Add sample for thread + fix code to get a WinProcess from a pid not using WinProcess(pid=xxx) + test

samples/process/thread.py

@@ -0,0 +1,56 @@
+import sys
+import os.path
+sys.path.append(os.path.abspath(__file__ + "\..\.."))
+
+import windows
+import windows.native_exec.simple_x86 as x86
+import windows.native_exec.simple_x64 as x64
+
+print("Creating a notepad") ## Replaced calc.exe by notepad.exe cause of windows 10.
+notepad = windows.utils.create_process(r"C:\windows\system32\notepad.exe")
+# You don't need to do that in our case, but it's useful to now
+
+print("Priting threads")
+for th in notepad.threads:
+    print("    * {0}".format(th))
+
+print("Writing some code in memory")
+
+
+if notepad.bitness == 32:
+    code = "mov eax, 0x42424242; label :start ; jmp :start; nop; nop; ret"
+    rawcode = x86.assemble(code)
+else:
+    code = "mov rax, 0x4242424242424242; label :start ; jmp :start; nop; nop; ret"
+    rawcode = x64.assemble(code)
+
+print("Allocating memory")
+with notepad.allocated_memory(0x1000) as addr:
+    print("Writing code at <{0:#x}>".format(addr))
+    notepad.write_memory(addr, rawcode)
+
+    print("Creating thread on injected code")
+    t = notepad.create_thread(addr, 0x11223344)
+    print("New thread is {0}".format(t))
+
+    print("Suspending thread")
+    t.suspend()
+
+    ctx = t.context
+    print("Thread context is {0}".format(ctx))
+    print("Dumping thread context:")
+    ctx.dump()
+    print("Changing context")
+    ctx.pc += 2  # EIP / RIP
+    ctx.func_result = 0x12345678 # EAX / RAX
+    print("Setting new thread context")
+    t.set_context(ctx)
+    print("Resuming thread")
+    t.resume()
+    print("Waiting thread")
+    t.wait()
+    print("Thread has exit: {0}".format(t.is_exit))
+    print("Thread exit value = {0:#x}".format(t.exit_code))
+
+
+

tests/test_system.py

@@ -17,12 +17,27 @@ class TestSystemWithCheckGarbage(object):
     def test_services(self):
         return windows.system.services
 
+    def test_services_process(self):
+        services_with_process = [s for s in windows.system.services if s.ServiceStatusProcess.dwProcessId]
+        service = services_with_process[0]
+        proc = service.process
+        assert proc.pid == service.ServiceStatusProcess.dwProcessId
+
     def test_logicaldrives(self):
         return windows.system.logicaldrives
 
     def test_wmi(self):
         return windows.system.wmi.select("Win32_Process", "*")
 
+    def test_handles(self):
+        return windows.system.handles
+
+    def test_handle_process(self):
+        handle_with_process = [h for h in windows.system.handles if h.dwProcessId]
+        handle = handle_with_process[-1]
+        proc = handle.process
+        assert proc.pid == handle.dwProcessId
+
 
 @check_for_gc_garbage
 class TestSystemWithCheckGarbageAndHandleLeak(object):

windows/__init__.py

@@ -37,15 +37,3 @@ import windows.syswow64
 import windows.com
 
 __all__ = ["system", 'current_process', 'current_thread']
-
-import os
-if bool(os.environ.get("SPHINX_BUILD", 0)):
-    # I know it's shameful
-    # But it's the only way I can think of right now to get a full class
-    # of PEFile for documentation purpose u_u
-
-    ppe = windows.current_process.peb.modules[0].pe
-    windows.pe_parse.PEFile = type(ppe)
-    iat_entry = ppe.imports.values()[0][0]
-    windows.pe_parse.IATEntry = type(iat_entry)
-

windows/winobject/handle.py

@@ -19,8 +19,9 @@ class Handle(SYSTEM_HANDLE):
         """The process possessing the handle
 
         :type: :class:`WinProcess <windows.winobject.process.WinProcess>`"""
-        "TODO: something smart ? :D"
-        return [p for p in windows.system.processes if p.pid == self.dwProcessId][0]
+        # "TODO: something smart ? :D"
+        # return [p for p in windows.system.processes if p.pid == self.dwProcessId][0]
+        return windows.WinProcess(pid=self.dwProcessId)
 
     @windows.utils.fixedpropety
     def name(self):

windows/winobject/service.py

@@ -85,10 +85,8 @@ class Service(object):
         pid = self.ServiceStatusProcess.dwProcessId
         if not pid:
             return None
-        l = [p for p in windows.system.processes if p.pid == pid]
-        if not l:
-            return None # Other thing ?
-        return l[0]
+        l = windows.WinProcess(pid=pid)
+        return l
 
 
 class ServiceA(Service, ENUM_SERVICE_STATUS_PROCESSA):