From 03e252b53af972c0404eaa94630c6d0b7b184271 Mon Sep 17 00:00:00 2001
From: hakril <project@hakril.net>
Date: Mon, 5 Mar 2018 01:06:30 +0100
Subject: [PATCH] Upgrade to sphinx 1.7.1 + small css fix +
 review/update/refactor doc samples

---
 docs/source/_static/css/mbasic.css            |  25 +
 docs/source/conf.py                           |   6 +-
 docs/source/sample.rst                        | 611 ++----------------
 .../samples_output/alpc_advanced_alpc.txt     |  87 +++
 .../samples_output/alpc_simple_alpc.txt       |  12 +
 .../samples_output/com_com_inetfwpolicy2.txt  |  15 +
 .../samples_output/crypto_certificate.txt     |  33 +
 .../source/samples_output/crypto_wintrust.txt |  15 +
 docs/source/samples_output/debug_attach.txt   |  15 +
 .../samples_output/debug_debug_functionbp.txt |  11 +
 .../debug_debugger_membp_singlestep.txt       |  11 +
 .../debug_debugger_print_LdrLoaddll.txt       |  24 +
 .../samples_output/debug_local_debugger.txt   |   8 +
 .../source/samples_output/network_network.txt |  16 +
 .../process_current_process.txt               |  12 +
 .../samples_output/process_iat_hook.txt       |  15 +
 docs/source/samples_output/process_peb.txt    |  23 +
 .../samples_output/process_remote_process.txt |  30 +
 .../samples_output/process_veh_segv.txt       |  19 +
 .../samples_output/registry_registry.txt      |  27 +
 docs/source/samples_output/rpc_lsass.txt      |  36 ++
 docs/source/samples_output/system.txt         |  39 ++
 docs/source/samples_output/test_code.txt      |  82 +++
 .../source/samples_output/wmi_wmi_request.txt |  15 +
 samples/alpc/advanced_alpc.py                 |   6 +-
 samples/crypto/encryption_demo.py             |   2 +-
 samples/debug/debugger_print_LdrLoaddll.py    |   6 +-
 samples/process/remote_process.py             |   2 +-
 windows/injection.py                          |   2 +-
 29 files changed, 637 insertions(+), 568 deletions(-)
 create mode 100644 docs/source/_static/css/mbasic.css
 create mode 100644 docs/source/samples_output/alpc_advanced_alpc.txt
 create mode 100644 docs/source/samples_output/alpc_simple_alpc.txt
 create mode 100644 docs/source/samples_output/com_com_inetfwpolicy2.txt
 create mode 100644 docs/source/samples_output/crypto_certificate.txt
 create mode 100644 docs/source/samples_output/crypto_wintrust.txt
 create mode 100644 docs/source/samples_output/debug_attach.txt
 create mode 100644 docs/source/samples_output/debug_debug_functionbp.txt
 create mode 100644 docs/source/samples_output/debug_debugger_membp_singlestep.txt
 create mode 100644 docs/source/samples_output/debug_debugger_print_LdrLoaddll.txt
 create mode 100644 docs/source/samples_output/debug_local_debugger.txt
 create mode 100644 docs/source/samples_output/network_network.txt
 create mode 100644 docs/source/samples_output/process_current_process.txt
 create mode 100644 docs/source/samples_output/process_iat_hook.txt
 create mode 100644 docs/source/samples_output/process_peb.txt
 create mode 100644 docs/source/samples_output/process_remote_process.txt
 create mode 100644 docs/source/samples_output/process_veh_segv.txt
 create mode 100644 docs/source/samples_output/registry_registry.txt
 create mode 100644 docs/source/samples_output/rpc_lsass.txt
 create mode 100644 docs/source/samples_output/system.txt
 create mode 100644 docs/source/samples_output/test_code.txt
 create mode 100644 docs/source/samples_output/wmi_wmi_request.txt

diff --git a/docs/source/_static/css/mbasic.css b/docs/source/_static/css/mbasic.css
new file mode 100644
index 0000000..1440e00
--- /dev/null
+++ b/docs/source/_static/css/mbasic.css
@@ -0,0 +1,25 @@
+/*
+ * basic.css
+ * ~~~~~~~~~
+ *
+ * Sphinx stylesheet -- basic theme.
+ *
+ * :copyright: Copyright 2007-2018 by the Sphinx team, see AUTHORS.
+ * :license: BSD, see LICENSE for details.
+ *
+ */
+
+/* -- general body styles --------------------------------------------------- */
+
+div.body {
+    min-width: 450px;
+    max-width: none;
+}
+
+div.admonition-todo {
+    border-top: 2px solid red;
+    border-bottom: 2px solid red;
+    border-left: 2px solid red;
+    border-right: 2px solid red;
+    background-color: #ff6347
+}
\ No newline at end of file
diff --git a/docs/source/conf.py b/docs/source/conf.py
index 42fbe79..7e92a2a 100644
--- a/docs/source/conf.py
+++ b/docs/source/conf.py
@@ -41,9 +41,11 @@ extensions = [
     'sphinx.ext.ifconfig',
     'sphinx.ext.viewcode',
     'sphinx.ext.autodoc',
+    'sphinx.ext.todo',
 ]
 
 autodoc_default_flags = ['inherited-members']
+todo_include_todos = True
 
 # Add any paths that contain templates here, relative to this directory.
 templates_path = ['_templates']
@@ -364,7 +366,7 @@ epub_exclude_files = ['search.html']
 
 
 # Example configuration for intersphinx: refer to the Python standard library.
-intersphinx_mapping = {'http://docs.python.org/': None}
+intersphinx_mapping = {'https://docs.python.org/2.7': None}
 
 
 def get_rst(app, what, name, obj, options, lines):
@@ -374,4 +376,4 @@ def get_rst2(app, what, name, obj, options, signature, return_annotation):
     pass
 
 def setup(app):
-    pass
+    app.add_stylesheet('css/mbasic.css')  # may also be an URL
diff --git a/docs/source/sample.rst b/docs/source/sample.rst
index 60543e3..7544960 100644
--- a/docs/source/sample.rst
+++ b/docs/source/sample.rst
@@ -1,4 +1,3 @@
-
 .. _sample_of_code:
 
 Samples of code
@@ -14,20 +13,10 @@ Processes
 
 .. literalinclude:: ..\..\samples\process\current_process.py
 
-Output::
+Output
+
+.. literalinclude:: samples_output\process_current_process.txt
 
-    (cmd λ) python32.exe process\current_process.py
-    current process is <windows.winobject.process.CurrentProcess object at 0x030A2590>
-    current process is a <32> bits process
-    current process is a SysWow64 process ? <True>
-    current process pid <8264>  and ppid <4100>
-    Here are the current process threads: <[<WinThread 13540 owner "python.exe" at 0x32d3210>]>
-    Let's execute some native code ! (0x41 + 1)
-    Native code returned <0x42>
-    Allocating memory in current process
-    Allocated memory is at <0xd60000>
-    Writing 'SOME STUFF' in allocation memory
-    Reading memory : <'SOME STUFF\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'>
 
 .. _sample_remote_process:
 
@@ -36,38 +25,11 @@ Remote process : :class:`WinProcess`
 
 .. literalinclude:: ..\..\samples\process\remote_process.py
 
-Output::
 
-    (cmd λ) python.exe process\remote_process.py
-    Creating a notepad
-    Looking for notepads in the processes
-    They are currently <1> notepads running on the system
-    Let's play with our notepad: <<WinProcess "notepad.exe" pid 2044 at 0x40ce850>>
-    Our notepad pid is 2044
-    Our notepad is a <32> bits process
-    Our notepad is a SysWow64 process ? <True>
-    Our notepad have threads ! <[<WinThread 7700 owner "notepad.exe" at 0x41faee0>, <WinThread 7264 owner "notepad.exe" at 0x41faf30>, ...]>
-    Exploring our notepad PEB ! <windows.winobject.process.RemotePEB object at 0x03F6CDA0>
-    Command line is <RemoteWinUnicodeString ""C:\windows\system32\notepad.exe"" at 0x3f6cf80>
-    Here are 3 loaded modules: [<RemoteLoadedModule "notepad.exe" at 0x3f6cf30>, <RemoteLoadedModule "ntdll.dll" at 0x3f6ce40>, <RemoteLoadedModule "kernel32.dll" at 0x3f6cee0>]
-    Allocating memory in our notepad
-    Allocated memory is at <0x6f80000>
-    Writing 'SOME STUFF' in allocated memory
-    Reading allocated memory : <'SOME STUFF\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'>
-    Execution some native code in our notepad (write 0x424242 at allocated address + return 0x1337)
-    Executing native code !
-    Return code = 0x1337L
-    Reading allocated memory : <'BBBB STUFF\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'>
-    Executing python code !
-    Reading allocated memory : <'HELLO FROM notepad\x00\x00'>
-    Trying to import in remote module 'FAKE_MODULE'
-    Remote ERROR !
-    Traceback (most recent call last):
-    File "<string>", line 3, in <module>
-    File "<string>", line 2, in func
-    ImportError: No module named FAKE_MODULE
+Output
+
+.. literalinclude:: samples_output\process_remote_process.txt
 
-    That's all ! killing the notepad
 
 
 .. _sample_peb_exploration:
@@ -77,31 +39,10 @@ Output::
 
 .. literalinclude:: ..\..\samples\process\peb.py
 
-Output::
+Output
+
+.. literalinclude:: samples_output\process_peb.txt
 
-    (cmd λ) python.exe  process\peb.py
-    Exploring the current process PEB
-    PEB is <<windows.winobject.PEB object at 0x02649B70>>
-    Commandline object is <WinUnicodeString "python.exe   peb.py " at 0x2649c60>
-    Commandline string is u'python.exe   peb.py '
-    Imagepath  <WinUnicodeString "C:\Python27\python.exe" at 0x2649d50>
-    Printing some modules: <LoadedModule "python.exe" at 0x272a030>
-    <LoadedModule "ntdll.dll" at 0x272a080>
-    <LoadedModule "kernel32.dll" at 0x272acb0>
-    <LoadedModule "kernelbase.dll" at 0x272ad00>
-    <LoadedModule "python27.dll" at 0x272ad50>
-    <LoadedModule "msvcr90.dll" at 0x272ada0>
-    === K32  ===
-    Looking for kernel32.dll
-    Kernel32 module: <LoadedModule "kernel32.dll" at 0x272acb0>
-    Module name = <kernel32.dll> | Fullname = <C:\Windows\SYSTEM32\KERNEL32.DLL>
-    Kernel32 is loaded at address 0x774c0000
-    === K32 PE ===
-    PE Representation of k32: <windows.pe_parse.PEFile object at 0x0272D350>
-    Here are some exports {0: 2001566688L, u'CreateFileA': 2001635616L, 42: 2001647872L, u'VirtualAlloc': 2001570704L}
-    Import DLL dependancies are (without api-*): [u'ntdll.dll', u'kernelbase.dll']
-    IAT Entry for ntdll!NtCreateFile = <IATEntry "NtCreateFile" ordinal 253> | addr = 0x77541128L
-    Sections: [<PESection ".text">, <PESection ".rdata">, <PESection ".data">, <PESection ".rsrc">, <PESection ".reloc">]
 
