2. The windows objects

Through the system object many classes representing various Windows parts are accessible.

This sections describes them by group of relation.

• 2.1. Processes and Threads
  • 2.1.1. CurrentProcess
  • 2.1.2. CurrentThread
  • 2.1.3. WinProcess
  • 2.1.4. WinThread
  • 2.1.5. Token
• 2.2. PEB Exploration
  • 2.2.1. PEB
  • 2.2.2. LoadedModule
  • 2.2.3. ApiSetMap
• 2.3. PEFile - Parsing loaded PE
  • 2.3.1. windows.pe_parse
    • 2.3.1.1. PEFile
    • 2.3.1.2. IATEntry
• 2.4. Exception and Context related structures
  • 2.4.1. Exception Records
  • 2.4.2. EXCEPTION DEBUG INFO
  • 2.4.3. Context
  • 2.4.4. EXCEPTION POINTERS
  • 2.4.5. Vectored Exception
• 2.5. Registry
  • 2.5.1. Registry
  • 2.5.2. PyHKey
  • 2.5.3. KeyValue
• 2.6. Network
  • 2.6.1. Connections
  • 2.6.2. Firewall
• 2.7. Service
• 2.8. Volume – The logical drives
• 2.9. WMI – Make request to WMI
  • 2.9.1. WmiManager
  • 2.9.2. WmiRequester
• 2.10. Handle – Processes handles