diff --git a/docs/build/html/_modules/windows/com.html b/docs/build/html/_modules/windows/com.html index 7770507..e765a09 100644 --- a/docs/build/html/_modules/windows/com.html +++ b/docs/build/html/_modules/windows/com.html @@ -4,12 +4,12 @@ - windows.com — PythonForWindows 1.0.2 documentation + windows.com — PythonForWindows 1.0.3 documentation - + @@ -25,7 +25,7 @@
  • modules |
    • -
  • PythonForWindows 1.0.2 documentation »
    • +
  • PythonForWindows 1.0.3 documentation »
  • Module code »
  • windows.com
    • @@ -75,7 +75,13 @@ def initsecurity(): # Should take some parameters.. - return winproxy.CoInitializeSecurity(0, -1, None, 0, 0, RPC_C_IMP_LEVEL_IMPERSONATE, 0,0,0) + try: + winproxy.CoInitializeSecurity(0, -1, None, 0, 0, RPC_C_IMP_LEVEL_IMPERSONATE, 0,0,0) + except OSError as e: + if e.winerror & 0xFFFFFFFF != gdef.RPC_E_TOO_LATE: + # RPC_E_TOO_LATE can happen when the python environment invokes CoInitializeSecurity before we get to it + # mspython builds do this consistently. + raise e class Dispatch(interfaces.IDispatch): @@ -489,7 +495,7 @@
  • modules |
    • -
  • PythonForWindows 1.0.2 documentation »
    • +
  • PythonForWindows 1.0.3 documentation »
  • Module code »
  • windows.com
    • diff --git a/docs/build/html/_modules/windows/crypto/certificate.html b/docs/build/html/_modules/windows/crypto/certificate.html index 721ef34..248e966 100644 --- a/docs/build/html/_modules/windows/crypto/certificate.html +++ b/docs/build/html/_modules/windows/crypto/certificate.html @@ -4,12 +4,12 @@ - windows.crypto.certificate — PythonForWindows 1.0.2 documentation + windows.crypto.certificate — PythonForWindows 1.0.3 documentation - + @@ -25,7 +25,7 @@
  • modules |
    • -
  • PythonForWindows 1.0.2 documentation »
    • +
  • PythonForWindows 1.0.3 documentation »
  • Module code »
  • windows.crypto.certificate
    • @@ -205,6 +205,17 @@ return ctypes.cast(res, cls) +
    +[docs] + @classmethod + def from_user_store(cls, store_name, user=True): + """Create a new :class:`CertificateStore` from system store ``store_name`` + (see `System Store Locations <https://msdn.microsoft.com/en-us/library/windows/desktop/aa388136(v=vs.85).aspx>`_) + """ + res = winproxy.CertOpenStore(gdef.CERT_STORE_PROV_SYSTEM_A, DEFAULT_ENCODING, None, gdef.CERT_SYSTEM_STORE_CURRENT_USER | gdef.CERT_STORE_READONLY_FLAG, store_name) + return ctypes.cast(res, cls)
    + +
    [docs] @classmethod @@ -697,7 +708,7 @@
  • modules |
    • -
  • PythonForWindows 1.0.2 documentation »
    • +
  • PythonForWindows 1.0.3 documentation »
  • Module code »
  • windows.crypto.certificate
    • diff --git a/docs/build/html/_modules/windows/debug/breakpoints.html b/docs/build/html/_modules/windows/debug/breakpoints.html index c77d069..d4945f8 100644 --- a/docs/build/html/_modules/windows/debug/breakpoints.html +++ b/docs/build/html/_modules/windows/debug/breakpoints.html @@ -4,12 +4,12 @@ - windows.debug.breakpoints — PythonForWindows 1.0.2 documentation + windows.debug.breakpoints — PythonForWindows 1.0.3 documentation - + @@ -25,7 +25,7 @@
  • modules |
    • -
  • PythonForWindows 1.0.2 documentation »
    • +
  • PythonForWindows 1.0.3 documentation »
  • Module code »
  • windows.debug.breakpoints
    • @@ -190,17 +190,11 @@ t = rt(value, cproc) else: t = rt(value) - - content = None - try: - content = t.contents - except Exception as e: - # contents will fail on basic type - # Not really an expected behavior - # But it works for now.. (and since a while) - pass - if content is None: - t = t.value + if not hasattr(t, "contents"): + try: + t = t.value + except AttributeError: + pass res[name[1]] = t return res @@ -365,7 +359,7 @@
  • modules |
    • -
  • PythonForWindows 1.0.2 documentation »
    • +
  • PythonForWindows 1.0.3 documentation »
  • Module code »
  • windows.debug.breakpoints
    • diff --git a/docs/build/html/_modules/windows/debug/symbols.html b/docs/build/html/_modules/windows/debug/symbols.html index b5bdd5f..34a0d0a 100644 --- a/docs/build/html/_modules/windows/debug/symbols.html +++ b/docs/build/html/_modules/windows/debug/symbols.html @@ -4,12 +4,12 @@ - windows.debug.symbols — PythonForWindows 1.0.2 documentation + windows.debug.symbols — PythonForWindows 1.0.3 documentation - + @@ -25,7 +25,7 @@
  • modules |
    • -
  • PythonForWindows 1.0.2 documentation »
    • +
  • PythonForWindows 1.0.3 documentation »
  • Module code »
  • windows.debug.symbols
    • @@ -54,7 +54,7 @@
    [docs] def set_dbghelp_path(path): - """Set the path of the ``dbghelp.dll`` file to use. It allow to configure a different version of the DLL handling PDB downloading. + r"""Set the path of the ``dbghelp.dll`` file to use. It allow to configure a different version of the DLL handling PDB downloading. If ``path`` is a directory, the final ``dbghelp.dll`` will be computed as ``path\<current_process_bitness>\dbghelp.dll``. @@ -169,7 +169,7 @@ class SymbolInfoW(gdef.SYMBOL_INFOW, SymbolInfoBase): - """Represent a Symbol. + r"""Represent a Symbol. This class in based on the class `SYMBOL_INFO <https://docs.microsoft.com/en-us/windows/win32/api/dbghelp/ns-dbghelp-symbol_info>`_ with the handling on displacement embeded into it.s @@ -222,6 +222,10 @@ windows.winproxy.LocalFree(res) return newres + @property + def module(self): + return self.resolver.get_module(self.modbase) + @property def name(self): return self._get_type_info(gdef.TI_GET_SYMNAME) @@ -373,7 +377,7 @@ @property