 .. _sample_iat_hook:
 
@@ -110,23 +51,10 @@ IAT hooking
 
 .. literalinclude:: ..\..\samples\process\iat_hook.py
 
-Output::
+Output
 
-    (cmd λ) python process\iat_hook.py
-    Asking for <MY_SECRET_KEY>
-    <in hook> Hook called | hKey = 0x12d687 | lpSubKey = <MY_SECRET_KEY>
-    <in hook> Secret key asked, returning magic handle 0x12345678
-    Result = 0x12345678
+.. literalinclude:: samples_output\process_iat_hook.txt
 
-    Asking for <MY_FAIL_KEY>
-    <in hook> Hook called | hKey = 0x12d687 | lpSubKey = <MY_FAIL_KEY>
-    <in hook> Asked for a failing key: returning 0x2a
-    WindowsError(42, 'Windows Error 0x2A')
-
-    Asking for <HKEY_CURRENT_USER/Software>
-    <in hook> Hook called | hKey = 0x80000001L | lpSubKey = <Software>
-    <in hook> Non-secret key : calling normal function
-    Result = 0x108
 
 .. _sample_system:
 
@@ -136,48 +64,9 @@ Output::
 
 .. literalinclude:: ..\..\samples\system.py
 
-Output::
-
-    (cmd λ) python system.py
-    Basic system infos:
-        version = (6, 3)
-        bitness = 64
-        computer_name = HAKRIL-PC
-        product_type = VER_NT_WORKSTATION(0x1L)
-        version_name = Windows 8.1
-
-    There is 117 processes
-    There is 1246 threads
-
-    Dumping first logical drive:
-        <LogicalDrive "C:\" (DRIVE_FIXED)>
-            name = C:\
-            type = DRIVE_FIXED(0x3L)
-            path = \Device\HarddiskVolume2
-
-    Dumping first service:
-        <ServiceA "ACPI">
-            name = ACPI
-            description = Microsoft ACPI Driver
-            status = ServiceStatus(type=SERVICE_KERNEL_DRIVER(0x1L), state=SERVICE_RUNNING(0x4L), control_accepted=1L, flags=0L)
-            process = None
-
-    Finding a service in a user process:
-        <ServiceA "Appinfo">
-            name = Appinfo
-            description = Application Information
-            status = ServiceStatus(type=SERVICE_WIN32_SHARE_PROCESS(0x20L), state=SERVICE_RUNNING(0x4L), control_accepted=129L, flags=0L)
-            process = <WinProcess "svchost.exe" pid 988 at 0x2e64750>
-
-    Enumerating handles:
-        There are 40664 handles:
-        First handle is: <Handle value=<0x4> in process pid=4>
-        Enumerating handles of the current process:
-            There are 255 handles for this process
-        Looking for a File handle:
-            Handle is <Handle value=<0x4> in process pid=14340>
-            Name is <\Device\ConDrv>
+Output
 
+.. literalinclude:: samples_output\system.txt
 
 
 .. _sample_network_exploration:
@@ -187,24 +76,9 @@ Output::
 
 .. literalinclude:: ..\..\samples\network\network.py
 
-Output::
+Output-New
 
-    (cmd λ) python.exe  network\network.py
-    Working on ipv4
-    == Listening ==
-    Some listening connections: [<TCP IPV4 Listening socket on 0.0.0.0:80>, <TCP IPV4 Listening socket on 0.0.0.0:135>, <TCP IPV4 Listening socket on 0.0.0.0:443>]
-    Listening ports are : [80, 135, 443, 445, 902, 912, 5357, 49152, 49153, 49154, 49155, 49157, 49159, 8307, 25340, 139, 139]
-    == Established ==
-    Some established connections: [<TCP IPV4 Connection 127.0.0.1:25340 -> 127.0.0.1:49472>, <TCP IPV4 Connection 127.0.0.1:49173 -> 127.0.0.1:49174>, <TCP IPV4 Connection 127.0.0.1:49174 -> 127.0.0.1:49173>]
-    == connection to localhost:80 ==
-    Our connection is [<TCP IPV4 Connection 127.0.0.1:49616 -> 127.0.0.1:80>]
-    Sending YOP
-    Closing socket
-    Sending LAIT
-    Traceback (most recent call last):
-    File ".\network.py", line 45, in <module>
-        s.send("LAIT")
-    socket.error: [Errno 10054] An existing connection was forcibly closed by the remote host
+.. literalinclude:: samples_output\network_network.txt
 
 
 .. _sample_registry:
@@ -214,36 +88,9 @@ Output::
 
 .. literalinclude:: ..\..\samples\registry\registry.py
 
-Output::
+Output
 
-    (cmd λ) python.exe registry\registry.py
-    Registry is <<windows.registry.Registry object at 0x02941290>>
-    HKEY_CURRENT_USER is <<PyHKey "HKEY_CURRENT_USER">>
-    HKEY_CURRENT_USER subkeys names are:
-    ['AppEvents',
-    'AppXBackupContentType',
-    'Console',
-    'Control Panel',
-    'Environment',
-    'EUDC',
-    'Identities',
-    'Keyboard Layout',
-    'Network',
-    'Printers',
-    'Software',
-    'System',
-    'Volatile Environment']
-    Opening 'Software' in HKEY_CURRENT_USER: <PyHKey "HKEY_CURRENT_USER\Software">
-    We can also open it in one access: <PyHKey "HKEY_CURRENT_USER\Sofware">
-    Looking at CurrentVersion
-    Key is <PyHKey "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion">
-    values are:
-    [KeyValue(name='SoftwareType', value=u'System', type=1),
-    KeyValue(name='RegisteredOwner', value=u'hakril', type=1),
-    KeyValue(name='InstallDate', value=0, type=4),
-    ...
-    KeyValue(name='PathName', value=u'C:\\Windows', type=1)]
-    registered owner = <KeyValue(name='RegisteredOwner', value=u'hakril', type=1)>
+.. literalinclude:: samples_output\registry_registry.txt
 
 
 .. _sample_wintrust:
@@ -253,23 +100,10 @@ Output::
 
 .. literalinclude:: ..\..\samples\crypto\wintrust.py
 
-Output::
+Output
+
+.. literalinclude:: samples_output\crypto_wintrust.txt
 
-    (cmd λ) python crypto\wintrust.py
-    Checking signature of <C:\windows\system32\ntdll.dll>
-    is_signed: <True>
-    check_signature: <0>
-    full_signature_information:
-        * signed <True>
-        * catalog <C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_35_for_KB3128650~31bf3856ad364e35~amd64~~6.3.1.2.cat>
-        * catalogsigned <True>
-        * additionalinfo <0>
-    Checking signature of some loaded DLL
-    <c:\python27\python.exe> : False (TRUST_E_NOSIGNATURE(0x800b0100L))
-    <c:\windows\system32\ntdll.dll> : True
-    <c:\windows\system32\kernel32.dll> : True
-    <c:\windows\system32\kernelbase.dll> : True
-    <c:\windows\system32\python27.dll> : False (TRUST_E_NOSIGNATURE(0x800b0100L))
 
 .. _sample_vectoredexception:
 
@@ -281,27 +115,10 @@ In local process
 
 .. literalinclude:: ..\..\samples\process\veh_segv.py
 
-Output::
+Output
 
-    (cmd λ) python.exe process\veh_segv.py
-    Protected page is at <0x1db0000>
-    Setting page protection to <PAGE_NOACCESS>
+.. literalinclude:: samples_output\process_veh_segv.txt
 
-    ==Entry of VEH handler==
-    Instr at 0x1d1ab574 accessed to addr 0x1db0000
-    Resetting page protection to <PAGE_READWRITE>
-    ==Entry of VEH handler==
-    Exception of type EXCEPTION_SINGLE_STEP(0x80000004L)
-    Resetting page protection to <PAGE_NOACCESS>
-    Value 1 read
-
-    ==Entry of VEH handler==
-    Instr at 0x1d1ab574 accessed to addr 0x1db0010
-    Resetting page protection to <PAGE_READWRITE>
-    ==Entry of VEH handler==
-    Exception of type EXCEPTION_SINGLE_STEP(0x80000004L)
-    Resetting page protection to <PAGE_NOACCESS>
-    Value 2 read
 
 
 In remote process
@@ -347,25 +164,11 @@ Debugging
 
 .. literalinclude:: ..\..\samples\debug\debugger_print_LdrLoaddll.py
 
-Ouput::
 
-    (cmd λ) python.exe debug\debugger_print_LdrLoaddll.py
-    Loading <KERNEL32.DLL>
-    Got exception EXCEPTION_BREAKPOINT(0x80000003L) at 0x77a73bad
-    Loading <C:\Windows\system32\IMM32.DLL>
-    Loading <C:\Windows\system32\uxtheme.dll>
-    Loading <C:\Windows\system32\uxtheme.dll>
-    Loading <C:\Windows\system32\uxtheme.dll>
-    Loading <C:\Windows\system32\uxtheme.dll>
-    Loading <kernel32.dll>
-    Loading <C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.9600.17415_none_dad8722c5bcc2d8f\gdiplus.dll>
-    Loading <comctl32.dll>
-    Loading <comctl32.dll>
-    Loading <comctl32.dll>
-    Loading <C:\Windows\system32\shell32.dll>
-    Loading <C:\Windows\SYSTEM32\WINMM.dll>
-    Loading <C:\Windows\system32\ole32.dll>
-    Ask to load <ole32.dll>: exiting process
+Output
+
+.. literalinclude:: samples_output\debug_debugger_print_LdrLoaddll.txt
+
 
