Update some doc + document windows.system.modules

docs/source/handle.rst

@@ -1,6 +1,9 @@
 Handle -- Processes handles
 ============================
 
+The list of handles is accessible via :py:attr:`windows.system.handles
+<windows.winobject.system.System.handles>`
+
 .. note::
 
     See sample :ref:`sample_system`

docs/source/network.rst

@@ -3,6 +3,9 @@ Network
 
 .. module:: windows.winobject.network
 
+The :class:`Network` instance is accessible via :py:attr:`windows.system.network
+<windows.winobject.system.System.network>`
+
 .. note::
 
     See sample :ref:`sample_network_exploration`

docs/source/registry.rst

@@ -3,6 +3,9 @@ Registry
 
 .. module:: windows.winobject.registry
 
+The :class:`Registry` instance is accessible via :py:attr:`windows.system.registry
+<windows.winobject.system.System.registry>`
+
 .. note::
 
     See sample :ref:`sample_registry`
@@ -11,7 +14,7 @@ Registry
 """"""""
 
 .. autoclass:: Registry
-    :special-members: __getitem__
+    :special-members: __call__
 
 
 PyHKey
@@ -31,6 +34,10 @@ PyHKey
 
         Wrapper for :func:`set`, accept ``value`` or ``(value, type)``
 
+    .. function:: __delitem__(name)
+
+        Alias for :func:`delete_value`
+
 KeyValue
 """"""""
 

docs/source/samples_output/system.txt

@@ -6,8 +6,8 @@ Basic system infos:
     product_type = VER_NT_WORKSTATION(0x1L)
     version_name = Windows 10
 
-There is 222 processes
-There is 2716 threads
+There is 194 processes
+There is 2324 threads
 
 Dumping first logical drive:
     <LogicalDrive "C:\" (DRIVE_FIXED)>
@@ -23,17 +23,25 @@ Dumping first service:
         process = None
 
 Finding a service in a user process:
-    <ServiceA "Appinfo" SERVICE_RUNNING(0x4L)>
-        name = Appinfo
-        description = Application Information
-        status = ServiceStatus(type=48L, state=SERVICE_RUNNING(0x4L), control_accepted=129L, flags=0L)
-        process = <WinProcess "svchost.exe" pid 13288 at 0x63ffc10>
+    <ServiceA "AppIDSvc" SERVICE_RUNNING(0x4L)>
+        name = AppIDSvc
+        description = Application Identity
+        status = ServiceStatus(type=48L, state=SERVICE_RUNNING(0x4L), control_accepted=5L, flags=0L)
+        process = <WinProcess "!cannot-retrieve-name" pid 7076 at 0x631eb70>
 
 Enumerating handles:
-    There are 106325 handles:
+    There are 78079 handles:
     First handle is: <Handle value=<0x4> in process pid=4>
     Enumerating handles of the current process:
-        There are 261 handles for this process
+        There are 260 handles for this process
     Looking for a File handle:
-        Handle is <Handle value=<0x4> in process pid=16752>
+        Handle is <Handle value=<0x4> in process pid=10968>
         Name is <\Device\ConDrv>
+
+Dumping the first system module
+    <SystemModuleWow64 name="\SystemRoot\system32\ntoskrnl.exe" base=0xfffff803f9697000>
+        ImageName = \SystemRoot\system32\ntoskrnl.exe
+        Base = 0xfffff803f9697000
+        Size = 0x8d5000
+        Flags = 0x8804000
+        LoadCount = 139

docs/source/service.rst

@@ -1,6 +1,10 @@
 Service
 =======
 
+The list of services is accessible via :py:attr:`windows.system.services
+<windows.winobject.system.System.services>`
+
+
 .. note::
 
     See sample :ref:`sample_system`

docs/source/system_module.rst

@@ -0,0 +1,43 @@
+System Module -- Loaded kernel modules
+======================================
+
+.. module:: windows.winobject.system_module
+
+
+The list of system modules is accessible via :py:attr:`windows.system.modules <windows.winobject.system.System.modules>`
+
+
+.. note::
+
+    See sample :ref:`sample_system`
+
+
+
+
+SystemModule
+""""""""""""
+
+.. autoclass:: SystemModule
+   :inherited-members:
+   :members:
+   :undoc-members:
+   :show-inheritance:
+
+
+SystemModuleWow64
+"""""""""""""""""
+
+.. autoclass:: SystemModuleWow64
+    :inherited-members:
+    :members:
+    :undoc-members:
+    :show-inheritance:
+
+
+BaseSystemModule
+""""""""""""""""
+
+.. autoclass:: BaseSystemModule
+
+
+

docs/source/task_scheduler.rst

@@ -3,6 +3,9 @@ Task scheduler
 
 .. module:: windows.winobject.task_scheduler
 
+The :class:`TaskService` is accessible via :py:attr:`windows.system.task_scheduler
+<windows.winobject.system.System.task_scheduler>`
+
 .. note::
 