def pdb(self): - """The local path of the loaded PDB if present + r"""The local path of the loaded PDB if present Exemple: >>> sh = windows.debug.symbols.VirtualSymbolHandler() @@ -503,7 +507,7 @@ return sym def resolve(self, name_or_addr): - """Resolve ``name_or_addr``. + r"""Resolve ``name_or_addr``. If its an int -> Return the :class:`SymbolInfo` at the address. If its a string -> Return the :class:`SymbolInfo` corresponding to the symbol name @@ -552,7 +556,7 @@ return True def search(self, mask, mod=0, tag=0, options=gdef.SYMSEARCH_ALLITEMS, callback=None): - """Search the symbols matching ``mask`` (``Windbg`` like). + r"""Search the symbols matching ``mask`` (``Windbg`` like). :return: [:class:`SymbolInfo`] -- A list of :class:`SymbolInfo` @@ -605,12 +609,6 @@ windows.winproxy.SymGetTypeFromNameW(self.handle, mod, name, buff) return SymbolType.from_symbol_info(buff[0], resolver=self) - # - def types(self, mod=None): - typeslist = [] # Iter on types of all modules if None provided ? - windows.winproxy.SymEnumTypes(self.handle, mod, self.simple_aggregator, typeslist) - return [SymbolType.from_symbol_info(t, resolver=self) for t in typeslist] - # TODO: mets de l'huile pour w4kfu class StackWalker(object): @@ -869,7 +867,7 @@
  • modules |
    • -
  • PythonForWindows 1.0.2 documentation »
    • +
  • PythonForWindows 1.0.3 documentation »
  • Module code »
  • windows.debug.symbols
    • diff --git a/docs/build/html/_modules/windows/generated_def/flag.html b/docs/build/html/_modules/windows/generated_def/flag.html index 0de105e..823e616 100644 --- a/docs/build/html/_modules/windows/generated_def/flag.html +++ b/docs/build/html/_modules/windows/generated_def/flag.html @@ -4,12 +4,12 @@ - windows.generated_def.flag — PythonForWindows 1.0.2 documentation + windows.generated_def.flag — PythonForWindows 1.0.3 documentation - + @@ -25,7 +25,7 @@
  • modules |
    • -
  • PythonForWindows 1.0.2 documentation »
    • +
  • PythonForWindows 1.0.3 documentation »
  • Module code »
  • windows.generated_def.flag
    • @@ -145,7 +145,7 @@
  • modules |
    • -
  • PythonForWindows 1.0.2 documentation »
    • +
  • PythonForWindows 1.0.3 documentation »
  • Module code »
  • windows.generated_def.flag
    • diff --git a/docs/build/html/_modules/windows/generated_def/interfaces.html b/docs/build/html/_modules/windows/generated_def/interfaces.html index 7169816..0e4fc94 100644 --- a/docs/build/html/_modules/windows/generated_def/interfaces.html +++ b/docs/build/html/_modules/windows/generated_def/interfaces.html @@ -4,12 +4,12 @@ - windows.generated_def.interfaces — PythonForWindows 1.0.2 documentation + windows.generated_def.interfaces — PythonForWindows 1.0.3 documentation - + @@ -25,7 +25,7 @@
  • modules |
    • -
  • PythonForWindows 1.0.2 documentation »
    • +
  • PythonForWindows 1.0.3 documentation »
  • Module code »
  • windows.generated_def.interfaces
    • @@ -3998,7 +3998,7 @@
  • modules |
    • -
  • PythonForWindows 1.0.2 documentation »
    • +
  • PythonForWindows 1.0.3 documentation »
  • Module code »
  • windows.generated_def.interfaces
    • diff --git a/docs/build/html/_modules/windows/generated_def/winstructs.html b/docs/build/html/_modules/windows/generated_def/winstructs.html index 23547cf..73eefe9 100644 --- a/docs/build/html/_modules/windows/generated_def/winstructs.html +++ b/docs/build/html/_modules/windows/generated_def/winstructs.html @@ -180,10 +180,12 @@ PWINDBG_EXTENSION_APIS64 = PVOID FILEOP_FLAGS = WORD NET_API_STATUS = DWORD +SECURITY_STATUS = LONG PVOID32 = DWORD PVOID64 = DWORD64 NCRYPT_HANDLE = ULONG_PTR NCRYPT_PROV_HANDLE = ULONG_PTR +BCRYPT_KEY_HANDLE = ULONG_PTR NCRYPT_KEY_HANDLE = ULONG_PTR NCRYPT_HASH_HANDLE = ULONG_PTR NCRYPT_SECRET_HANDLE = ULONG_PTR @@ -1716,6 +1718,43 @@ +
    +[docs] +class __MIDL_ILocalObjectExporter_0006(Structure): + _fields_ = [ + ("dwTid", ULONG), + ("dwPid", ULONG), + ("dwAuthnHint", ULONG), + ("version", tagCOMVERSION), + ("ipidRemUnknown", _GUID), + ("dwFlags", ULONG), + ("psa", POINTER(tagDUALSTRINGARRAY)), + ("guidProcessIdentifier", _GUID), + ("processHostId", UINT64), + ("clientDependencyBehavior", INT), + ("packageFullName", POINTER(HSTRING__)), + ("userSid", POINTER(HSTRING__)), + ("appcontainerSid", POINTER(HSTRING__)), + ]
    + +MIDL_ILocalObjectExporter_0006 = __MIDL_ILocalObjectExporter_0006 + +
    +[docs] +class _PRIV_RESOLVER_INFO_17763(Structure): + _fields_ = [ + ("OxidServer", UINT64), + ("pServerORBindings", POINTER(tagDUALSTRINGARRAY)), + ("OxidInfo", MIDL_ILocalObjectExporter_0006), + ("LocalMidOfRemote", UINT64), + ("DllServerModel", ULONG), + ("pwszDllServer", POINTER(WCHAR)), + ("FoundInROT", INT), + ]
    + +PPRIV_RESOLVER_INFO_17763 = POINTER(_PRIV_RESOLVER_INFO_17763) +PRIV_RESOLVER_INFO_17763 = _PRIV_RESOLVER_INFO_17763 +
    [docs] class _MIDL_ILocalObjectExporter_0007(Structure): @@ -1890,6 +1929,8 @@ +
    +[docs] class WireExtentArray(Structure): _fields_ = [ ("size", ULONG), @@ -1897,17 +1938,23 @@ ("unique", ULONG), ("rounded_size", ULONG), ("unique_flag", ULONG * (UNIQUE_FLAG_PADDING)), - ] + ]
    + +
    +[docs] class WireExtent(Structure): _fields_ = [ ("rounded_size", ULONG), ("id", GUID), ("size", ULONG), - ] + ]
    + +
    +[docs] class tagMainHeader(Structure): _fields_ = [ ("Signature", ULONG), @@ -1918,57 +1965,78 @@ ("hr", LONG), ("hrServer", LONG), ("reserved", LONG), - ] + ]
    + MainHeader = tagMainHeader +