 
 Single stepping
@@ -373,19 +176,9 @@ Single stepping
 
 .. literalinclude:: ..\..\samples\debug\debugger_membp_singlestep.py
 
-Ouput::
+Output
 
-    (cmd λ) python.exe debug\debugger_membp_singlestep.py
-    Got exception EXCEPTION_BREAKPOINT(0x80000003L) at 0x77ae3c7d
-    Instruction at <0x8d0006> wrote at <0x8e0000>
-    Got single_step EXCEPTION_SINGLE_STEP(0x80000004L) at 0x8d000c
-    Got single_step EXCEPTION_SINGLE_STEP(0x80000004L) at 0x8d0011
-    Instruction at <0x8d0011> wrote at <0x8e0004>
-    Got single_step EXCEPTION_SINGLE_STEP(0x80000004L) at 0x8d0017
-    Got single_step EXCEPTION_SINGLE_STEP(0x80000004L) at 0x8d001c
-    Got single_step EXCEPTION_SINGLE_STEP(0x80000004L) at 0x8d0022
-    Got single_step EXCEPTION_SINGLE_STEP(0x80000004L) at 0x8d0023
-    No more single step: exiting
+.. literalinclude:: samples_output\debug_debugger_membp_singlestep.txt
 
 
 :class:`windows.debug.FunctionBP`
@@ -393,19 +186,10 @@ Ouput::
 
 .. literalinclude:: ..\..\samples\debug\debug_functionbp.py
 
-Ouput::
+Output
 
-    (cmd λ) python.exe debug\debug_functionbp.py
-    NtCreateFile of <\??\C:\Windows\syswow64\en-US\calc.exe.mui>: handle = 0xac
-    Handle manually found! typename=<File>, name=<\Device\HarddiskVolume2\Windows\SysWOW64\en-US\calc.exe.mui>
+.. literalinclude:: samples_output\debug_debug_functionbp.txt
 
-    NtCreateFile of <\Device\DeviceApi\CMApi>: handle = 0x108
-    Handle manually found! typename=<File>, name=<\Device\DeviceApi>
-
-    NtCreateFile of <\??\C:\Windows\Fonts\staticcache.dat>: handle = 0x154
-    Handle manually found! typename=<File>, name=<\Device\HarddiskVolume2\Windows\Fonts\StaticCache.dat>
-
-    Exiting process
 
 .. _sample_debugger_attach:
 
@@ -414,25 +198,9 @@ Ouput::
 
 .. literalinclude:: ..\..\samples\debug\attach.py
 
-Ouput::
-
-    (cmd λ) python.exe debug\attach.py
-    Finding process with pid <11392>
-    Target is <WinProcess "notepad.exe" pid 11392 at 0x471a750>
-    Debugger attached: <windows.debug.debugger.Debugger object at 0x04707EF0>
-
-    NtCreateFile of <\??\C:\Windows\Fonts\staticcache.dat>: handle = 0x288
-    Handle manually found! typename=<File>, name=<\Device\HarddiskVolume4\Windows\Fonts\StaticCache.dat>
-
-    NtCreateFile of <\??\C:\WINDOWS\Registration\R000000000015.clb>: handle = 0x320
-    Handle manually found! typename=<File>, name=<\Device\HarddiskVolume4\Windows\Registration\R000000000015.clb>
-
-    NtCreateFile of <\??\C:\WINDOWS\Globalization\Sorting\sortdefault.nls>: handle = 0x334
-    Handle manually found! typename=<File>, name=<\Device\HarddiskVolume4\Windows\Globalization\Sorting\SortDefault.nls>
-
-    Exiting process
-
+Output
 
+.. literalinclude:: samples_output\debug_attach.txt
 
 
 
@@ -442,90 +210,9 @@ Native code tester
 .. literalinclude:: ..\..\samples\test_code.py
 
 
-Ouput::
+Ouput
 
-    (cmd λ) python.exe test_code.py "mov eax, 0x42424242" "eax=0x11223344"
-    Testing x86 code
-    Startup context is:
-    Eip -> 0x3f0000L
-    Esp -> 0x3bfae4L
-    Eax -> 0x11223344L
-    Ebx -> 0x5a6000L
-    Ecx -> 0x0L
-    Edx -> 0x0L
-    Ebp -> 0x0L
-    Edi -> 0x0L
-    Esi -> 0x0L
-    EFlags -> 0x202L
-    EEflags(0x202L:IF)
-    ==Post-exec context==
-    Eip -> 0x3f0007L
-    Esp -> 0x3bfae4L
-    Eax -> 0x42424242L
-    Ebx -> 0x5a6000L
-    Ecx -> 0x0L
-    Edx -> 0x0L
-    Ebp -> 0x0L
-    Edi -> 0x0L
-    Esi -> 0x0L
-    EFlags -> 0x202L
-    EEflags(0x202L:IF)
-    <Normal terminaison>
-    ==DIFF==
-    Eip: 0x3f0000 -> 0x3f0007 (+0x7)
-    Eax: 0x11223344 -> 0x42424242 (+0x31200efe)
-
-
-    (cmd λ) python64 test_code.py --x64 "mov r15, 0x11223344; push r14; call r15" "rcx=1; r14=0x4242424243434343"
-    Testing x64 code
-    Startup context is:
-    Rip -> 0x205a1d60000L
-    Rsp -> 0xe24a88fa88L
-    Rax -> 0x0L
-    Rbx -> 0x0L
-    Rcx -> 0x1L
-    Rdx -> 0xe24aaf9000L
-    Rbp -> 0x0L
-    Rdi -> 0x0L
-    Rsi -> 0x0L
-    R8 -> 0x0L
-    R9 -> 0x0L
-    R10 -> 0x0L
-    R11 -> 0x0L
-    R12 -> 0x0L
-    R13 -> 0x0L
-    R14 -> 0x4242424243434343L
-    R15 -> 0x0L
-    EFlags -> 0x200L
-    EEflags(0x200L:IF)
-    ==Post-exec context==
-    Rip -> 0x11223344L
-    Rsp -> 0xe24a88fa78L
-    Rax -> 0x0L
-    Rbx -> 0x0L
-    Rcx -> 0x1L
-    Rdx -> 0xe24aaf9000L
-    Rbp -> 0x0L
-    Rdi -> 0x0L
-    Rsi -> 0x0L
-    R8 -> 0x0L
-    R9 -> 0x0L
-    R10 -> 0x0L
-    R11 -> 0x0L
-    R12 -> 0x0L
-    R13 -> 0x0L
-    R14 -> 0x4242424243434343L
-    R15 -> 0x11223344L
-    EFlags -> 0x10202L
-    EEflags(0x10202L:IF|RF)
-    <EXCEPTION_ACCESS_VIOLATION(0xc0000005L)> at <0x11223344>
-    ==DIFF==
-    Rip: 0x205a1d60000 -> 0x11223344 (-0x20590b3ccbc)
-    Rsp: 0xe24a88fa88 -> 0xe24a88fa78 (-0x10)
-    R15: 0x0 -> 0x11223344 (+0x11223344)
-    EFlags: 0x200 -> 0x10202 (+0x10002)
-    Negative Stack: dumping:
-    E24A88FA88 0C 00 D6 A1 05 02 00 00  43 43 43 43 42 42 42 42 ........CCCCBBBB
+.. literalinclude:: samples_output\test_code.txt
 
 
 .. _sample_local_debugger:
@@ -539,16 +226,9 @@ In current process
 
 .. literalinclude:: ..\..\samples\debug\local_debugger.py
 
-Ouput::
+Output
 
-    (cmd λ) python.exe debug\local_debugger.py
-    Code addr = 0xcf0002
-    GOT AN HXBP at 0xcf0002
-    EXCEPTION !!!! Got a EXCEPTION_SINGLE_STEP(0x80000004L) at 0xcf0003
-    EXCEPTION !!!! Got a EXCEPTION_SINGLE_STEP(0x80000004L) at 0xcf0004
-    EXCEPTION !!!! Got a EXCEPTION_SINGLE_STEP(0x80000004L) at 0xcf0005
-    EXCEPTION !!!! Got a EXCEPTION_SINGLE_STEP(0x80000004L) at 0x770d7c04
-    Done!
+.. literalinclude:: samples_output\debug_local_debugger.txt
 
 
 In remote process
@@ -556,6 +236,7 @@ In remote process
 
 .. literalinclude:: ..\..\samples\debug\local_debugger_remote_process.py
 
+
 Ouput::
 
     (cmd λ) python.exe debug\local_debugger_remote_process.py
@@ -590,26 +271,10 @@ WMI requests
 
 .. literalinclude:: ..\..\samples\wmi\wmi_request.py
 
+Output
 
-Ouput::
+.. literalinclude:: samples_output\wmi_wmi_request.txt
 
-    (cmd λ) python wmi\wmi_request.py
-    WMI requester is <windows.winobject.wmi.WmiRequester object at 0x02B37EF0>
-    Selecting * from 'Win32_Process'
-    They are <92> processes
-    Looking for ourself via pid
-    Some info about our process:
-        * Name -> python.exe
-        * ProcessId -> 7968
-        * OSName -> Microsoft Windows 8.1 Pro|C:\Windows|\Device\Harddisk0\Partition2
-        * UserModeTime -> 2812500
-        * WindowsVersion -> 6.3.9600
-        * CommandLine -> python.exe  .\samples\wmi_request.py
-    <Select Caption,FileSystem,FreeSpace from Win32_LogicalDisk>:
-        * {'Caption': u'C:', 'FreeSpace': u'43991547904', 'FileSystem': u'NTFS'}
-        * {'Caption': u'E:', 'FreeSpace': u'82776027136', 'FileSystem': u'NTFS'}
-        * {'Caption': u'F:', 'FreeSpace': u'5711265792', 'FileSystem': u'FAT32'}
-        * {'Caption': u'G:', 'FreeSpace': None, 'FileSystem': None}
 
 .. _sample_com_firewall:
 
@@ -618,23 +283,10 @@ using COM: ``INetFwPolicy2``
 
 .. literalinclude:: ..\..\samples\com\com_inetfwpolicy2.py
 
-Output::
+Output
 
-    (cmd λ) python com\com_inetfwpolicy2.py
-    Initialisation of COM
-    Creating INetFwPolicy2 variable
-    <INetFwPolicy2 object at 0x02DC8210> (value = None)
+.. literalinclude:: samples_output\com_com_inetfwpolicy2.txt
 
-    Generating CLSID
-    <IID "E2B3C97F-6AE1-41AC-817A-F6F92166D7DD">
-
-    Creating COM instance
-    <INetFwPolicy2 object at 0x02DC8210> (value = 0x8984848)
-
-    Checking for enabled profiles
-    * NET_FW_PROFILE2_DOMAIN(0x1L) -> True
-    * NET_FW_PROFILE2_PRIVATE(0x2L) -> True
-    * NET_FW_PROFILE2_PUBLIC(0x4L) -> True
 
 
 :mod:`windows.crypto`
@@ -670,7 +322,7 @@ Ouput::
     \xc6\x12x\x1am\xc8\x01t\xac\xa6\xf3#\x02\xd4J \x8eZ\xbb\x10W\xe1 0;\x06\t*\x86H\x86\xf7\r\x01\x07\x010\x14\x06\x08*
     \x86H\x86\xf7\r\x03\x07\x04\x08\x14F\x04\xad\xed9\xed<\x80\x18\x80]6\xccTV\xbc\xb8*\x84QY!~\xb3\n\x1aV\xd4\rf\xd1n:')
 
-    (cmd λ) python crypto\encryption_demo.py decrypt message.crypt mykey.pfx BADPASS
+    (cmd λ) python crypto\encryption_demo.py decrypt decrypt --password BADPASS message.crypt mykey.pfx
     Traceback (most recent call last):
     File "..\samples\encryption_demo.py", line 103, in <module>
         res.func(**res.__dict__)
@@ -686,7 +338,7 @@ Ouput::
         raise Kernel32Error(func_name)
     windows.winproxy.Kernel32Error: PFXImportCertStore: [Error 86] The specified network password is not correct.
 
