Updated some doc and samples

docs/source/etw.rst

@@ -0,0 +1,48 @@
+ETW -- Event Tracing for Windows
+================================
+
+.. module:: windows.winobject.event_trace
+
+The :class:`EtwManager` instance is accessible via :py:attr:`windows.system.etw
+<windows.winobject.system.System.etw>`
+
+.. note::
+
+    This code is the result of my research on ``ETW`` that lead to this presentation `ETW for the lazy reverser (FR) <https://www.rump.beer/2019/slides/etw_lazy_reverser.pdf>`_
+
+
+.. note::
+
+        See sample :ref:`sample_etw`
+
+
+EtwManager
+""""""""""
+
+
+.. autoclass:: EtwManager
+    :members:
+
+
+Tracing Events
+""""""""""""""
+
+EtwTrace
+''''''''
+
+.. autoclass:: EtwTrace
+    :members:
+
+
+EventTraceProperties
+''''''''''''''''''''
+
+.. autoclass:: EventTraceProperties
+    :members:
+
+EventRecord
+'''''''''''
+
+.. autoclass:: EventRecord
+    :members:
+

docs/source/evtlog.rst

@@ -10,6 +10,9 @@ I have tried to offer some abstraction without completly hidding the some underl
 
 The current API may need some works to provide simpler/highter level API in the future.
 
+The :class:`EvtlogManager` instance is accessible via :py:attr:`windows.system.event_log
+<windows.winobject.system.System.event_log>`
+
 For now, the best thing to do is look at the sample:
 
 .. note::

docs/source/index.rst

@@ -34,15 +34,19 @@ You can install PythonForWindows using the ``setup.py`` at the root of the proje
 
     python setup.py install
 
-In its current state the project only support Python2 and
-``setup.py`` will raise an :class:`NotImplementedError` if launched from python3.
-
-
 .. warning::
 
     PythonForWindows is not available on Pypi for now and thus cannot be directly installed using ``pip``.
 
 
+Python3
+^^^^^^^
+
+python3 support is still in beta.
+All the tests pass on master, but I did not test it heavily on real case.
+Do not hesitate report bugs and issues.
+
+
 Documentation
 """""""""""""
 

docs/source/sample.rst

@@ -669,3 +669,27 @@ Query SACL
 Output
 
 .. literalinclude:: samples_output\security_query_sacl.txt
+
+
+.. _sample_etw:
+
+ETW (Event Tracing for Windows)
+"""""""""""""""""""""""""""""""
+
+Trace processing
+''''''''''''''''
+
+.. literalinclude:: ..\..\samples\etw\uac_trace.py
+
+Output
+
+.. literalinclude:: samples_output\etw_uac_trace.txt
+
+Enumeration
+'''''''''''
+
+.. literalinclude:: ..\..\samples\etw\etw_enumeration.py
+
+Output
+
+.. literalinclude:: samples_output\etw_etw_enumeration.txt

docs/source/samples_output/etw_etw_enumeration.txt

@@ -0,0 +1,28 @@
+(cmd) python etw\etw_enumeration.py
+ETW Manager is: <windows.winobject.event_trace.EtwManager object at 0x03AFBF70>
+
+Listing some ETW sessions:
+  * <EventTraceProperties name="AppModel" guid=A922A8BE-2450-438E-9520-FBCDFB46B0BD>
+     * name: AppModel
+     * guid: A922A8BE-2450-438E-9520-FBCDFB46B0BD
+     * id: 4
+     * logfile: 
+  * <EventTraceProperties name="LwtNetLog" guid=603BA31E-EC5A-4CDE-BE87-ED0A16C3B170>
+     * name: LwtNetLog
+     * guid: 603BA31E-EC5A-4CDE-BE87-ED0A16C3B170
+     * id: 14
+     * logfile: C:\WINDOWS\System32\LogFiles\WMI\LwtNetLog.etl
+
+Looking for providers for: <EventTraceProperties name="LwtNetLog" guid=603BA31E-EC5A-4CDE-BE87-ED0A16C3B170>
+Found a provider/session for target:
+  * Provider: <TraceProvider for "43D1A55C-76D6-4F7E-995C-64C711E5CAFE">
+  * Instance: <TraceProviderInstanceInfo Pid=5256 EnableCount=1>
+  * Process: <WinProcess "RuntimeBroker.exe" pid 5256 at 0x54c39d0>
+Found a provider/session for target:
+  * Provider: <TraceProvider for "43D1A55C-76D6-4F7E-995C-64C711E5CAFE">
+  * Instance: <TraceProviderInstanceInfo Pid=10768 EnableCount=1>
+  * Process: <WinProcess "chrome.exe" pid 10768 at 0x54c3930>
+Found a provider/session for target:
+  * Provider: <TraceProvider for "43D1A55C-76D6-4F7E-995C-64C711E5CAFE">
+  * Instance: <TraceProviderInstanceInfo Pid=10236 EnableCount=1>
+  * Process: <WinProcess "YourPhone.exe" pid 10236 at 0x54c37d0>