    +[docs] class LOCALTHIS32_NT_62(Structure): _fields_ = [ ("dwFlags", ULONG), ("dwClientThread", ULONG), - ] + ]
    + +
    +[docs] class __MIDL_XmitDefs_0001_NT_63(Structure): _fields_ = [ ("size", ULONG), ("reserved", ULONG), ("pAstaOxids", POINTER(UINT64)), - ] + ]
    + +
    +[docs] class LOCALTHIS32_NT_63(Structure): _fields_ = [ ("dwFlags", ULONG), ("dwClientThread", ULONG), ("reserved", ULONG), ("pTouchedAstaArray", PVOID32), - ] + ]
    + +
    +[docs] class LOCALTHAT32_NT_63(Structure): _fields_ = [ ("marshalingSetAcknowledgmentOxid", UINT64), ("marshalingSetId", UINT64), - ] + ]
    + +
    +[docs] class __MIDL_XmitDefs_0002_NT_1607(Structure): _fields_ = [ ("size", ULONG), ("reserved", ULONG), ("pAstaOxids", PVOID32), - ] + ]
    + +
    +[docs] class __MIDL_XmitDefs_0001_NT_1607(Structure): _fields_ = [ ("asyncOperationId", _GUID), ("oxidClientProcessNA", UINT64), ("originalClientLogicalThreadId", _GUID), ("uClientCausalityTraceId", UINT64), - ] + ]
    + MIDL_XmitDefs_0001_NT_1607 = __MIDL_XmitDefs_0001_NT_1607 +
    +[docs] class _LOCALTHIS32_NT_1607(Structure): _fields_ = [ ("dwFlags", ULONG), @@ -1976,9 +2044,12 @@ ("asyncRequestBlock", MIDL_XmitDefs_0001_NT_1607), ("reserved", ULONG), ("pTouchedAstaArray", PVOID32), - ] + ]
    + LOCALTHIS32_NT_1607 = _LOCALTHIS32_NT_1607 +
    +[docs] class __MIDL_XmitDefs_0007(Structure): _fields_ = [ ("pointOfFailure", INT), @@ -1986,25 +2057,34 @@ ("sizeOfMarshaledErrorInfo", ULONG), ("reserved", ULONG), ("pMarshaledErrorInfo", POINTER(BYTE)), - ] + ]
    + MIDL_XmitDefs_0007 = __MIDL_XmitDefs_0007 +
    +[docs] class __MIDL_XmitDefs_0005(Structure): _fields_ = [ ("sizeOfMarshaledResults", ULONG), ("reserved", ULONG), ("pMarshaledResults", POINTER(BYTE)), - ] + ]
    + MIDL_XmitDefs_0005 = __MIDL_XmitDefs_0005 +
    +[docs] class __MIDL_XmitDefs_0008(Structure): _fields_ = [ ("outcome", INT), ("successDetails", MIDL_XmitDefs_0005), ("failureDetails", MIDL_XmitDefs_0007), - ] + ]
    + MIDL_XmitDefs_0008 = __MIDL_XmitDefs_0008 +
    +[docs] class __MIDL_XmitDefs_0010(Structure): _fields_ = [ ("asyncStatus", ULONG), @@ -2012,24 +2092,31 @@ ("uServerCausalityTraceId", UINT64), ("reserved2", ULONG), ("pOutcomeDetails", POINTER(PVOID32)), - ] + ]
    + MIDL_XmitDefs_0010 = __MIDL_XmitDefs_0010 +
    +[docs] class LOCALTHAT32_NT_1607(Structure): _fields_ = [ ("marshalingSetAcknowledgmentOxid", UINT64), ("marshalingSetId", UINT64), ("reserved", ULONG), ("pAsyncResponseBlock", PVOID32), - ] + ]
    + +
    +[docs] class _LOCALTHAT32_10_1903(Structure): _fields_ = [ ("marshalingSetId", UINT64), ("pAsyncResponseBlock", PVOID32), ("containerPassthroughData", PVOID32), - ] + ]
    + LOCALTHAT32_10_1903 = _LOCALTHAT32_10_1903
    @@ -2230,7 +2317,8 @@ # Self referencing struct tricks
    [docs] -class _INTERNET_BUFFERSA(Structure): pass
    +class _INTERNET_BUFFERSA(Structure): + pass
    INTERNET_BUFFERSA = _INTERNET_BUFFERSA LPINTERNET_BUFFERSA = POINTER(_INTERNET_BUFFERSA) @@ -2250,7 +2338,8 @@ # Self referencing struct tricks
    [docs] -class _INTERNET_BUFFERSW(Structure): pass
    +class _INTERNET_BUFFERSW(Structure): + pass
    INTERNET_BUFFERSW = _INTERNET_BUFFERSW LPINTERNET_BUFFERSW = POINTER(_INTERNET_BUFFERSW) @@ -2892,7 +2981,8 @@ # Self referencing struct tricks
    [docs] -class _DNS_CACHE_ENTRY(Structure): pass
    +class _DNS_CACHE_ENTRY(Structure): + pass
    DNS_CACHE_ENTRY = _DNS_CACHE_ENTRY PDNS_CACHE_ENTRY = POINTER(_DNS_CACHE_ENTRY) @@ -3550,7 +3640,9 @@ # Self referencing struct tricks
    [docs] -class _DnsRecordA(Structure): pass
    +class _DnsRecordA(Structure): + _anonymous_ = ("Flags","Data")
    + DNS_RECORDA = _DnsRecordA PDNS_RECORDA = POINTER(_DnsRecordA) @@ -3663,7 +3755,9 @@ # Self referencing struct tricks
    [docs] -class _DnsRecordW(Structure): pass
    +class _DnsRecordW(Structure): + _anonymous_ = ("Flags","Data") + DNS_RECORDW = _DnsRecordW PDNS_RECORDW = POINTER(_DnsRecordW) @@ -3763,7 +3857,8 @@ # Self referencing struct tricks
    [docs] -class _IP_ADDR_STRING(Structure): pass
    +class _IP_ADDR_STRING(Structure): + pass IP_ADDR_STRING = _IP_ADDR_STRING PIP_ADDR_STRING = POINTER(_IP_ADDR_STRING) @@ -3777,7 +3872,8 @@ # Self referencing struct tricks
    [docs] -class _IP_ADAPTER_INFO(Structure): pass
    +class _IP_ADAPTER_INFO(Structure): + pass IP_ADAPTER_INFO = _IP_ADAPTER_INFO PIP_ADAPTER_INFO = POINTER(_IP_ADAPTER_INFO) @@ -4245,6 +4341,208 @@ IMAGE_LOAD_CONFIG_DIRECTORY64 = _IMAGE_LOAD_CONFIG_DIRECTORY64 PIMAGE_LOAD_CONFIG_DIRECTORY64 = POINTER(_IMAGE_LOAD_CONFIG_DIRECTORY64) +ProcThreadAttributeParentProcess = EnumValue("_PROC_THREAD_ATTRIBUTE_NUM", "ProcThreadAttributeParentProcess", 0x0) +ProcThreadAttributeHandleList = EnumValue("_PROC_THREAD_ATTRIBUTE_NUM", "ProcThreadAttributeHandleList", 0x2) +ProcThreadAttributeGroupAffinity = EnumValue("_PROC_THREAD_ATTRIBUTE_NUM", "ProcThreadAttributeGroupAffinity", 0x3) +ProcThreadAttributePreferredNode = EnumValue("_PROC_THREAD_ATTRIBUTE_NUM", "ProcThreadAttributePreferredNode", 0x4) +ProcThreadAttributeIdealProcessor = EnumValue("_PROC_THREAD_ATTRIBUTE_NUM", "ProcThreadAttributeIdealProcessor", 0x5) +ProcThreadAttributeUmsThread = EnumValue("_PROC_THREAD_ATTRIBUTE_NUM", "ProcThreadAttributeUmsThread", 0x6) +ProcThreadAttributeMitigationPolicy = EnumValue("_PROC_THREAD_ATTRIBUTE_NUM", "ProcThreadAttributeMitigationPolicy", 0x7) +ProcThreadAttributeSecurityCapabilities = EnumValue("_PROC_THREAD_ATTRIBUTE_NUM", "ProcThreadAttributeSecurityCapabilities", 