-    (cmd λ) python crypto\encryption_demo.py decrypt message.crypt mykey.pfx MYPASSWORD
+    (cmd λ) python crypto\encryption_demo.py decrypt --password MYPASSWORD message.crypt mykey.pfx
     Result = <my secret message>
 
 
@@ -697,43 +349,9 @@ Certificate demo
 
 .. literalinclude:: ..\..\samples\crypto\certificate.py
 
+Output
 
-Ouput::
-
-
-    (cmd λ) python crypto\certificate.py
-    Analysing certificate: <CertificateContext "Microsoft Windows" serial="33 00 00 01 06 6e c3 25 c4 31 c9 18 0e 00 00 00 00 01 06">
-        * name: <Microsoft Windows>
-        * issuer: <Microsoft Windows Production PCA 2011>
-        * raw_serial: <[51, 0, 0, 1, 6, 110, 195, 37, 196, 49, 201, 24, 14, 0, 0, 0, 0, 1, 6]>
-        * serial: <33 00 00 01 06 6e c3 25 c4 31 c9 18 0e 00 00 00 00 01 06>
-        * encoded start: <bytearray(b'0\x82\x05\x040\x82\x03\xec\xa0\x03\x02\x01\x02\x02\x133\x00\x00\x01\x06')>
-
-    This certificate has 1 certificate chain(s)
-    Chain 0:
-    <CertificateContext "Microsoft Windows" serial="33 00 00 01 06 6e c3 25 c4 31 c9 18 0e 00 00 00 00 01 06">:
-        * issuer: <Microsoft Windows Production PCA 2011>
-    <CertificateContext "Microsoft Windows Production PCA 2011" serial="61 07 76 56 00 00 00 00 00 08">:
-        * issuer: <Microsoft Root Certificate Authority 2010>
-    <CertificateContext "Microsoft Root Certificate Authority 2010" serial="28 cc 3a 25 bf ba 44 ac 44 9a 9b 58 6b 43 39 aa">:
-        * issuer: <Microsoft Root Certificate Authority 2010>
-
-    Looking for <Microsoft Root Certificate Authority 2010> in trusted certificates
-    matches = [<CertificateContext "Microsoft Root Certificate Authority 2010" serial="28 cc 3a 25 bf ba 44 ac 44 9a 9b 58 6b 43 39 aa">]
-    Found it !
-
-    == PE Analysis ==
-    Target sha1 = <eb90bc0e33f3e62b0eac4afa8bfcf42a5d4e7bbb>
-    Analysing <CryptObject "C:\windows\system32\ntdll.dll" content_type=CERT_QUERY_CONTENT_PKCS7_SIGNED_EMBED(0xaL)>
-    File has 1 signer(s):
-    Signer 0:
-    * Issuer: bytearray(b'0\x81\x841\x0b0\t\x06\x03U\x04\x06\x13\x02US1\x130\x11\x06\x03U\x04\x08\x13\nWashington1\x100\x0e\x06\x03U\x04\x07\x13\x07Redmond1\x1e0\x1c\x06\x03U\x04\n\x13\x15Microsoft Corporation1.0,\x06\x03U\x04\x03\x13%Microsoft Windows Production PCA 2011')
-    * HashAlgorithme: 2.16.840.1.101.3.4.2.1
-    * Certificate: <CertificateContext "Microsoft Windows" serial="33 00 00 01 06 6e c3 25 c4 31 c9 18 0e 00 00 00 00 01 06">
-
-    File embdeds 2 certificate(s):
-    * 0) <CertificateContext "Microsoft Windows" serial="33 00 00 01 06 6e c3 25 c4 31 c9 18 0e 00 00 00 00 01 06">
-    * 1) <CertificateContext "Microsoft Windows Production PCA 2011" serial="61 07 76 56 00 00 00 00 00 08">
+.. literalinclude:: samples_output\crypto_certificate.txt
 
 
 
@@ -747,20 +365,10 @@ simple alpc communication
 
 .. literalinclude:: ..\..\samples\alpc\simple_alpc.py
 
-Ouput::
+Output
 
-    (cmd λ) python alpc\simple_alpc.py
-    [SERV] PORT <\RPC Control\PythonForWindowsPORT> CREATED
-    Client pid = 15044
-    [SERV] Message type = 0x300a
-    [SERV] Received data: <>
-    [SERV] Connection request
-    [CLIENT] Connected: <windows.alpc.AlpcClient object at 0x0377FDB0>
+.. literalinclude:: samples_output\alpc_simple_alpc.txt
 
-    [SERV] Received message: <Hello world !>
-    [SERV] Message type = 0x3001
-    [CLIENT] Response: <REQUEST 'Hello world !' DONE>
-    BYE
 
 .. _sample_advanced_alpc:
 
@@ -770,90 +378,9 @@ advanced alpc communication
 
 .. literalinclude:: ..\..\samples\alpc\advanced_alpc.py
 
+Output
 
-Output::
-
-    (cmd λ) python alpc\advanced_alpc.py
-    server pid = 13000
-    [SERV] PORT <\RPC Control\PythonForWindowsPORT_2> CREATED
-    Client pid = 2100
-    [CLIENT] == Connecting to port ==
-    [SERV] == Message received ==
-    * ALPC connection request: <Connection request client message>
-    [CLIENT] Connected with response: <Connection message response>
-
-    [CLIENT] == Sending a message ==
-    * Sending Message <Complex Message 1>
-    [SERV] == Message received ==
-    * ALPC request: <Complex Message 1>
-    * view_is_valid <False>
-    * security_is_valid <False>
-    * handle_is_valid <False>
-    * context_is_valid <True>
-    * message context attribute:
-        - CTX.PortContext -> 0x11223344
-        - CTX.MessageContext -> None
-        - CTX.Sequence -> 0x1L
-        - CTX.MessageId -> 0x0L
-        - CTX.CallbackId -> 0x0L
-    * message token attribute:
-    - TOKEN.TokenId -> 0x1e4ecaccL
-    - TOKEN.AuthenticationId -> 0x48989L
-    - TOKEN.ModifiedId -> 0x48995L
-    [CLIENT] Server response: <REQUEST 'Complex Message 1' DONE>
-    [CLIENT] RESP Message Valid ATTRS = [ALPC_MESSAGE_CONTEXT_ATTRIBUTE(0x20000000L)]
-
-    [Client] == Sending a message with a handle ==
-    [SERV] == Message received ==
-    * ALPC request: <some message with a file>
-    * view_is_valid <False>
-    * security_is_valid <False>
-    * handle_is_valid <True>
-    * message handle attribute:
-        - HANDLE.Flags -> 0x0L
-        - HANDLE.Handle -> 0x260
-        - HANDLE.ObjectType -> 0x1L
-        - HANDLE.DesiredAccess -> 0x13019fL
-    - File: <open file '<fdopen>', mode 'r' at 0x02D529C0>
-    - content: <Tempfile data <3>
-    * context_is_valid <True>
-    * message context attribute:
-        - CTX.PortContext -> 0x11223344
-        - CTX.MessageContext -> None
-        - CTX.Sequence -> 0x2L
-        - CTX.MessageId -> 0x0L
-        - CTX.CallbackId -> 0x0L
-    * message token attribute:
-    - TOKEN.TokenId -> 0x1e4ecaccL
-    - TOKEN.AuthenticationId -> 0x48989L
-    - TOKEN.ModifiedId -> 0x48995L
-
-    [Client] == Sending a message with a view ==
-    [SERV] == Message received ==
-    * ALPC request: <some message with a view>
-    * view_is_valid <True>
-    * message view attribute:
-        - VIEW.Flags -> 0x0L
-        - VIEW.SectionHandle -> None
-        - VIEW.ViewBase -> 0x2770000
-        - VIEW.ViewSize -> 0x4000
-    * Reading view content: <The content of the view :)>
-    * security_is_valid <False>
-    * handle_is_valid <False>
-    * context_is_valid <True>
-    * message context attribute:
-        - CTX.PortContext -> 0x11223344
-        - CTX.MessageContext -> None
-        - CTX.Sequence -> 0x3L
-        - CTX.MessageId -> 0x0L
-        - CTX.CallbackId -> 0x0L
-    * message token attribute:
-    - TOKEN.TokenId -> 0x1e4ecaccL
-    - TOKEN.AuthenticationId -> 0x48989L
-    - TOKEN.ModifiedId -> 0x48995L
-    BYE
-
-
+.. literalinclude:: samples_output\alpc_advanced_alpc.txt
 