     See sample :ref:`sample_scheduled_task`

docs/source/volume.rst

@@ -1,6 +1,10 @@
 Volume -- The logical drives
 ============================
 
+The list of logical drives is accessible via :py:attr:`windows.system.logicaldrives
+<windows.winobject.system.System.logicaldrives>`
+
+
 .. note::
 
     See sample :ref:`sample_system`

docs/source/winobject.rst

@@ -17,5 +17,6 @@ This sections describes them by group of relation.
     volume.rst
     wmi.rst
     handle.rst
+    system_module.rst
     task_scheduler.rst
     evtlog.rst

docs/source/wmi.rst

@@ -3,6 +3,10 @@ WMI -- Make request to WMI
 
 .. module:: windows.winobject.wmi
 
+
+The :class:`WmiManager` is accessible via :py:attr:`windows.system.wmi
+<windows.winobject.system.System.wmi>`
+
 .. note::
 
     See sample :ref:`wmi_request`

samples/system.py

@@ -53,4 +53,15 @@ print("        There are {0} handles for this process".format(len(cp_handles)))
 print("    Looking for a File handle:")
 file_h = [h for h in cp_handles if h.type == "File"][0]
 print("        Handle is {0}".format(file_h))
-print("        Name is <{0}>".format(file_h.name))
+print("        Name is <{0}>".format(file_h.name))
+print("")
+
+
+print("Dumping the first system module")
+kmod = windows.system.modules[0]
+print("    " + str(kmod))
+print((" " * 8) + "ImageName = {0}".format(kmod.ImageName))
+print((" " * 8) + "Base = {0:#x}".format(kmod.Base))
+print((" " * 8) + "Size = {0:#x}".format(kmod.Size))
+print((" " * 8) + "Flags = {0:#x}".format(kmod.Flags))
+print((" " * 8) + "LoadCount = {0}".format(kmod.LoadCount))

windows/winobject/registry.py

@@ -140,11 +140,15 @@ class PyHKey(object):
             sam = self.sam
         return PyHKey(self, name, sam)
 
-    def reopen(self, new_sam):
-        return PyHKey(self.surkey, self.name, new_sam)
+    def reopen(self, sam):
+        """Reopen the registry key with a new ``sam``
+
+        :rtype: :class:`PyHKey`
+        """
+        return PyHKey(self.surkey, self.name, sam)
 
     def create(self):
-        # TODO: document
+        """Create the registry key"""
         try:
             self._phkey = _winreg.CreateKeyEx(self.surkey.phkey, self.name, 0, self.sam)
         except WindowsError as e:
@@ -152,6 +156,7 @@ class PyHKey(object):
         return self
 
     def delete(self):
+        """Delete the registry key"""
         try:
             _winreg.DeleteKeyEx(self.surkey.phkey, self.name, self.sam, 0)
         except WindowsError as e:
@@ -188,7 +193,7 @@ HKEY_USERS = PyHKey(DummyPHKEY(_winreg.HKEY_USERS, "HKEY_USERS"), "", _winreg.KE
 
 
 class Registry(object):
-    """The ``Windows`` registry: a read only (for now) mapping"""
+    """The ``Windows`` registry"""
 
     registry_base_keys = {
         "HKEY_LOCAL_MACHINE" : HKEY_LOCAL_MACHINE,
@@ -204,6 +209,10 @@ class Registry(object):
 
     @classmethod
     def reopen(cls, sam):
+        """Return a new :class:`Registry` using ``sam`` as the new default
+
+        :rtype: :class:`Registry`
+        """
         return cls(sam)
 
     def __call__(self, name, sam=None):

windows/winobject/system.py

@@ -73,7 +73,10 @@ class System(object):
 
     @property
     def modules(self):
-        # TODO: doc
+        """The list of system modules
+
+        :type: [:class:`~windows.winobject.system_module.SystemModule`] -- A list of :class:`~windows.winobject.system_module.SystemModule` or :class:`~windows.winobject.system_module.SystemModuleWow64`
+        """
         return system_module.enumerate_kernel_modules()
 
     @utils.fixedpropety

windows/winobject/system_module.py

@@ -5,16 +5,23 @@ import windows.winproxy as winproxy
 import windows.generated_def as gdef
 
 class BaseSystemModule(object):
+    """[ABSTRACT] A common base class for all system modules"""
     def __repr__(self):
         return """<{0} name="{1}" base={2:#x}>""".format(type(self).__name__, self.ImageName, self.Base)
 
 
 class SystemModule(BaseSystemModule, gdef.SYSTEM_MODULE):
+    """A system module.
+
+    .. note::
+        inherit from SYSTEM_MODULE[32/64] based on the current process bitness
+    """
     pass
 
 
 # Only useful / meaningful in Wow64 Process
 class SystemModuleWow64(BaseSystemModule, gdef.SYSTEM_MODULE64):
+    """An explicite 64b system module for SysWow64 processes"""
     pass