diff --git a/docs/source/handle.rst b/docs/source/handle.rst index 1497638..ed7689b 100644 --- a/docs/source/handle.rst +++ b/docs/source/handle.rst @@ -1,6 +1,9 @@ Handle -- Processes handles ============================ +The list of handles is accessible via :py:attr:`windows.system.handles +` + .. note:: See sample :ref:`sample_system` diff --git a/docs/source/network.rst b/docs/source/network.rst index 2e64fd3..b5e35ba 100644 --- a/docs/source/network.rst +++ b/docs/source/network.rst @@ -3,6 +3,9 @@ Network .. module:: windows.winobject.network +The :class:`Network` instance is accessible via :py:attr:`windows.system.network +` + .. note:: See sample :ref:`sample_network_exploration` diff --git a/docs/source/registry.rst b/docs/source/registry.rst index cf1f0ba..17ad364 100644 --- a/docs/source/registry.rst +++ b/docs/source/registry.rst @@ -3,6 +3,9 @@ Registry .. module:: windows.winobject.registry +The :class:`Registry` instance is accessible via :py:attr:`windows.system.registry +` + .. note:: See sample :ref:`sample_registry` @@ -11,7 +14,7 @@ Registry """""""" .. autoclass:: Registry - :special-members: __getitem__ + :special-members: __call__ PyHKey @@ -31,6 +34,10 @@ PyHKey Wrapper for :func:`set`, accept ``value`` or ``(value, type)`` + .. function:: __delitem__(name) + + Alias for :func:`delete_value` + KeyValue """""""" diff --git a/docs/source/samples_output/system.txt b/docs/source/samples_output/system.txt index 0e04f00..c99ff59 100644 --- a/docs/source/samples_output/system.txt +++ b/docs/source/samples_output/system.txt @@ -6,8 +6,8 @@ Basic system infos: product_type = VER_NT_WORKSTATION(0x1L) version_name = Windows 10 -There is 222 processes -There is 2716 threads +There is 194 processes +There is 2324 threads Dumping first logical drive: @@ -23,17 +23,25 @@ Dumping first service: process = None Finding a service in a user process: - - name = Appinfo - description = Application Information - status = ServiceStatus(type=48L, state=SERVICE_RUNNING(0x4L), control_accepted=129L, flags=0L) - process = + + name = AppIDSvc + description = Application Identity + status = ServiceStatus(type=48L, state=SERVICE_RUNNING(0x4L), control_accepted=5L, flags=0L) + process = Enumerating handles: - There are 106325 handles: + There are 78079 handles: First handle is: in process pid=4> Enumerating handles of the current process: - There are 261 handles for this process + There are 260 handles for this process Looking for a File handle: - Handle is in process pid=16752> + Handle is in process pid=10968> Name is <\Device\ConDrv> + +Dumping the first system module + + ImageName = \SystemRoot\system32\ntoskrnl.exe + Base = 0xfffff803f9697000 + Size = 0x8d5000 + Flags = 0x8804000 + LoadCount = 139 diff --git a/docs/source/service.rst b/docs/source/service.rst index 6c1d041..c103393 100644 --- a/docs/source/service.rst +++ b/docs/source/service.rst @@ -1,6 +1,10 @@ Service ======= +The list of services is accessible via :py:attr:`windows.system.services +` + + .. note:: See sample :ref:`sample_system` diff --git a/docs/source/system_module.rst b/docs/source/system_module.rst new file mode 100644 index 0000000..dd76166 --- /dev/null +++ b/docs/source/system_module.rst @@ -0,0 +1,43 @@ +System Module -- Loaded kernel modules +====================================== + +.. module:: windows.winobject.system_module + + +The list of system modules is accessible via :py:attr:`windows.system.modules ` + + +.. note:: + + See sample :ref:`sample_system` + + + + +SystemModule +"""""""""""" + +.. autoclass:: SystemModule + :inherited-members: + :members: + :undoc-members: + :show-inheritance: + + +SystemModuleWow64 +""""""""""""""""" + +.. autoclass:: SystemModuleWow64 + :inherited-members: + :members: + :undoc-members: + :show-inheritance: + + +BaseSystemModule +"""""""""""""""" + +.. autoclass:: BaseSystemModule + + + diff --git a/docs/source/task_scheduler.rst b/docs/source/task_scheduler.rst index ac82db2..6443aea 100644 --- a/docs/source/task_scheduler.rst +++ b/docs/source/task_scheduler.rst @@ -3,6 +3,9 @@ Task scheduler .. module:: windows.winobject.task_scheduler +The :class:`TaskService` is accessible via :py:attr:`windows.system.task_scheduler +` + .. note:: See sample :ref:`sample_scheduled_task` diff --git a/docs/source/volume.rst b/docs/source/volume.rst index 60d440d..6757dc4 100644 --- a/docs/source/volume.rst +++ b/docs/source/volume.rst @@ -1,6 +1,10 @@ Volume -- The logical drives ============================ +The list of logical drives is accessible via :py:attr:`windows.system.logicaldrives +` + + .. note:: See sample :ref:`sample_system` diff --git a/docs/source/winobject.rst b/docs/source/winobject.rst index b6644ee..6a563ea 100644 --- a/docs/source/winobject.rst +++ b/docs/source/winobject.rst @@ -17,5 +17,6 @@ This sections describes them by group of relation. volume.rst wmi.rst handle.rst + system_module.rst task_scheduler.rst evtlog.rst \ No newline at end of file diff --git a/docs/source/wmi.rst b/docs/source/wmi.rst index 08e7d55..a6f69f2 100644 --- a/docs/source/wmi.rst +++ b/docs/source/wmi.rst @@ -3,6 +3,10 @@ WMI -- Make request to WMI .. module:: windows.winobject.wmi + +The :class:`WmiManager` is accessible via :py:attr:`windows.system.wmi +` + .. note:: See sample :ref:`wmi_request` diff --git a/samples/system.py b/samples/system.py index 06d65a1..543c554 100644 --- a/samples/system.py +++ b/samples/system.py @@ -53,4 +53,15 @@ print(" There are {0} handles for this process".format(len(cp_handles))) print(" Looking for a File handle:") file_h = [h for h in cp_handles if h.type == "File"][0] print(" Handle is {0}".format(file_h)) -print(" Name is <{0}>".format(file_h.name)) \ No newline at end of file +print(" Name is <{0}>".format(file_h.name)) +print("") + + +print("Dumping the first system module") +kmod = windows.system.modules[0] +print(" " + str(kmod)) +print((" " * 8) + "ImageName = {0}".format(kmod.ImageName)) +print((" " * 8) + "Base = {0:#x}".format(kmod.Base)) +print((" " * 8) + "Size = {0:#x}".format(kmod.Size)) +print((" " * 8) + "Flags = {0:#x}".format(kmod.Flags)) +print((" " * 8) + "LoadCount = {0}".format(kmod.LoadCount)) diff --git a/windows/winobject/registry.py b/windows/winobject/registry.py index c1bd762..e6cbb57 100644 --- a/windows/winobject/registry.py +++ b/windows/winobject/registry.py @@ -140,11 +140,15 @@ class PyHKey(object): sam = self.sam return PyHKey(self, name, sam) - def reopen(self, new_sam): - return PyHKey(self.surkey, self.name, new_sam) + def reopen(self, sam): + """Reopen the registry key with a new ``sam`` + + :rtype: :class:`PyHKey` + """ + return PyHKey(self.surkey, self.name, sam) def create(self): - # TODO: document + """Create the registry key""" try: self._phkey = _winreg.CreateKeyEx(self.surkey.phkey, self.name, 0, self.sam) except WindowsError as e: @@ -152,6 +156,7 @@ class PyHKey(object): return self def delete(self): + """Delete the registry key""" try: _winreg.DeleteKeyEx(self.surkey.phkey, self.name, self.sam, 0) except WindowsError as e: @@ -188,7 +193,7 @@ HKEY_USERS = PyHKey(DummyPHKEY(_winreg.HKEY_USERS, "HKEY_USERS"), "", _winreg.KE class Registry(object): - """The ``Windows`` registry: a read only (for now) mapping""" + """The ``Windows`` registry""" registry_base_keys = { "HKEY_LOCAL_MACHINE" : HKEY_LOCAL_MACHINE, @@ -204,6 +209,10 @@ class Registry(object): @classmethod def reopen(cls, sam): + """Return a new :class:`Registry` using ``sam`` as the new default + + :rtype: :class:`Registry` + """ return cls(sam) def __call__(self, name, sam=None): diff --git a/windows/winobject/system.py b/windows/winobject/system.py index cb53bae..78d7929 100644 --- a/windows/winobject/system.py +++ b/windows/winobject/system.py @@ -73,7 +73,10 @@ class System(object): @property def modules(self): - # TODO: doc + """The list of system modules + + :type: [:class:`~windows.winobject.system_module.SystemModule`] -- A list of :class:`~windows.winobject.system_module.SystemModule` or :class:`~windows.winobject.system_module.SystemModuleWow64` + """ return system_module.enumerate_kernel_modules() @utils.fixedpropety diff --git a/windows/winobject/system_module.py b/windows/winobject/system_module.py index d61ca75..57725c1 100644 --- a/windows/winobject/system_module.py +++ b/windows/winobject/system_module.py @@ -5,16 +5,23 @@ import windows.winproxy as winproxy import windows.generated_def as gdef class BaseSystemModule(object): + """[ABSTRACT] A common base class for all system modules""" def __repr__(self): return """<{0} name="{1}" base={2:#x}>""".format(type(self).__name__, self.ImageName, self.Base) class SystemModule(BaseSystemModule, gdef.SYSTEM_MODULE): + """A system module. + + .. note:: + inherit from SYSTEM_MODULE[32/64] based on the current process bitness + """ pass # Only useful / meaningful in Wow64 Process class SystemModuleWow64(BaseSystemModule, gdef.SYSTEM_MODULE64): + """An explicite 64b system module for SysWow64 processes""" pass