0x9) +ProcThreadAttributeProtectionLevel = EnumValue("_PROC_THREAD_ATTRIBUTE_NUM", "ProcThreadAttributeProtectionLevel", 0xb) +ProcThreadAttributeJobList = EnumValue("_PROC_THREAD_ATTRIBUTE_NUM", "ProcThreadAttributeJobList", 0xd) +ProcThreadAttributeChildProcessPolicy = EnumValue("_PROC_THREAD_ATTRIBUTE_NUM", "ProcThreadAttributeChildProcessPolicy", 0xe) +ProcThreadAttributeAllApplicationPackagesPolicy = EnumValue("_PROC_THREAD_ATTRIBUTE_NUM", "ProcThreadAttributeAllApplicationPackagesPolicy", 0xf) +ProcThreadAttributeWin32kFilter = EnumValue("_PROC_THREAD_ATTRIBUTE_NUM", "ProcThreadAttributeWin32kFilter", 0x10) +ProcThreadAttributeSafeOpenPromptOriginClaim = EnumValue("_PROC_THREAD_ATTRIBUTE_NUM", "ProcThreadAttributeSafeOpenPromptOriginClaim", 0x11) +ProcThreadAttributeDesktopAppPolicy = EnumValue("_PROC_THREAD_ATTRIBUTE_NUM", "ProcThreadAttributeDesktopAppPolicy", 0x12) +ProcThreadAttributePseudoConsole = EnumValue("_PROC_THREAD_ATTRIBUTE_NUM", "ProcThreadAttributePseudoConsole", 0x16) +ProcThreadAttributeMitigationAuditPolicy = EnumValue("_PROC_THREAD_ATTRIBUTE_NUM", "ProcThreadAttributeMitigationAuditPolicy", 0x18) +ProcThreadAttributeMachineType = EnumValue("_PROC_THREAD_ATTRIBUTE_NUM", "ProcThreadAttributeMachineType", 0x19) +ProcThreadAttributeComponentFilter = EnumValue("_PROC_THREAD_ATTRIBUTE_NUM", "ProcThreadAttributeComponentFilter", 0x1a) +ProcThreadAttributeEnableOptionalXStateFeatures = EnumValue("_PROC_THREAD_ATTRIBUTE_NUM", "ProcThreadAttributeEnableOptionalXStateFeatures", 0x1b) +ProcThreadAttributeTrustedApp = EnumValue("_PROC_THREAD_ATTRIBUTE_NUM", "ProcThreadAttributeTrustedApp", 0x1d) +ProcThreadAttributeSveVectorLength = EnumValue("_PROC_THREAD_ATTRIBUTE_NUM", "ProcThreadAttributeSveVectorLength", 0x1e) +
    +[docs] +class _PROC_THREAD_ATTRIBUTE_NUM(EnumType): + values = [ProcThreadAttributeParentProcess, ProcThreadAttributeHandleList, ProcThreadAttributeGroupAffinity, ProcThreadAttributePreferredNode, ProcThreadAttributeIdealProcessor, ProcThreadAttributeUmsThread, ProcThreadAttributeMitigationPolicy, ProcThreadAttributeSecurityCapabilities, ProcThreadAttributeProtectionLevel, ProcThreadAttributeJobList, ProcThreadAttributeChildProcessPolicy, ProcThreadAttributeAllApplicationPackagesPolicy, ProcThreadAttributeWin32kFilter, ProcThreadAttributeSafeOpenPromptOriginClaim, ProcThreadAttributeDesktopAppPolicy, ProcThreadAttributePseudoConsole, ProcThreadAttributeMitigationAuditPolicy, ProcThreadAttributeMachineType, ProcThreadAttributeComponentFilter, ProcThreadAttributeEnableOptionalXStateFeatures, ProcThreadAttributeTrustedApp, ProcThreadAttributeSveVectorLength] + mapper = FlagMapper(*values)
    + +PROC_THREAD_ATTRIBUTE_NUM = _PROC_THREAD_ATTRIBUTE_NUM + + +MemoryBasicInformation = EnumValue("_MEMORY_INFORMATION_CLASS", "MemoryBasicInformation", 0x0) +MemoryWorkingSetList = EnumValue("_MEMORY_INFORMATION_CLASS", "MemoryWorkingSetList", 0x1) +MemorySectionName = EnumValue("_MEMORY_INFORMATION_CLASS", "MemorySectionName", 0x2) +MemoryBasicVlmInformation = EnumValue("_MEMORY_INFORMATION_CLASS", "MemoryBasicVlmInformation", 0x3) +MemoryWorkingSetListEx = EnumValue("_MEMORY_INFORMATION_CLASS", "MemoryWorkingSetListEx", 0x4) +
    +[docs] +class _MEMORY_INFORMATION_CLASS(EnumType): + values = [MemoryBasicInformation, MemoryWorkingSetList, MemorySectionName, MemoryBasicVlmInformation, MemoryWorkingSetListEx] + mapper = FlagMapper(*values)
    + +MEMORY_INFORMATION_CLASS = _MEMORY_INFORMATION_CLASS + + +ThreadBasicInformation = EnumValue("_THREAD_INFORMATION_CLASS", "ThreadBasicInformation", 0x0) +ThreadTimes = EnumValue("_THREAD_INFORMATION_CLASS", "ThreadTimes", 0x1) +ThreadPriority = EnumValue("_THREAD_INFORMATION_CLASS", "ThreadPriority", 0x2) +ThreadBasePriority = EnumValue("_THREAD_INFORMATION_CLASS", "ThreadBasePriority", 0x3) +ThreadAffinityMask = EnumValue("_THREAD_INFORMATION_CLASS", "ThreadAffinityMask", 0x4) +ThreadImpersonationToken = EnumValue("_THREAD_INFORMATION_CLASS", "ThreadImpersonationToken", 0x5) +ThreadDescriptorTableEntry = EnumValue("_THREAD_INFORMATION_CLASS", "ThreadDescriptorTableEntry", 0x6) +ThreadEnableAlignmentFaultFixup = EnumValue("_THREAD_INFORMATION_CLASS", "ThreadEnableAlignmentFaultFixup", 0x7) +ThreadEventPair = EnumValue("_THREAD_INFORMATION_CLASS", "ThreadEventPair", 0x8) +ThreadQuerySetWin32StartAddress = EnumValue("_THREAD_INFORMATION_CLASS", "ThreadQuerySetWin32StartAddress", 0x9) +ThreadZeroTlsCell = EnumValue("_THREAD_INFORMATION_CLASS", "ThreadZeroTlsCell", 0xa) +ThreadPerformanceCount = EnumValue("_THREAD_INFORMATION_CLASS", "ThreadPerformanceCount", 0xb) +ThreadAmILastThread = EnumValue("_THREAD_INFORMATION_CLASS", "ThreadAmILastThread", 0xc) +ThreadIdealProcessor = EnumValue("_THREAD_INFORMATION_CLASS", "ThreadIdealProcessor", 0xd) +ThreadPriorityBoost = EnumValue("_THREAD_INFORMATION_CLASS", "ThreadPriorityBoost", 0xe) +ThreadSetTlsArrayAddress = EnumValue("_THREAD_INFORMATION_CLASS", "ThreadSetTlsArrayAddress", 0xf) +ThreadIsIoPending = EnumValue("_THREAD_INFORMATION_CLASS", "ThreadIsIoPending", 0x10) +ThreadHideFromDebugger = EnumValue("_THREAD_INFORMATION_CLASS", "ThreadHideFromDebugger", 0x11) +
    +[docs] +class _THREAD_INFORMATION_CLASS(EnumType): + values = [ThreadBasicInformation, ThreadTimes, ThreadPriority, ThreadBasePriority, ThreadAffinityMask, ThreadImpersonationToken, ThreadDescriptorTableEntry, ThreadEnableAlignmentFaultFixup, ThreadEventPair, ThreadQuerySetWin32StartAddress, ThreadZeroTlsCell, ThreadPerformanceCount, ThreadAmILastThread, ThreadIdealProcessor, ThreadPriorityBoost, ThreadSetTlsArrayAddress, ThreadIsIoPending, ThreadHideFromDebugger] + mapper = FlagMapper(*values)