 
 :mod:`windows.rpc`
@@ -891,42 +418,8 @@ Manual ``LsarEnumeratePrivileges``
 
 .. literalinclude:: ..\..\samples\rpc\lsass.py
 
-Output::
+Output
+
+.. literalinclude:: samples_output\rpc_lsass.txt
 
-    (cmd λ) python rpc\lsass.py
-    (2, u'SeCreateTokenPrivilege')
-    (3, u'SeAssignPrimaryTokenPrivilege')
-    (4, u'SeLockMemoryPrivilege')
-    (5, u'SeIncreaseQuotaPrivilege')
-    (6, u'SeMachineAccountPrivilege')
-    (7, u'SeTcbPrivilege')
-    (8, u'SeSecurityPrivilege')
-    (9, u'SeTakeOwnershipPrivilege')
-    (10, u'SeLoadDriverPrivilege')
-    (11, u'SeSystemProfilePrivilege')
-    (12, u'SeSystemtimePrivilege')
-    (13, u'SeProfileSingleProcessPrivilege')
-    (14, u'SeIncreaseBasePriorityPrivilege')
-    (15, u'SeCreatePagefilePrivilege')
-    (16, u'SeCreatePermanentPrivilege')
-    (17, u'SeBackupPrivilege')
-    (18, u'SeRestorePrivilege')
-    (19, u'SeShutdownPrivilege')
-    (20, u'SeDebugPrivilege')
-    (21, u'SeAuditPrivilege')
-    (22, u'SeSystemEnvironmentPrivilege')
-    (23, u'SeChangeNotifyPrivilege')
-    (24, u'SeRemoteShutdownPrivilege')
-    (25, u'SeUndockPrivilege')
-    (26, u'SeSyncAgentPrivilege')
-    (27, u'SeEnableDelegationPrivilege')
-    (28, u'SeManageVolumePrivilege')
-    (29, u'SeImpersonatePrivilege')
-    (30, u'SeCreateGlobalPrivilege')
-    (31, u'SeTrustedCredManAccessPrivilege')
-    (32, u'SeRelabelPrivilege')
-    (33, u'SeIncreaseWorkingSetPrivilege')
-    (34, u'SeTimeZonePrivilege')
-    (35, u'SeCreateSymbolicLinkPrivilege')
-    (36, u'SeDelegateSessionUserImpersonatePrivilege')
 