docs/source/samples_output/etw_uac_trace.txt

@@ -0,0 +1,53 @@
+(cmd) python etw\uac_trace.py
+Recording UAC event in file <uac.trace> using session named <MY_UAC_MONITOR>
+0x1d65bb1febaceea: <EventRecord provider="68FDD900-4A3E-11D1-84F4-0000F80464E3" id=0>
+    guid: 68FDD900-4A3E-11D1-84F4-0000F80464E3
+    id: 0
+    opcode: 0
+    level: 0
+    data: '\x01\n\x01\x05\xbbG\x04-D\xd5\xff\xb1[\xd6\x01Zb\x02\t\x01\x04\xf0\x0c\t\x06\xc4\xff\xff\xff@tzres.dll,-302\n\x05\x03@tzres.dll,-301\x03\x05\x02\xc4\xff\xff\xff\xc0\x92\x1c\xd2D[\xd6\x01\x80\x96\x98\xea\xce\xba\xfe\xb1[\xd6\x01\x01MY_UAC_MONITORC:\\Users\\hakril\\Documents\\projets\\PythonForWindows\\samples\\uac.trace'
+[...]
+0x1d65bb1fec4c011: <EventRecord provider="DEB74A23-5444-3F3B-924B-0E653973F55A" id=11>
+    guid: DEB74A23-5444-3F3B-924B-0E653973F55A
+    id: 11
+    opcode: 0
+    level: 0
+    data: '\x9e\x06\x04\x19\x14\x04\x08\x04\xff\xff\xff\xffWinSta0\\DefaultC:\\Windows\\System32\\mmc.exe"C:\\Windows\\System32\\mmc.exe" BAD_MMC_FILENAMEC:\\Users\\hakril\\Documents\\projets\\PythonForWindows\\samples'
+0x1d65bb1fec4e48b: <EventRecord provider="C0B508D3-5459-339F-A213-889C238CA5B1" id=10>
+    guid: C0B508D3-5459-339F-A213-889C238CA5B1
+    id: 10
+    opcode: 0
+    level: 0
+    data: 'C:\\WINDOWS\\SysWOW64\\mmc.exe"C:\\WINDOWS\\SysWOW64\\mmc.exe" BAD_MMC_FILENAME` '
+0x1d65bb1fec7c8eb: <EventRecord provider="C0B508D3-5459-339F-A213-889C238CA5B1" id=13>
+    guid: C0B508D3-5459-339F-A213-889C238CA5B1
+    id: 13
+    opcode: 0
+    level: 0
+    data: 'C:\\WINDOWS\\SysWOW64\\mmc.exe'
+0x1d65bb1fec7c8f0: <EventRecord provider="C0B508D3-5459-339F-A213-889C238CA5B1" id=14>
+    guid: C0B508D3-5459-339F-A213-889C238CA5B1
+    id: 14
+    opcode: 0
+    level: 0
+    data: '"C:\\WINDOWS\\SysWOW64\\mmc.exe" BAD_MMC_FILENAME'
+[...]
+0x1d65bb1feca018d: <EventRecord provider="172FF31C-2D80-31A6-FCA8-EB000D380666" id=11>
+    guid: 172FF31C-2D80-31A6-FCA8-EB000D380666
+    id: 11
+    opcode: 0
+    level: 0
+    data: 'C:\\WINDOWS\\SysWOW64\\mmc.exe'
+0x1d65bb1feca030d: <EventRecord provider="172FF31C-2D80-31A6-FCA8-EB000D380666" id=25>
+    guid: 172FF31C-2D80-31A6-FCA8-EB000D380666
+    id: 25
+    opcode: 0
+    level: 0
+    data: 'C:\\WINDOWS\\SysWOW64\\mmc.exe\x08\x02TRUEFALSE\x10'
+0x1d65bb1fecfcdc0: <EventRecord provider="172FF31C-2D80-31A6-FCA8-EB000D380666" id=27>
+    guid: 172FF31C-2D80-31A6-FCA8-EB000D380666
+    id: 27
+    opcode: 0
+    level: 0
+    data: '\x05TRUETRUE'
+[...]

docs/source/winerror_generated.rst

@@ -1,7 +1,7 @@
 .. currentmodule:: windows.generated_def
 
 WinError
-------
+--------
 .. autodata:: FACILITY_NULL
 .. autodata:: FACILITY_RPC
 .. autodata:: FACILITY_DISPATCH

docs/source/winobject.rst

@@ -22,4 +22,5 @@ This sections describes them by group of relation.
     object_manager.rst
     device_manager.rst
     task_scheduler.rst
-    evtlog.rst
+    evtlog.rst
+    etw.rst