    + +PTHREAD_INFORMATION_CLASS = POINTER(_THREAD_INFORMATION_CLASS) +THREAD_INFORMATION_CLASS = _THREAD_INFORMATION_CLASS + + +ProcessBasicInformation = EnumValue("_PROCESSINFOCLASS", "ProcessBasicInformation", 0x0) +ProcessQuotaLimits = EnumValue("_PROCESSINFOCLASS", "ProcessQuotaLimits", 0x1) +ProcessIoCounters = EnumValue("_PROCESSINFOCLASS", "ProcessIoCounters", 0x2) +ProcessVmCounters = EnumValue("_PROCESSINFOCLASS", "ProcessVmCounters", 0x3) +ProcessTimes = EnumValue("_PROCESSINFOCLASS", "ProcessTimes", 0x4) +ProcessBasePriority = EnumValue("_PROCESSINFOCLASS", "ProcessBasePriority", 0x5) +ProcessRaisePriority = EnumValue("_PROCESSINFOCLASS", "ProcessRaisePriority", 0x6) +ProcessDebugPort = EnumValue("_PROCESSINFOCLASS", "ProcessDebugPort", 0x7) +ProcessExceptionPort = EnumValue("_PROCESSINFOCLASS", "ProcessExceptionPort", 0x8) +ProcessAccessToken = EnumValue("_PROCESSINFOCLASS", "ProcessAccessToken", 0x9) +ProcessLdtInformation = EnumValue("_PROCESSINFOCLASS", "ProcessLdtInformation", 0xa) +ProcessLdtSize = EnumValue("_PROCESSINFOCLASS", "ProcessLdtSize", 0xb) +ProcessDefaultHardErrorMode = EnumValue("_PROCESSINFOCLASS", "ProcessDefaultHardErrorMode", 0xc) +ProcessIoPortHandlers = EnumValue("_PROCESSINFOCLASS", "ProcessIoPortHandlers", 0xd) +ProcessPooledUsageAndLimits = EnumValue("_PROCESSINFOCLASS", "ProcessPooledUsageAndLimits", 0xe) +ProcessWorkingSetWatch = EnumValue("_PROCESSINFOCLASS", "ProcessWorkingSetWatch", 0xf) +ProcessUserModeIOPL = EnumValue("_PROCESSINFOCLASS", "ProcessUserModeIOPL", 0x10) +ProcessEnableAlignmentFaultFixup = EnumValue("_PROCESSINFOCLASS", "ProcessEnableAlignmentFaultFixup", 0x11) +ProcessPriorityClass = EnumValue("_PROCESSINFOCLASS", "ProcessPriorityClass", 0x12) +ProcessWx86Information = EnumValue("_PROCESSINFOCLASS", "ProcessWx86Information", 0x13) +ProcessHandleCount = EnumValue("_PROCESSINFOCLASS", "ProcessHandleCount", 0x14) +ProcessAffinityMask = EnumValue("_PROCESSINFOCLASS", "ProcessAffinityMask", 0x15) +ProcessPriorityBoost = EnumValue("_PROCESSINFOCLASS", "ProcessPriorityBoost", 0x16) +ProcessDeviceMap = EnumValue("_PROCESSINFOCLASS", "ProcessDeviceMap", 0x17) +ProcessSessionInformation = EnumValue("_PROCESSINFOCLASS", "ProcessSessionInformation", 0x18) +ProcessForegroundInformation = EnumValue("_PROCESSINFOCLASS", "ProcessForegroundInformation", 0x19) +ProcessWow64Information = EnumValue("_PROCESSINFOCLASS", "ProcessWow64Information", 0x1a) +ProcessImageFileName = EnumValue("_PROCESSINFOCLASS", "ProcessImageFileName", 0x1b) +ProcessLUIDDeviceMapsEnabled = EnumValue("_PROCESSINFOCLASS", "ProcessLUIDDeviceMapsEnabled", 0x1c) +ProcessBreakOnTermination = EnumValue("_PROCESSINFOCLASS", "ProcessBreakOnTermination", 0x1d) +ProcessDebugObjectHandle = EnumValue("_PROCESSINFOCLASS", "ProcessDebugObjectHandle", 0x1e) +ProcessDebugFlags = EnumValue("_PROCESSINFOCLASS", "ProcessDebugFlags", 0x1f) +ProcessHandleTracing = EnumValue("_PROCESSINFOCLASS", "ProcessHandleTracing", 0x20) +ProcessIoPriority = EnumValue("_PROCESSINFOCLASS", "ProcessIoPriority", 0x21) +ProcessExecuteFlags = EnumValue("_PROCESSINFOCLASS", "ProcessExecuteFlags", 0x22) +ProcessTlsInformation = EnumValue("_PROCESSINFOCLASS", "ProcessTlsInformation", 0x23) +ProcessCookie = EnumValue("_PROCESSINFOCLASS", "ProcessCookie", 0x24) +ProcessImageInformation = EnumValue("_PROCESSINFOCLASS", "ProcessImageInformation", 0x25) +ProcessCycleTime = EnumValue("_PROCESSINFOCLASS", "ProcessCycleTime", 0x26) +ProcessPagePriority = EnumValue("_PROCESSINFOCLASS", "ProcessPagePriority", 0x27) +ProcessInstrumentationCallback = EnumValue("_PROCESSINFOCLASS", "ProcessInstrumentationCallback", 0x28) +ProcessThreadStackAllocation = EnumValue("_PROCESSINFOCLASS", "ProcessThreadStackAllocation", 0x29) +ProcessWorkingSetWatchEx = EnumValue("_PROCESSINFOCLASS", "ProcessWorkingSetWatchEx", 0x2a) +ProcessImageFileNameWin32 = EnumValue("_PROCESSINFOCLASS", "ProcessImageFileNameWin32", 0x2b) +ProcessImageFileMapping = EnumValue("_PROCESSINFOCLASS", "ProcessImageFileMapping", 0x2c) +ProcessAffinityUpdateMode = EnumValue("_PROCESSINFOCLASS", "ProcessAffinityUpdateMode", 0x2d) +ProcessMemoryAllocationMode = EnumValue("_PROCESSINFOCLASS", "ProcessMemoryAllocationMode", 0x2e) +ProcessGroupInformation = EnumValue("_PROCESSINFOCLASS", "ProcessGroupInformation", 0x2f) +ProcessTokenVirtualizationEnabled = EnumValue("_PROCESSINFOCLASS", "ProcessTokenVirtualizationEnabled", 0x30) +ProcessOwnerInformation = EnumValue("_PROCESSINFOCLASS", "ProcessOwnerInformation", 0x31) +ProcessWindowInformation = EnumValue("_PROCESSINFOCLASS", "ProcessWindowInformation", 0x32) +ProcessHandleInformation = EnumValue("_PROCESSINFOCLASS", "ProcessHandleInformation", 0x33) +ProcessMitigationPolicy = EnumValue("_PROCESSINFOCLASS", "ProcessMitigationPolicy", 0x34) +ProcessDynamicFunctionTableInformation = EnumValue("_PROCESSINFOCLASS", "ProcessDynamicFunctionTableInformation", 0x35) +ProcessHandleCheckingMode = EnumValue("_PROCESSINFOCLASS", "ProcessHandleCheckingMode", 0x36) +ProcessKeepAliveCount = EnumValue("_PROCESSINFOCLASS", "ProcessKeepAliveCount", 0x37) +ProcessRevokeFileHandles = EnumValue("_PROCESSINFOCLASS", "ProcessRevokeFileHandles", 0x38) +ProcessWorkingSetControl = EnumValue("_PROCESSINFOCLASS", "ProcessWorkingSetControl", 0x39) +ProcessHandleTable = EnumValue("_PROCESSINFOCLASS", "ProcessHandleTable", 0x3a) +ProcessCheckStackExtentsMode = EnumValue("_PROCESSINFOCLASS", "ProcessCheckStackExtentsMode", 0x3b) +ProcessCommandLineInformation = EnumValue("_PROCESSINFOCLASS", "ProcessCommandLineInformation", 0x3c) +ProcessProtectionInformation = EnumValue("_PROCESSINFOCLASS", "ProcessProtectionInformation", 0x3d) +ProcessMemoryExhaustion = EnumValue("_PROCESSINFOCLASS", "ProcessMemoryExhaustion", 0x3e) +ProcessFaultInformation = EnumValue("_PROCESSINFOCLASS", "ProcessFaultInformation", 0x3f) +ProcessTelemetryIdInformation = EnumValue("_PROCESSINFOCLASS", "ProcessTelemetryIdInformation", 0x40) +ProcessCommitReleaseInformation = EnumValue("_PROCESSINFOCLASS", "ProcessCommitReleaseInformation", 0x41) +ProcessReserved1Information = EnumValue("_PROCESSINFOCLASS", "ProcessReserved1Information", 0x42) +ProcessReserved2Information = EnumValue("_PROCESSINFOCLASS", "ProcessReserved2Information", 0x43) +ProcessSubsystemProcess = EnumValue("_PROCESSINFOCLASS", "ProcessSubsystemProcess", 0x44) +ProcessInPrivate = EnumValue("_PROCESSINFOCLASS", "ProcessInPrivate", 0x46) +ProcessRaiseUMExceptionOnInvalidHandleClose = EnumValue("_PROCESSINFOCLASS", "ProcessRaiseUMExceptionOnInvalidHandleClose", 0x47) +ProcessSubsystemInformation = EnumValue("_PROCESSINFOCLASS", "ProcessSubsystemInformation", 0x4b) +ProcessWin32kSyscallFilterInformation = EnumValue("_PROCESSINFOCLASS", "ProcessWin32kSyscallFilterInformation", 0x4f) +ProcessEnergyTrackingState = EnumValue("_PROCESSINFOCLASS", "ProcessEnergyTrackingState", 0x52) +MaxProcessInfoClass = EnumValue("_PROCESSINFOCLASS", "MaxProcessInfoClass", 0x53) +
    +[docs] +class _PROCESSINFOCLASS(EnumType): + values = [ProcessBasicInformation, ProcessQuotaLimits, ProcessIoCounters, ProcessVmCounters, ProcessTimes, ProcessBasePriority, ProcessRaisePriority, ProcessDebugPort, ProcessExceptionPort, ProcessAccessToken, ProcessLdtInformation, ProcessLdtSize, ProcessDefaultHardErrorMode, ProcessIoPortHandlers, ProcessPooledUsageAndLimits, ProcessWorkingSetWatch, ProcessUserModeIOPL, ProcessEnableAlignmentFaultFixup, ProcessPriorityClass, ProcessWx86Information, ProcessHandleCount, ProcessAffinityMask, ProcessPriorityBoost, ProcessDeviceMap, ProcessSessionInformation, ProcessForegroundInformation, ProcessWow64Information, ProcessImageFileName, ProcessLUIDDeviceMapsEnabled, ProcessBreakOnTermination, ProcessDebugObjectHandle, ProcessDebugFlags, ProcessHandleTracing, ProcessIoPriority, ProcessExecuteFlags, ProcessTlsInformation, ProcessCookie, ProcessImageInformation, ProcessCycleTime, ProcessPagePriority, ProcessInstrumentationCallback, ProcessThreadStackAllocation, ProcessWorkingSetWatchEx, ProcessImageFileNameWin32, ProcessImageFileMapping, ProcessAffinityUpdateMode, ProcessMemoryAllocationMode, ProcessGroupInformation, ProcessTokenVirtualizationEnabled, ProcessOwnerInformation, ProcessWindowInformation, ProcessHandleInformation, ProcessMitigationPolicy, ProcessDynamicFunctionTableInformation, ProcessHandleCheckingMode, ProcessKeepAliveCount, ProcessRevokeFileHandles, ProcessWorkingSetControl, ProcessHandleTable, ProcessCheckStackExtentsMode, ProcessCommandLineInformation, ProcessProtectionInformation, ProcessMemoryExhaustion, ProcessFaultInformation, ProcessTelemetryIdInformation, ProcessCommitReleaseInformation, ProcessReserved1Information, ProcessReserved2Information, ProcessSubsystemProcess, ProcessInPrivate, ProcessRaiseUMExceptionOnInvalidHandleClose, ProcessSubsystemInformation, ProcessWin32kSyscallFilterInformation, ProcessEnergyTrackingState, MaxProcessInfoClass] + mapper = FlagMapper(*values)
    + +PROCESSINFOCLASS = _PROCESSINFOCLASS + + +ProcessMemoryPriority = EnumValue("_PROCESS_INFORMATION_CLASS", "ProcessMemoryPriority", 0x0) +ProcessMemoryExhaustionInfo = EnumValue("_PROCESS_INFORMATION_CLASS", "ProcessMemoryExhaustionInfo", 0x1) +ProcessAppMemoryInfo = EnumValue("_PROCESS_INFORMATION_CLASS", "ProcessAppMemoryInfo", 0x2) +ProcessInPrivateInfo = EnumValue("_PROCESS_INFORMATION_CLASS", "ProcessInPrivateInfo", 0x3) +ProcessPowerThrottling = EnumValue("_PROCESS_INFORMATION_CLASS", "ProcessPowerThrottling", 0x4) +ProcessReservedValue1 = EnumValue("_PROCESS_INFORMATION_CLASS", "ProcessReservedValue1", 0x5) +ProcessTelemetryCoverageInfo = EnumValue("_PROCESS_INFORMATION_CLASS", "ProcessTelemetryCoverageInfo", 0x6) +ProcessProtectionLevelInfo = EnumValue("_PROCESS_INFORMATION_CLASS", "ProcessProtectionLevelInfo", 0x7) +ProcessLeapSecondInfo = EnumValue("_PROCESS_INFORMATION_CLASS", "ProcessLeapSecondInfo", 0x8) +ProcessMachineTypeInfo = EnumValue("_PROCESS_INFORMATION_CLASS", "ProcessMachineTypeInfo", 0x9) +ProcessOverrideSubsequentPrefetchParameter = EnumValue("_PROCESS_INFORMATION_CLASS", "ProcessOverrideSubsequentPrefetchParameter", 0xa) +ProcessMaxOverridePrefetchParameter = EnumValue("_PROCESS_INFORMATION_CLASS", "ProcessMaxOverridePrefetchParameter", 0xb) +ProcessInformationClassMax = EnumValue("_PROCESS_INFORMATION_CLASS", "ProcessInformationClassMax", 0xc) +
    +[docs] +class _PROCESS_INFORMATION_CLASS(EnumType): + values = [ProcessMemoryPriority, ProcessMemoryExhaustionInfo, ProcessAppMemoryInfo, ProcessInPrivateInfo, ProcessPowerThrottling, ProcessReservedValue1, ProcessTelemetryCoverageInfo, ProcessProtectionLevelInfo, ProcessLeapSecondInfo, ProcessMachineTypeInfo, ProcessOverrideSubsequentPrefetchParameter, ProcessMaxOverridePrefetchParameter, ProcessInformationClassMax] + mapper = FlagMapper(*values)