diff --git a/docs/source/samples_output/alpc_advanced_alpc.txt b/docs/source/samples_output/alpc_advanced_alpc.txt
new file mode 100644
index 0000000..f2f78f0
--- /dev/null
+++ b/docs/source/samples_output/alpc_advanced_alpc.txt
@@ -0,0 +1,87 @@
+(cmd) python alpc\advanced_alpc.py
+server pid = 2300
+[SERV] PORT <\RPC Control\PythonForWindowsPORT_2> CREATED
+Client pid = 14848
+[CLIENT] == Connecting to port ==
+[SERV] == Message received ==
+ * ALPC connection request: <Connection request client message>
+[CLIENT] Connected with response: <Connection message response>
+
+[CLIENT] == Sending a message ==
+ * Sending Message <Complex Message 1>
+[SERV] == Message received ==
+ * ALPC request: <Complex Message 1>
+ * view_is_valid <False>
+ * security_is_valid <False>
+ * handle_is_valid <False>
+ * context_is_valid <True>
+   * message context attribute:
+     - CTX.PortContext -> 0x11223344
+     - CTX.MessageContext -> None
+     - CTX.Sequence -> 0x1L
+     - CTX.MessageId -> 0x0L
+     - CTX.CallbackId -> 0x0L
+ * message token attribute:
+   - TOKEN.TokenId -> 0x4101ef8eL
+   - TOKEN.AuthenticationId -> 0x54177L
+   - TOKEN.ModifiedId -> 0x4077ab89L
+[CLIENT] Server response: <REQUEST 'Complex Message 1' DONE>
+[CLIENT] RESP Message Valid ATTRS = [ALPC_MESSAGE_CONTEXT_ATTRIBUTE(0x20000000L)]
+
+[Client] == Sending a message with a handle ==
+[SERV] == Message received ==
+ * ALPC request: <some message with a file>
+ * view_is_valid <False>
+ * security_is_valid <False>
+ * handle_is_valid <True>
+   * message handle attribute:
+       - HANDLE.Flags -> 0x0L
+       - HANDLE.Handle -> 0x2cc
+       - HANDLE.ObjectType -> 0x1L
+       - HANDLE.DesiredAccess -> 0x13019fL
+   - File: <open file '<fdopen>', mode 'r' at 0x049ECA18>
+   - content: <Tempfile data <3>
+ * context_is_valid <True>
+   * message context attribute:
+     - CTX.PortContext -> 0x11223344
+     - CTX.MessageContext -> None
+     - CTX.Sequence -> 0x2L
+     - CTX.MessageId -> 0x0L
+     - CTX.CallbackId -> 0x0L
+ * message token attribute:
+   - TOKEN.TokenId -> 0x4101ef8eL
+   - TOKEN.AuthenticationId -> 0x54177L
+   - TOKEN.ModifiedId -> 0x4077ab89L
+
+[Client] == Sending a message with a view ==
+[SERV] == Message received ==
+ * ALPC request: <some message with a view>
+ * view_is_valid <True>
+   * message view attribute:
+       - VIEW.Flags -> 0x0L
+       - VIEW.SectionHandle -> None
+       - VIEW.ViewBase -> 0x4780000
+       - VIEW.ViewSize -> 0x4000
+   * Reading view content: <The content of the view :)>
+ * security_is_valid <False>
+ * handle_is_valid <False>
+ * context_is_valid <True>
+   * message context attribute:
+     - CTX.PortContext -> 0x11223344
+     - CTX.MessageContext -> None
+     - CTX.Sequence -> 0x3L
+     - CTX.MessageId -> 0x0L
+     - CTX.CallbackId -> 0x0L
+ * message token attribute:
+   - TOKEN.TokenId -> 0x4101ef8eL
+   - TOKEN.AuthenticationId -> 0x54177L
+   - TOKEN.ModifiedId -> 0x4077ab89L
+[SERV] == Message received ==
+Unexpected message type <12>
+[SERV] == Message received ==
+Unexpected message type <5>
+[SERV] == Message received ==
+Unexpected message type <12>
+[SERV] == Message received ==
+Unexpected message type <12>
+BYE
\ No newline at end of file
diff --git a/docs/source/samples_output/alpc_simple_alpc.txt b/docs/source/samples_output/alpc_simple_alpc.txt
new file mode 100644
index 0000000..7fd6501
--- /dev/null
+++ b/docs/source/samples_output/alpc_simple_alpc.txt
@@ -0,0 +1,12 @@
+(cmd) python alpc\simple_alpc.py
+[SERV] PORT <\RPC Control\PythonForWindowsPORT> CREATED
+Client pid = 15840
+[SERV] Message type = 0x300a
+[SERV] Received data: <>
+[SERV] Connection request
+[CLIENT] Connected: <windows.alpc.AlpcClient object at 0x06919290>
+
+[SERV] Received message: <Hello world !>
+[SERV] Message type = 0x3001
+[CLIENT] Response: <REQUEST 'Hello world !' DONE>
+BYE
diff --git a/docs/source/samples_output/com_com_inetfwpolicy2.txt b/docs/source/samples_output/com_com_inetfwpolicy2.txt
new file mode 100644
index 0000000..f6b1045
--- /dev/null
+++ b/docs/source/samples_output/com_com_inetfwpolicy2.txt
@@ -0,0 +1,15 @@
+(cmd) python com\com_inetfwpolicy2.py
+Initialisation of COM
+Creating INetFwPolicy2 variable
+<INetFwPolicy2 object at 0x060677B0> (value = None)
+
+Generating CLSID
+<IID "E2B3C97F-6AE1-41AC-817A-F6F92166D7DD">
+
+Creating COM instance
+<INetFwPolicy2 object at 0x060677B0> (value = 0x85678080)
+
+Checking for enabled profiles
+   * NET_FW_PROFILE2_DOMAIN(0x1L) -> True
+   * NET_FW_PROFILE2_PRIVATE(0x2L) -> True
+   * NET_FW_PROFILE2_PUBLIC(0x4L) -> True
diff --git a/docs/source/samples_output/crypto_certificate.txt b/docs/source/samples_output/crypto_certificate.txt
new file mode 100644
index 0000000..af22603
--- /dev/null
+++ b/docs/source/samples_output/crypto_certificate.txt
@@ -0,0 +1,33 @@
+(cmd) python crypto\certificate.py
+Analysing certificate: <Certificate "Microsoft Windows" serial="33 00 00 01 06 6e c3 25 c4 31 c9 18 0e 00 00 00 00 01 06">
+    * name: <Microsoft Windows>
+    * issuer: <Microsoft Windows Production PCA 2011>
+    * raw_serial: <[51, 0, 0, 1, 6, 110, 195, 37, 196, 49, 201, 24, 14, 0, 0, 0, 0, 1, 6]>
+    * serial: <33 00 00 01 06 6e c3 25 c4 31 c9 18 0e 00 00 00 00 01 06>
+    * encoded start: <bytearray(b'0\x82\x05\x040\x82\x03\xec\xa0\x03\x02\x01\x02\x02\x133\x00\x00\x01\x06')>
+
+This certificate has 1 certificate chain(s)
+Chain 0:
+  <Certificate "Microsoft Windows" serial="33 00 00 01 06 6e c3 25 c4 31 c9 18 0e 00 00 00 00 01 06">:
+    * issuer: <Microsoft Windows Production PCA 2011>
+  <Certificate "Microsoft Windows Production PCA 2011" serial="61 07 76 56 00 00 00 00 00 08">:
+    * issuer: <Microsoft Root Certificate Authority 2010>
+  <Certificate "Microsoft Root Certificate Authority 2010" serial="28 cc 3a 25 bf ba 44 ac 44 9a 9b 58 6b 43 39 aa">:
+    * issuer: <Microsoft Root Certificate Authority 2010>
+
+Looking for <Microsoft Root Certificate Authority 2010> in trusted certificates
+matches = [<Certificate "Microsoft Root Certificate Authority 2010" serial="28 cc 3a 25 bf ba 44 ac 44 9a 9b 58 6b 43 39 aa">]
+Found it !
+
+== PE Analysis ==
+Target sha1 = <339e4c236e716d4b6f6b10359c425eb3d1478df7>
+Analysing <CryptObject "C:\windows\system32\ntdll.dll" content_type=CERT_QUERY_CONTENT_PKCS7_SIGNED_EMBED(0xaL)>
+File has 1 signer(s):
+Signer 0:
+   * Issuer: bytearray(b'0\x81\x841\x0b0\t\x06\x03U\x04\x06\x13\x02US1\x130\x11\x06\x03U\x04\x08\x13\nWashington1\x100\x0e\x06\x03U\x04\x07\x13\x07Redmond1\x1e0\x1c\x06\x03U\x04\n\x13\x15Microsoft Corporation1.0,\x06\x03U\x04\x03\x13%Microsoft Windows Production PCA 2011')
+   * HashAlgorithme: 2.16.840.1.101.3.4.2.1
+   * Certificate: <Certificate "Microsoft Windows" serial="33 00 00 01 73 30 31 07 26 65 b8 b9 b3 00 00 00 00 01 73">
+
+File embdeds 2 certificate(s):
+   * 0) <Certificate "Microsoft Windows" serial="33 00 00 01 73 30 31 07 26 65 b8 b9 b3 00 00 00 00 01 73">
+   * 1) <Certificate "Microsoft Windows Production PCA 2011" serial="61 07 76 56 00 00 00 00 00 08">
diff --git a/docs/source/samples_output/crypto_wintrust.txt b/docs/source/samples_output/crypto_wintrust.txt
new file mode 100644
index 0000000..89478ae
--- /dev/null
+++ b/docs/source/samples_output/crypto_wintrust.txt
@@ -0,0 +1,15 @@
+(cmd) python crypto\wintrust.py
+Checking signature of <C:\windows\system32\ntdll.dll>
+ is_signed: <True>
+ check_signature: <0>
+ full_signature_information:
+    * signed <True>
+    * catalog <C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_802_for_KB4054517~31bf3856ad364e35~amd64~~10.0.1.6.cat>
+    * catalogsigned <True>
+    * additionalinfo <0>
+Checking signature of some loaded DLL
+<c:\python27\python.exe> : False (TRUST_E_NOSIGNATURE(0x800b0100L))
+<c:\windows\system32\ntdll.dll> : True
+<c:\windows\system32\kernel32.dll> : True
+<c:\windows\system32\kernelbase.dll> : True
+<c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.9317_none_508dca76bcbcfe81\msvcr90.dll> : True
diff --git a/docs/source/samples_output/debug_attach.txt b/docs/source/samples_output/debug_attach.txt
new file mode 100644
index 0000000..f837d25
--- /dev/null
+++ b/docs/source/samples_output/debug_attach.txt
@@ -0,0 +1,15 @@
+(cmd) python debug\attach.py
+Finding process with pid <12252>
+Target is <WinProcess "notepad.exe" pid 12252 at 0x66971b0>
+Debugger attached: <windows.debug.debugger.Debugger object at 0x0667CFD0>
+
+NtCreateFile of <10573272>: handle = 0x144
+Handle manually found! typename=<File>, name=<\Device\HarddiskVolume2\Windows\SysWOW64\en-US\notepad.exe.mui>
+
+NtCreateFile of <1996168876>: handle = 0x170
+Handle manually found! typename=<File>, name=<\Device\DeviceApi>
+
+NtCreateFile of <10504328>: handle = 0x2a8
+Handle manually found! typename=<File>, name=<\Device\HarddiskVolume2\Windows\Fonts\StaticCache.dat>
+
+Exiting process
diff --git a/docs/source/samples_output/debug_debug_functionbp.txt b/docs/source/samples_output/debug_debug_functionbp.txt
new file mode 100644
index 0000000..767d912
--- /dev/null
+++ b/docs/source/samples_output/debug_debug_functionbp.txt
@@ -0,0 +1,11 @@
+(cmd) python debug\debug_functionbp.py
+NtCreateFile of <86250608>: handle = 0x124
+Handle manually found! typename=<File>, name=<\Device\HarddiskVolume2\Windows\SysWOW64\en-US\notepad.exe.mui>
+
+NtCreateFile of <1996168876>: handle = 0x150
+Handle manually found! typename=<File>, name=<\Device\DeviceApi>
+
+NtCreateFile of <86206640>: handle = 0x280
+Handle manually found! typename=<File>, name=<\Device\HarddiskVolume2\Windows\Fonts\StaticCache.dat>
+
+Exiting process
diff --git a/docs/source/samples_output/debug_debugger_membp_singlestep.txt b/docs/source/samples_output/debug_debugger_membp_singlestep.txt
new file mode 100644
index 0000000..e3e231b
--- /dev/null
+++ b/docs/source/samples_output/debug_debugger_membp_singlestep.txt
@@ -0,0 +1,11 @@
+(cmd) python debug\debugger_membp_singlestep.py
+Got exception EXCEPTION_BREAKPOINT(0x80000003L) at 0x77e0dadf
+Instruction at <0x520006> wrote at <0x530000>
+Got single_step EXCEPTION_SINGLE_STEP(0x80000004L) at 0x52000c
+Got single_step EXCEPTION_SINGLE_STEP(0x80000004L) at 0x520011
+Instruction at <0x520011> wrote at <0x530004>
+Got single_step EXCEPTION_SINGLE_STEP(0x80000004L) at 0x520017
+Got single_step EXCEPTION_SINGLE_STEP(0x80000004L) at 0x52001c
+Got single_step EXCEPTION_SINGLE_STEP(0x80000004L) at 0x520022
+Got single_step EXCEPTION_SINGLE_STEP(0x80000004L) at 0x520023
+No more single step: exiting
diff --git a/docs/source/samples_output/debug_debugger_print_LdrLoaddll.txt b/docs/source/samples_output/debug_debugger_print_LdrLoaddll.txt
new file mode 100644
index 0000000..7b30c78
--- /dev/null
+++ b/docs/source/samples_output/debug_debugger_print_LdrLoaddll.txt
@@ -0,0 +1,24 @@
+(cmd) python debug\debugger_print_LdrLoaddll.py
+Loading <kernel32.dll>
+Got exception EXCEPTION_BREAKPOINT(0x80000003L) at 0x77e0dadf
+Loading <api-ms-win-core-synch-l1-2-0>
+Loading <api-ms-win-core-fibers-l1-1-1>
+Loading <api-ms-win-core-fibers-l1-1-1>
+Loading <api-ms-win-core-synch-l1-2-0>
+Loading <api-ms-win-core-localization-l1-2-1>
+Loading <kernel32>
+Loading <api-ms-win-core-string-l1-1-0>
+Loading <api-ms-win-core-datetime-l1-1-1>
+Loading <api-ms-win-core-localization-obsolete-l1-2-0>
+Loading <c:\windows\system32\imm32.dll>
+Loading <api-ms-win-core-processthreads-l1-1-2.dll>
+Loading <c:\windows\system32\uxtheme.dll>
+Loading <c:\windows\system32\mrmcorer.dll>
+Loading <c:\windows\system32\windows.storage.dll>
+Loading <c:\windows\system32\efswrt.dll>
+Loading <c:\windows\system32\twinapi.appcore.dll>
+Loading <rpcrt4.dll>
+Loading <c:\windows\system32\wintypes.dll>
+Loading <c:\windows\syswow64\wintypes.dll>
+Loading <comctl32.dll>
+Ask to load <comctl32.dll>: exiting process
diff --git a/docs/source/samples_output/debug_local_debugger.txt b/docs/source/samples_output/debug_local_debugger.txt
new file mode 100644
index 0000000..3a50a81
--- /dev/null
+++ b/docs/source/samples_output/debug_local_debugger.txt
@@ -0,0 +1,8 @@
+(cmd) python debug\local_debugger.py
+Code addr = 0x5450002
+GOT AN HXBP at 0x5450002
+EXCEPTION !!!! Got a EXCEPTION_SINGLE_STEP(0x80000004L) at 0x5450003
+EXCEPTION !!!! Got a EXCEPTION_SINGLE_STEP(0x80000004L) at 0x5450004
+EXCEPTION !!!! Got a EXCEPTION_SINGLE_STEP(0x80000004L) at 0x5450005
+EXCEPTION !!!! Got a EXCEPTION_SINGLE_STEP(0x80000004L) at 0x76948654
+Done!
diff --git a/docs/source/samples_output/network_network.txt b/docs/source/samples_output/network_network.txt
new file mode 100644
index 0000000..0c8abf0
--- /dev/null
+++ b/docs/source/samples_output/network_network.txt
@@ -0,0 +1,16 @@
+(cmd) python network\network.py
+Working on ipv4
+== Listening ==
+Some listening connections: [<TCP IPV4 Listening socket on 0.0.0.0:80>, <TCP IPV4 Listening socket on 0.0.0.0:135>, <TCP IPV4 Listening socket on 0.0.0.0:445>]
+Listening ports are : [80, 135, 445, 902, 912, 27036, 49664, 49665, 49666, 49667, 49671, 49673, 1120, 1120, 1120, 1120, 1120, 1120, 1120, 1120, 1120, 1120, 1120, 1120, 1120, 1120, 1120, 1120, 1120, 1120, 1120, 1120, 1120, 1120, 1120, 1120, 1120, 1120, 1120, 1120, 1120, 1120, 1120, 1120, 1120, 1120, 1120, 1120, 1120, 1120, 1120, 1120, 1120, 1120, 1120, 1120, 1120, 1120, 1120, 5556, 6463, 22885, 22886, 27060, 49330, 49331, 49794, 49795, 49867, 52541, 57125, 57138, 65000, 65001, 139, 5556, 57046, 57109, 57110, 57143, 57144, 139, 5556, 139, 5556]
+== Established ==
+Some established connections: [<TCP IPV4 Connection 127.0.0.1:912 -> 127.0.0.1:49488>, <TCP IPV4 Connection 127.0.0.1:912 -> 127.0.0.1:52332>, <TCP IPV4 Connection 127.0.0.1:49488 -> 127.0.0.1:912>]
+== connection to localhost:80 ==
+Our connection is [<TCP IPV4 Connection 127.0.0.1:57167 -> 127.0.0.1:80>]
+Sending YOP
+Closing socket
+Sending LAIT
+Traceback (most recent call last):
+  File "network\network.py", line 34, in <module>
+    s.send("LAIT")
