debug.HXBreakpoint method) (windows.debug.MemoryBreakpoint method) try_generate_stub_target() (in module windows.syswow64) type (windows.winobject.handle.Handle attribute) (windows.winobject.registry.KeyValue attribute) (windows.winobject.service.ServiceStatus attribute) (windows.winobject.volume.LogicalDrive attribute)

U

username (windows.winobject.process.Token attribute)

V

value (windows.winobject.network.Firewall attribute) (windows.winobject.network.FirewallRule attribute) (windows.winobject.registry.KeyValue attribute) values (windows.winobject.registry.PyHKey attribute) VectoredException (class in windows.winobject.exception) version (windows.winobject.system.System attribute) version_name (windows.winobject.system.System attribute)

virtual_alloc() (windows.winobject.process.CurrentProcess method) (windows.winobject.process.WinProcess method) virtual_free() (windows.winobject.process.CurrentProcess method) (windows.winobject.process.WinProcess method) virtual_protect() (windows.winobject.process.CurrentProcess method) (windows.winobject.process.WinProcess method) virtual_protected() (windows.winobject.process.CurrentProcess method) (windows.winobject.process.WinProcess method) VirtualProtected (class in windows.utils)

W

wait() (windows.winobject.process.CurrentProcess method) (windows.winobject.process.CurrentThread method) (windows.winobject.process.DeadThread method) (windows.winobject.process.Token method) (windows.winobject.process.WinProcess method) (windows.winobject.process.WinThread method) windows.com (module) windows.debug (module) windows.hooks (module) windows.native_exec (module) windows.native_exec.cpuid (module) windows.native_exec.nativeutils (module) windows.native_exec.simple_x64 (module) windows.native_exec.simple_x86 (module) windows.pe_parse (module) windows.remotectypes (module) windows.syswow64 (module) windows.utils (module) windows.winobject.exception (module) windows.winobject.handle (module) windows.winobject.network (module) windows.winobject.process (module)

windows.winobject.registry (module) windows.winobject.service (module) windows.winobject.volume (module) windows.winobject.wmi (module) windows.winproxy (module) windows.wintrust (module) WinProcess (class in windows.winobject.process) WinThread (class in windows.winobject.process) WinUnicodeString (class in windows.winobject.process) wmi (windows.winobject.system.System attribute) WmiRequester (class in windows.winobject.wmi) write_byte() (windows.winobject.process.CurrentProcess method) (windows.winobject.process.WinProcess method) write_dword() (windows.winobject.process.CurrentProcess method) (windows.winobject.process.WinProcess method) write_memory() (windows.winobject.process.CurrentProcess method) (windows.winobject.process.WinProcess method) write_qword() (windows.winobject.process.CurrentProcess method) (windows.winobject.process.WinProcess method) write_short() (windows.winobject.process.CurrentProcess method) (windows.winobject.process.WinProcess method)

X

x64_cpuid() (in module windows.native_exec.cpuid) x86_cpuid() (in module windows.native_exec.cpuid)

X86CpuidResult (class in windows.native_exec.cpuid)