    + +PROCESS_INFORMATION_CLASS = _PROCESS_INFORMATION_CLASS + + +UserEnabled = EnumValue("_MACHINE_ATTRIBUTES", "UserEnabled", 0x1) +KernelEnabled = EnumValue("_MACHINE_ATTRIBUTES", "KernelEnabled", 0x2) +Wow64Container = EnumValue("_MACHINE_ATTRIBUTES", "Wow64Container", 0x4) +
    +[docs] +class _MACHINE_ATTRIBUTES(EnumType): + values = [UserEnabled, KernelEnabled, Wow64Container] + mapper = FlagMapper(*values)
    + +MACHINE_ATTRIBUTES = _MACHINE_ATTRIBUTES + + +
    +[docs] +class _PROCESS_MACHINE_INFORMATION(Structure): + _fields_ = [ + ("ProcessMachine", USHORT), + ("Res0", USHORT), + ("MachineAttributes", MACHINE_ATTRIBUTES), + ]
    + +PROCESS_MACHINE_INFORMATION = _PROCESS_MACHINE_INFORMATION + MemExtendedParameterInvalidType = EnumValue("MEM_EXTENDED_PARAMETER_TYPE", "MemExtendedParameterInvalidType", 0x0) MemExtendedParameterAddressRequirements = EnumValue("MEM_EXTENDED_PARAMETER_TYPE", "MemExtendedParameterAddressRequirements", 0x1) MemExtendedParameterNumaNode = EnumValue("MEM_EXTENDED_PARAMETER_TYPE", "MemExtendedParameterNumaNode", 0x2) @@ -4601,6 +4899,129 @@ LPSHFILEOPSTRUCTA = POINTER(_SHFILEOPSTRUCTA) SHFILEOPSTRUCTA = _SHFILEOPSTRUCTA +# Self referencing struct tricks +class _LIST_ENTRY(Structure): + pass +LIST_ENTRY = _LIST_ENTRY +PLIST_ENTRY = POINTER(_LIST_ENTRY) +PRLIST_ENTRY = POINTER(_LIST_ENTRY) +_LIST_ENTRY._fields_ = [ + ("Flink", POINTER(_LIST_ENTRY)), + ("Blink", POINTER(_LIST_ENTRY)), +] + +# From: ctypes_generation\extended_structs\_LIST_ENTRY.py +# _LIST_ENTRY is a self referencing structure +# Currently ctypes generation does not support extending self referencing structures +# Ass the _fields_ assignement should happen after the extended structure definition +# So we just redefine fully _LIST_ENTRY without inheriting the real one + +
    +[docs] +class _LIST_ENTRY(Structure): + def get_real_struct(self, targetcls, target_field): + # >>> gdef.LDR_DATA_TABLE_ENTRY.InMemoryOrderLinks + # <Field type=_LIST_ENTRY, ofs=16, size=16> + # This field object does not allow to retrieve the type.. + # So we need to basse the target class AND the target field.. + return targetcls.from_address(ctypes.addressof(self) - target_field.offset)
    + + +_LIST_ENTRY._fields_ = [ + ("Flink", POINTER(_LIST_ENTRY)), + ("Blink", POINTER(_LIST_ENTRY)), +] +LIST_ENTRY = _LIST_ENTRY +PLIST_ENTRY = POINTER(_LIST_ENTRY) +PRLIST_ENTRY = POINTER(_LIST_ENTRY) +class _LSA_UNICODE_STRING(Structure): + _fields_ = [ + ("Length", USHORT), + ("MaximumLength", USHORT), + ("Buffer", PVOID), + ] +LSA_UNICODE_STRING = _LSA_UNICODE_STRING +PLSA_UNICODE_STRING = POINTER(_LSA_UNICODE_STRING) +PUNICODE_STRING = POINTER(_LSA_UNICODE_STRING) +UNICODE_STRING = _LSA_UNICODE_STRING + +INITIAL_LSA_UNICODE_STRING = _LSA_UNICODE_STRING + +
    +[docs] +class _LSA_UNICODE_STRING(INITIAL_LSA_UNICODE_STRING): + @property + def str(self): + """The python string of the LSA_UNICODE_STRING object + + :type: :class:`unicode` + """ + if not self.Length: + return "" + if getattr(self, "_target", None) is not None: #remote ctypes :D -> TRICKS OF THE YEAR + raw_data = self._target.read_memory(self.Buffer, self.Length) + return raw_data.decode("utf16") + size = int(self.Length / 2) + return (ctypes.c_wchar * size).from_address(self.Buffer)[:] + + @classmethod + def from_string(cls, s): + utf16_len = len(s) * 2 + return cls(utf16_len, utf16_len, ctypes.cast(PWSTR(s), PVOID)) + + @classmethod + def from_size(cls, size): + buffer = ctypes.create_string_buffer(size) + return cls(size, size, ctypes.cast(buffer, PVOID)) + + def __repr__(self): + return windows.pycompat.urepr_encode(u"""<{0} "{1}" at {2}>""".format(type(self).__name__, self.str, hex(id(self)))) + + def __sprint__(self): + try: + return self.__repr__() + except TypeError as e: + # Bad buffer: print raw infos + return """<{0} len={1} maxlen={2} buffer={3}>""".format(type(self).__name__, self.Length, self.MaximumLength, self.Buffer)
    + + +LSA_UNICODE_STRING = _LSA_UNICODE_STRING +PLSA_UNICODE_STRING = POINTER(_LSA_UNICODE_STRING) +PUNICODE_STRING = POINTER(_LSA_UNICODE_STRING) +UNICODE_STRING = _LSA_UNICODE_STRING +
    +[docs] +class _CLIENT_ID(Structure): + _fields_ = [ + ("UniqueProcess", HANDLE), + ("UniqueThread", HANDLE), + ]
    + +CLIENT_ID = _CLIENT_ID +PCLIENT_ID = POINTER(_CLIENT_ID) + +
    +[docs] +class _CLIENT_ID64(Structure): + _fields_ = [ + ("UniqueProcess", ULONG64), + ("UniqueThread", ULONG64), + ]
    + +CLIENT_ID64 = _CLIENT_ID64 +PCLIENT_ID64 = POINTER(_CLIENT_ID64) + +
    +[docs] +class _CLIENT_ID32(Structure): + _fields_ = [ + ("UniqueProcess", ULONG), + ("UniqueThread", ULONG), + ]
    + +CLIENT_ID32 = _CLIENT_ID32 +PCLIENT_ID32 = POINTER(_CLIENT_ID32) + SymNone = EnumValue("SYM_TYPE", "SymNone", 0x0) SymCoff = EnumValue("SYM_TYPE", "SymCoff", 0x1) SymCv = EnumValue("SYM_TYPE", "SymCv", 0x2) @@ -5264,6 +5685,130 @@ LPSTACKFRAME_EX = POINTER(_tagSTACKFRAME_EX) STACKFRAME_EX = _tagSTACKFRAME_EX +ComputerNameNetBIOS = EnumValue("_COMPUTER_NAME_FORMAT", "ComputerNameNetBIOS", 0x0) +ComputerNameDnsHostname = EnumValue("_COMPUTER_NAME_FORMAT", "ComputerNameDnsHostname", 0x1) +ComputerNameDnsDomain = EnumValue("_COMPUTER_NAME_FORMAT", "ComputerNameDnsDomain", 0x2) +ComputerNameDnsFullyQualified = EnumValue("_COMPUTER_NAME_FORMAT", "ComputerNameDnsFullyQualified", 0x3) +ComputerNamePhysicalNetBIOS = EnumValue("_COMPUTER_NAME_FORMAT", "ComputerNamePhysicalNetBIOS", 0x4) +ComputerNamePhysicalDnsHostname = EnumValue("_COMPUTER_NAME_FORMAT", "ComputerNamePhysicalDnsHostname", 0x5) +ComputerNamePhysicalDnsDomain = EnumValue("_COMPUTER_NAME_FORMAT", "ComputerNamePhysicalDnsDomain", 0x6) +ComputerNamePhysicalDnsFullyQualified = EnumValue("_COMPUTER_NAME_FORMAT", "ComputerNamePhysicalDnsFullyQualified", 0x7) +ComputerNameMax = EnumValue("_COMPUTER_NAME_FORMAT", "ComputerNameMax", 0x8) +