+socket.error: [Errno 10054] An existing connection was forcibly closed by the remote host
diff --git a/docs/source/samples_output/process_current_process.txt b/docs/source/samples_output/process_current_process.txt
new file mode 100644
index 0000000..b7906dc
--- /dev/null
+++ b/docs/source/samples_output/process_current_process.txt
@@ -0,0 +1,12 @@
+(cmd) python process\current_process.py
+current process is <windows.winobject.process.CurrentProcess object at 0x06407430>
+current process is a <32> bits process
+current process is a SysWow64 process ? <True>
+current process pid <11344>  and ppid <14984>
+Here are the current process threads: <[<WinThread 17288 owner "CurrentProcess" at 0x6a68870>, <WinThread 15176 owner "CurrentProcess" at 0x6a687b0>, <WinThread 8972 owner "CurrentProcess" at 0x6a68bf0>, <WinThread 5568 owner "CurrentProcess" at 0x6a68dd0>]>
+Let's execute some native code ! (0x41 + 1)
+Native code returned <0x42>
+Allocating memory in current process
+Allocated memory is at <0x5510000>
+Writing 'SOME STUFF' in allocation memory
+Reading memory : <'SOME STUFF\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'>
diff --git a/docs/source/samples_output/process_iat_hook.txt b/docs/source/samples_output/process_iat_hook.txt
new file mode 100644
index 0000000..4f5f335
--- /dev/null
+++ b/docs/source/samples_output/process_iat_hook.txt
@@ -0,0 +1,15 @@
+(cmd) python process\iat_hook.py
+Asking for <MY_SECRET_KEY>
+<in hook> Hook called | hKey = 0x12d687 | lpSubKey = <MY_SECRET_KEY>
+<in hook> Secret key asked, returning magic handle 0x12345678
+Result = 0x12345678
+
+Asking for <MY_FAIL_KEY>
+<in hook> Hook called | hKey = 0x12d687 | lpSubKey = <MY_FAIL_KEY>
+<in hook> Asked for a failing key: returning 0x2a
+WindowsError(42, 'Windows Error 0x2A')
+
+Asking for <HKEY_CURRENT_USER/Software>
+<in hook> Hook called | hKey = 0x80000001L | lpSubKey = <Software>
+<in hook> Non-secret key : calling normal function
+Result = 0x428
diff --git a/docs/source/samples_output/process_peb.txt b/docs/source/samples_output/process_peb.txt
new file mode 100644
index 0000000..2e7905b
--- /dev/null
+++ b/docs/source/samples_output/process_peb.txt
@@ -0,0 +1,23 @@
+(cmd) python process\peb.py
+Exploring the current process PEB
+PEB is <<windows.winobject.process.PEB object at 0x05A6F710>>
+Commandline object is <_LSA_UNICODE_STRING "C:\Python27\python.exe  process\peb.py" at 0x5a6f8a0>
+Commandline string is 47063282
+Imagepath  <_LSA_UNICODE_STRING "C:\Python27\python.exe" at 0x5a6f990>
+Printing some modules: <LoadedModule "python.exe" at 0x60d2080>
+<LoadedModule "ntdll.dll" at 0x60d2030>
+<LoadedModule "kernel32.dll" at 0x60d2b20>
+<LoadedModule "kernelbase.dll" at 0x60d2b70>
+<LoadedModule "python27.dll" at 0x60d2bc0>
+<LoadedModule "msvcr90.dll" at 0x60d2c10>
+=== K32  ===
+Looking for kernel32.dll
+Kernel32 module: <LoadedModule "kernel32.dll" at 0x60d2b20>
+Module name = <kernel32.dll> | Fullname = <c:\windows\system32\kernel32.dll>
+Kernel32 is loaded at address 0x76930000
+=== K32 PE ===
+PE Representation of k32: <windows.pe_parse.PEFile object at 0x060CCA10>
+Here are some exports {0: 1989445168L, 'CreateFileA': 1989795280L, 42: 1989636592L, 'VirtualAlloc': 1989437552L}
+Import DLL dependancies are (without api-*): ['kernelbase.dll', 'ntdll.dll']
+IAT Entry for ntdll!NtCreateFile = <IATEntry "NtCreateFile" ordinal 272> | addr = 0x769a1a28L
+Sections: [<PESection ".text">, <PESection ".rdata">, <PESection ".data">, <PESection ".rsrc">, <PESection ".reloc">]
diff --git a/docs/source/samples_output/process_remote_process.txt b/docs/source/samples_output/process_remote_process.txt
new file mode 100644
index 0000000..0e09a51
--- /dev/null
+++ b/docs/source/samples_output/process_remote_process.txt
@@ -0,0 +1,30 @@
+(cmd) python process\remote_process.py
+Creating a notepad
+Looking for notepads in the processes
+They are currently <1> notepads running on the system
+Let's play with our notepad: <<WinProcess "notepad.exe" pid 8400 at 0x6238510>>
+Our notepad pid is 8400
+Our notepad is a <32> bits process
+Our notepad is a SysWow64 process ? <True>
+Our notepad have threads ! <[<WinThread 16028 owner "notepad.exe" at 0x6238f10>, <WinThread 5924 owner "notepad.exe" at 0x6238a10>, <WinThread 11620 owner "notepad.exe" at 0x6238fb0>, <WinThread 3480 owner "notepad.exe" at 0x6238ff0>, <WinThread 200 owner "notepad.exe" at 0x62389b0>, <WinThread 16804 owner "notepad.exe" at 0x62389f0>, <WinThread 13340 owner "notepad.exe" at 0x6238930>]>
+Exploring our notepad PEB ! <windows.winobject.process.RemotePEB object at 0x061BDA80>
+Command line is <Remote_LSA_UNICODE_STRING ""C:\windows\system32\notepad.exe"" at 0x61bdb20>
+Here are 3 loaded modules: [<RemoteLoadedModule "notepad.exe" at 0x61bdad0>, <RemoteLoadedModule "ntdll.dll" at 0x61bd940>, <RemoteLoadedModule "kernel32.dll" at 0x61bd8f0>]
+Allocating memory in our notepad
+Allocated memory is at <0x6f00000>
+Writing 'SOME STUFF' in allocated memory
+Reading allocated memory : <'SOME STUFF\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'>
+Execution some native code in our notepad (write 0x424242 at allocated address + return 0x1337)
+Executing native code !
+Return code = 0x1337L
+Reading allocated memory : <'BBBB STUFF\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'>
+Executing python code !
+Reading allocated memory : <'HELLO FROM notepad\x00\x00'>
+Trying to import in remote module 'FAKE_MODULE'
+Exception in remote process!
+Traceback (most recent call last):
+  File "<string>", line 3, in <module>
+  File "<string>", line 2, in func
+ImportError: No module named FAKE_MODULE
+
+That's all ! killing the notepad
diff --git a/docs/source/samples_output/process_veh_segv.txt b/docs/source/samples_output/process_veh_segv.txt
new file mode 100644
index 0000000..ffa1b05
--- /dev/null
+++ b/docs/source/samples_output/process_veh_segv.txt
@@ -0,0 +1,19 @@
+(cmd) python process\veh_segv.py
+Protected page is at <0x7270000>
+Setting page protection to <PAGE_NOACCESS>
+
+==Entry of VEH handler==
+Instr at 0x6a54c166 accessed to addr 0x7270000
+Resetting page protection to <PAGE_READWRITE>
+==Entry of VEH handler==
+Exception of type EXCEPTION_SINGLE_STEP(0x80000004L)
+Resetting page protection to <PAGE_NOACCESS>
+Value 1 read
+
+==Entry of VEH handler==
+Instr at 0x6a54c166 accessed to addr 0x7270010
+Resetting page protection to <PAGE_READWRITE>
+==Entry of VEH handler==
+Exception of type EXCEPTION_SINGLE_STEP(0x80000004L)
+Resetting page protection to <PAGE_NOACCESS>
+Value 2 read
diff --git a/docs/source/samples_output/registry_registry.txt b/docs/source/samples_output/registry_registry.txt
new file mode 100644
index 0000000..3568dbb
--- /dev/null
+++ b/docs/source/samples_output/registry_registry.txt
@@ -0,0 +1,27 @@
+(cmd) python registry\registry.py
+Registry is <<windows.winobject.registry.Registry object at 0x061F89F0>>
+HKEY_CURRENT_USER is <<PyHKey "HKEY_CURRENT_USER">>
+HKEY_CURRENT_USER subkeys names are:
+['AppEvents',
+ 'AppXBackupContentType',
+ 'Console',
+ 'Control Panel',
+ 'Environment',
+ 'EUDC',
+ 'Keyboard Layout',
+ 'Network',
+ 'Printers',
+ 'Software',
+ 'System',
+ 'Uninstall',
+ 'Volatile Environment']
+Opening 'Software' in HKEY_CURRENT_USER: <PyHKey "HKEY_CURRENT_USER\Software">
+We can also open it in one access: <PyHKey "HKEY_CURRENT_USER\Sofware">
+Looking at CurrentVersion
+Key is <PyHKey "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion">
+values are:
+[KeyValue(name='SoftwareType', value=u'System', type=1),
+ KeyValue(name='RegisteredOwner', value=u'hakril', type=1),
+ ...
+ KeyValue(name='PathName', value=u'C:\\WINDOWS', type=1)]
+registered owner = <KeyValue(name='RegisteredOwner', value=u'hakril', type=1)>
diff --git a/docs/source/samples_output/rpc_lsass.txt b/docs/source/samples_output/rpc_lsass.txt
new file mode 100644
index 0000000..a8ada25
--- /dev/null
+++ b/docs/source/samples_output/rpc_lsass.txt
@@ -0,0 +1,36 @@
+(cmd) python rpc\lsass.py
+(2, u'SeCreateTokenPrivilege')
+(3, u'SeAssignPrimaryTokenPrivilege')
+(4, u'SeLockMemoryPrivilege')
+(5, u'SeIncreaseQuotaPrivilege')
+(6, u'SeMachineAccountPrivilege')
+(7, u'SeTcbPrivilege')
+(8, u'SeSecurityPrivilege')
+(9, u'SeTakeOwnershipPrivilege')
+(10, u'SeLoadDriverPrivilege')
+(11, u'SeSystemProfilePrivilege')
+(12, u'SeSystemtimePrivilege')
+(13, u'SeProfileSingleProcessPrivilege')
+(14, u'SeIncreaseBasePriorityPrivilege')
+(15, u'SeCreatePagefilePrivilege')
+(16, u'SeCreatePermanentPrivilege')
+(17, u'SeBackupPrivilege')
+(18, u'SeRestorePrivilege')
+(19, u'SeShutdownPrivilege')
+(20, u'SeDebugPrivilege')
+(21, u'SeAuditPrivilege')
+(22, u'SeSystemEnvironmentPrivilege')
+(23, u'SeChangeNotifyPrivilege')
+(24, u'SeRemoteShutdownPrivilege')
+(25, u'SeUndockPrivilege')
+(26, u'SeSyncAgentPrivilege')
+(27, u'SeEnableDelegationPrivilege')
+(28, u'SeManageVolumePrivilege')
+(29, u'SeImpersonatePrivilege')
+(30, u'SeCreateGlobalPrivilege')
+(31, u'SeTrustedCredManAccessPrivilege')
+(32, u'SeRelabelPrivilege')
+(33, u'SeIncreaseWorkingSetPrivilege')
+(34, u'SeTimeZonePrivilege')
+(35, u'SeCreateSymbolicLinkPrivilege')
+(36, u'SeDelegateSessionUserImpersonatePrivilege')
diff --git a/docs/source/samples_output/system.txt b/docs/source/samples_output/system.txt
new file mode 100644
index 0000000..0e04f00
--- /dev/null
+++ b/docs/source/samples_output/system.txt
@@ -0,0 +1,39 @@
+(cmd) python system.py
+Basic system infos:
+    version = (10, 0)
+    bitness = 64
+    computer_name = WILLIE
+    product_type = VER_NT_WORKSTATION(0x1L)
+    version_name = Windows 10
+
+There is 222 processes
+There is 2716 threads
+
+Dumping first logical drive:
+    <LogicalDrive "C:\" (DRIVE_FIXED)>
+        name = C:\
+        type = DRIVE_FIXED(0x3L)
+        path = \Device\HarddiskVolume2
+
+Dumping first service:
+    <ServiceA "1394ohci" SERVICE_STOPPED(0x1L)>
+        name = 1394ohci
+        description = 1394 OHCI Compliant Host Controller
+        status = ServiceStatus(type=SERVICE_KERNEL_DRIVER(0x1L), state=SERVICE_STOPPED(0x1L), control_accepted=0L, flags=0L)
+        process = None
+
+Finding a service in a user process:
+    <ServiceA "Appinfo" SERVICE_RUNNING(0x4L)>
+        name = Appinfo
+        description = Application Information
+        status = ServiceStatus(type=48L, state=SERVICE_RUNNING(0x4L), control_accepted=129L, flags=0L)
+        process = <WinProcess "svchost.exe" pid 13288 at 0x63ffc10>
+
+Enumerating handles:
+    There are 106325 handles:
+    First handle is: <Handle value=<0x4> in process pid=4>
+    Enumerating handles of the current process:
+        There are 261 handles for this process
+    Looking for a File handle:
+        Handle is <Handle value=<0x4> in process pid=16752>
+        Name is <\Device\ConDrv>
diff --git a/docs/source/samples_output/test_code.txt b/docs/source/samples_output/test_code.txt
new file mode 100644
index 0000000..2d277ec
--- /dev/null
+++ b/docs/source/samples_output/test_code.txt
@@ -0,0 +1,82 @@
+(cmd) python.exe test_code.py "mov eax, 0x42424242" "eax=0x11223344"
+Testing x86 code
+Startup context is:
+Eip -> 0x3f0000L
+Esp -> 0x3bfae4L
+Eax -> 0x11223344L
+Ebx -> 0x5a6000L
+Ecx -> 0x0L
+Edx -> 0x0L
+Ebp -> 0x0L
+Edi -> 0x0L
+Esi -> 0x0L
+EFlags -> 0x202L
+EEflags(0x202L:IF)
+==Post-exec context==
+Eip -> 0x3f0007L
+Esp -> 0x3bfae4L
+Eax -> 0x42424242L
+Ebx -> 0x5a6000L
+Ecx -> 0x0L
+Edx -> 0x0L
+Ebp -> 0x0L
+Edi -> 0x0L
+Esi -> 0x0L
+EFlags -> 0x202L
+EEflags(0x202L:IF)
+<Normal terminaison>
+==DIFF==
+Eip: 0x3f0000 -> 0x3f0007 (+0x7)
+Eax: 0x11223344 -> 0x42424242 (+0x31200efe)
+
+
+(cmd) python64 test_code.py --x64 "mov r15, 0x11223344; push r14; call r15" "rcx=1; r14=0x4242424243434343"
+Testing x64 code
+Startup context is:
+Rip -> 0x205a1d60000L
+Rsp -> 0xe24a88fa88L
+Rax -> 0x0L
+Rbx -> 0x0L
+Rcx -> 0x1L
+Rdx -> 0xe24aaf9000L
+Rbp -> 0x0L
+Rdi -> 0x0L
+Rsi -> 0x0L
+R8 -> 0x0L
+R9 -> 0x0L
+R10 -> 0x0L
+R11 -> 0x0L
+R12 -> 0x0L
+R13 -> 0x0L
+R14 -> 0x4242424243434343L
+R15 -> 0x0L
+EFlags -> 0x200L
+EEflags(0x200L:IF)
+==Post-exec context==
+Rip -> 0x11223344L
+Rsp -> 0xe24a88fa78L
+Rax -> 0x0L
+Rbx -> 0x0L
+Rcx -> 0x1L
+Rdx -> 0xe24aaf9000L
+Rbp -> 0x0L
+Rdi -> 0x0L
+Rsi -> 0x0L
+R8 -> 0x0L
+R9 -> 0x0L
+R10 -> 0x0L
+R11 -> 0x0L
+R12 -> 0x0L
+R13 -> 0x0L
+R14 -> 0x4242424243434343L
+R15 -> 0x11223344L
+EFlags -> 0x10202L
+EEflags(0x10202L:IF|RF)
+<EXCEPTION_ACCESS_VIOLATION(0xc0000005L)> at <0x11223344>
+==DIFF==
+Rip: 0x205a1d60000 -> 0x11223344 (-0x20590b3ccbc)
+Rsp: 0xe24a88fa88 -> 0xe24a88fa78 (-0x10)
+R15: 0x0 -> 0x11223344 (+0x11223344)
+EFlags: 0x200 -> 0x10202 (+0x10002)
+Negative Stack: dumping:
+E24A88FA88 0C 00 D6 A1 05 02 00 00  43 43 43 43 42 42 42 42 ........CCCCBBBB
\ No newline at end of file
diff --git a/docs/source/samples_output/wmi_wmi_request.txt b/docs/source/samples_output/wmi_wmi_request.txt
new file mode 100644
index 0000000..e45345f
--- /dev/null
+++ b/docs/source/samples_output/wmi_wmi_request.txt
@@ -0,0 +1,15 @@
+(cmd) python wmi\wmi_request.py
+WMI requester is <windows.winobject.wmi.WmiManager object at 0x052D7CA8>
+Selecting * from 'Win32_Process'
+They are <224> processes
+Looking for ourself via pid
+Some info about our process:
+    * Name -> python.exe
+    * ProcessId -> 10136
+    * OSName -> Microsoft Windows 10 Home|C:\WINDOWS|\Device\Harddisk0\Partition2
+    * UserModeTime -> 1718750
+    * WindowsVersion -> 10.0.16299
+    * CommandLine -> C:\Python27\python.exe  wmi\wmi_request.py
+<Select Caption,FileSystem,FreeSpace from Win32_LogicalDisk>:
+    * {'Caption': u'C:', 'FreeSpace': u'15900839936', 'FileSystem': u'NTFS'}
+    * {'Caption': u'D:', 'FreeSpace': u'301635821568', 'FileSystem': u'NTFS'}
diff --git a/samples/alpc/advanced_alpc.py b/samples/alpc/advanced_alpc.py
index ebdcdfb..00c4e86 100644
--- a/samples/alpc/advanced_alpc.py
+++ b/samples/alpc/advanced_alpc.py
@@ -1,3 +1,4 @@
+import sys
 import multiprocessing
 
 import windows.alpc
@@ -67,9 +68,10 @@ def full_alpc_server():
             #    - Send the same message with modified data
             #    - Recreate a Message and copy the MessageId
             msg.data = "REQUEST '{0}' DONE".format(msg.data)
+            sys.stdout.flush()
             server.send(msg)
         else:
-            raise ValueError("Unexpected message type")
+            print ValueError("Unexpected message type <{0}>".format(msg.type & 0xfff))
 
 
 def send_message_with_handle(client):
@@ -135,6 +137,7 @@ def alpc_client():
 
     send_message_with_handle(client)
     send_message_with_view(client)
+    sys.stdout.flush()
 
 
 if __name__ == "__main__":
@@ -142,5 +145,6 @@ if __name__ == "__main__":
     proc.start()
     import time; time.sleep(0.5)
     alpc_client()
+    import time; time.sleep(0.5)
     print("BYE")
     proc.terminate()
\ No newline at end of file
diff --git a/samples/crypto/encryption_demo.py b/samples/crypto/encryption_demo.py
index e1735c6..14c7eff 100644
--- a/samples/crypto/encryption_demo.py
+++ b/samples/crypto/encryption_demo.py
@@ -12,7 +12,7 @@ import windows.crypto.generation as gencrypt
 def crypt(src, dst, certs, **kwargs):
     """Encrypt the content of 'src' file with the certifacts in 'certs' into 'dst'"""
     # Open every certificates in the certs list
-    certlist = [crypto.CertificateContext.from_file(x) for x in certs]
+    certlist = [crypto.Certificate.from_file(x) for x in certs]
     # Encrypt the content of 'src' with all the public keys(certs)
     res = crypto.encrypt(certlist, src.read())
     print("Encryption done. Result:")
diff --git a/samples/debug/debugger_print_LdrLoaddll.py b/samples/debug/debugger_print_LdrLoaddll.py
index 70bb28a..cfcfd37 100644
--- a/samples/debug/debugger_print_LdrLoaddll.py
+++ b/samples/debug/debugger_print_LdrLoaddll.py
@@ -31,11 +31,11 @@ class PrintUnicodeString(windows.debug.Breakpoint):
 
         unicode_string_addr = p.read_ptr(esp + (self.arg_pos + 1) * 4)
         wstring_addr = p.read_ptr(unicode_string_addr + 4)
-        dll_loaded = p.read_wstring(wstring_addr)
+        dll_loaded = p.read_wstring(wstring_addr).lower()
         print("Loading <{0}>".format(dll_loaded))
 
-        if dll_loaded.endswith("ole32.dll"):
-            print("Ask to load <ole32.dll>: exiting process")
+        if dll_loaded.endswith("comctl32.dll"):
+            print("Ask to load <comctl32.dll>: exiting process")
             dbg.current_process.exit()
 
 
diff --git a/samples/process/remote_process.py b/samples/process/remote_process.py
index 8230d76..b1f6749 100644
--- a/samples/process/remote_process.py
+++ b/samples/process/remote_process.py
@@ -78,7 +78,7 @@ try:
     print("Trying to import in remote module 'FAKE_MODULE'")
     notepad.execute_python("def func():\n   import FAKE_MODULE\nfunc()")
 except windows.injection.RemotePythonError as e:
-    print("Remote ERROR !")
+    print("Exception in remote process!")
     print(e)
 
 print("That's all ! killing the notepad")
diff --git a/windows/injection.py b/windows/injection.py
index e8fe287..105f3f4 100644
--- a/windows/injection.py
+++ b/windows/injection.py
@@ -318,7 +318,7 @@ buff[:] = txt
 
 def retrieve_last_exception_data(process):
     with process.allocated_memory(0x1000) as mem:
-        execute_python_code(process, retrieve_exc.format(mem))
+        execute_python_code(process, retrieve_exc.format(mem)).wait()
         size = struct.unpack("<I", process.read_memory(mem, ctypes.sizeof(ctypes.c_uint)))[0]
         data = process.read_memory(mem + ctypes.sizeof(ctypes.c_uint), size)
     return data