    +[docs] +class _COMPUTER_NAME_FORMAT(EnumType): + values = [ComputerNameNetBIOS, ComputerNameDnsHostname, ComputerNameDnsDomain, ComputerNameDnsFullyQualified, ComputerNamePhysicalNetBIOS, ComputerNamePhysicalDnsHostname, ComputerNamePhysicalDnsDomain, ComputerNamePhysicalDnsFullyQualified, ComputerNameMax] + mapper = FlagMapper(*values)
    + +COMPUTER_NAME_FORMAT = _COMPUTER_NAME_FORMAT + + +
    +[docs] +class _SYSTEM_PROCESS_INFORMATION(Structure): + _fields_ = [ + ("NextEntryOffset", ULONG), + ("NumberOfThreads", ULONG), + ("Reserved1", BYTE * (24)), + ("CreateTime", LARGE_INTEGER), + ("UserTime", LARGE_INTEGER), + ("KernelTime", LARGE_INTEGER), + ("ImageName", UNICODE_STRING), + ("BasePriority", LONG), + ("UniqueProcessId", HANDLE), + ("InheritedFromUniqueProcessId", PVOID), + ("HandleCount", ULONG), + ("Reserved4", BYTE * (4)), + ("Reserved5", PVOID * (1)), + ("PeakVirtualSize", PVOID), + ("VirtualSize", PVOID), + ("PageFaultCount", PVOID), + ("PeakWorkingSetSize", PVOID), + ("WorkingSetSize", PVOID), + ("QuotaPeakPagedPoolUsage", PVOID), + ("QuotaPagedPoolUsage", PVOID), + ("QuotaPeakNonPagedPoolUsage", PVOID), + ("QuotaNonPagedPoolUsage", PVOID), + ("PagefileUsage", PVOID), + ("PeakPagefileUsage", SIZE_T), + ("PrivatePageCount", SIZE_T), + ("Reserved6", LARGE_INTEGER * (6)), + ]
    + +PSYSTEM_PROCESS_INFORMATION = POINTER(_SYSTEM_PROCESS_INFORMATION) +SYSTEM_PROCESS_INFORMATION = _SYSTEM_PROCESS_INFORMATION + +
    +[docs] +class _SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION(Structure): + _fields_ = [ + ("IdleTime", LARGE_INTEGER), + ("KernelTime", LARGE_INTEGER), + ("UserTime", LARGE_INTEGER), + ("Reserved1", LARGE_INTEGER * (2)), + ("Reserved2", ULONG), + ]
    + +PSYSTEM_PROCESSOR_PERFORMANCE_INFORMATION = POINTER(_SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION) +SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION = _SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION + +
    +[docs] +class _SYSTEM_REGISTRY_QUOTA_INFORMATION(Structure): + _fields_ = [ + ("RegistryQuotaAllowed", ULONG), + ("RegistryQuotaUsed", ULONG), + ("Reserved1", PVOID), + ]
    + +PSYSTEM_REGISTRY_QUOTA_INFORMATION = POINTER(_SYSTEM_REGISTRY_QUOTA_INFORMATION) +SYSTEM_REGISTRY_QUOTA_INFORMATION = _SYSTEM_REGISTRY_QUOTA_INFORMATION + +
    +[docs] +class _SYSTEM_BASIC_INFORMATION(Structure): + _fields_ = [ + ("Reserved1", BYTE * (24)), + ("Reserved2", PVOID * (4)), + ("NumberOfProcessors", CHAR), + ]
    + +PSYSTEM_BASIC_INFORMATION = POINTER(_SYSTEM_BASIC_INFORMATION) +SYSTEM_BASIC_INFORMATION = _SYSTEM_BASIC_INFORMATION + +class _ANON__ANON__SYSTEM_INFO_SUB_UNION_1_SUB_STRUCTURE_1(Structure): + _fields_ = [ + ("wProcessorArchitecture", WORD), + ("wReserved", WORD), + ] + +class _ANON__SYSTEM_INFO_SUB_UNION_1(Union): + _anonymous_ = ("DUMMYSTRUCTNAME",) + _fields_ = [ + ("dwOemId", DWORD), + ("DUMMYSTRUCTNAME", _ANON__ANON__SYSTEM_INFO_SUB_UNION_1_SUB_STRUCTURE_1), + ] + +
    +[docs] +class _SYSTEM_INFO(Structure): + _anonymous_ = ("DUMMYUNIONNAME",) + _fields_ = [ + ("DUMMYUNIONNAME", _ANON__SYSTEM_INFO_SUB_UNION_1), + ("dwPageSize", DWORD), + ("lpMinimumApplicationAddress", LPVOID), + ("lpMaximumApplicationAddress", LPVOID), + ("dwActiveProcessorMask", DWORD_PTR), + ("dwNumberOfProcessors", DWORD), + ("dwProcessorType", DWORD), + ("dwAllocationGranularity", DWORD), + ("wProcessorLevel", WORD), + ("wProcessorRevision", WORD), + ]
    + +LPSYSTEM_INFO = POINTER(_SYSTEM_INFO) +SYSTEM_INFO = _SYSTEM_INFO + TASK_ACTION_EXEC = EnumValue("_TASK_ACTION_TYPE", "TASK_ACTION_EXEC", 0x0) TASK_ACTION_COM_HANDLER = EnumValue("_TASK_ACTION_TYPE", "TASK_ACTION_COM_HANDLER", 0x5) TASK_ACTION_SEND_EMAIL = EnumValue("_TASK_ACTION_TYPE", "TASK_ACTION_SEND_EMAIL", 0x6) @@ -5402,6 +5947,651 @@ +
    +[docs] +class _CURDIR(Structure): + _fields_ = [ + ("DosPath", UNICODE_STRING), + ("Handle", PVOID), + ]
    + +CURDIR = _CURDIR +PCURDIR = POINTER(_CURDIR) + +
    +[docs] +class _RTL_DRIVE_LETTER_CURDIR(Structure): + _fields_ = [ + ("Flags", WORD), + ("Length", WORD), + ("TimeStamp", ULONG), + ("DosPath", UNICODE_STRING), + ]
    + +PRTL_DRIVE_LETTER_CURDIR = POINTER(_RTL_DRIVE_LETTER_CURDIR) +RTL_DRIVE_LETTER_CURDIR = _RTL_DRIVE_LETTER_CURDIR + +
    +[docs] +class _RTL_USER_PROCESS_PARAMETERS(Structure): + _fields_ = [ + ("MaximumLength", ULONG), + ("Length", ULONG), + ("Flags", ULONG), + ("DebugFlags", ULONG), + ("ConsoleHandle", PVOID), + ("ConsoleFlags", ULONG), + ("StandardInput", PVOID), + ("StandardOutput", PVOID), + ("StandardError", PVOID), + ("CurrentDirectory", CURDIR), + ("DllPath", UNICODE_STRING), + ("ImagePathName", UNICODE_STRING), + ("CommandLine", UNICODE_STRING), + ("Environment", PVOID), + ("StartingX", ULONG), + ("StartingY", ULONG), + ("CountX", ULONG), + ("CountY", ULONG), + ("CountCharsX", ULONG), + ("CountCharsY", ULONG), + ("FillAttribute", ULONG), + ("WindowFlags", ULONG), + ("ShowWindowFlags", ULONG), + ("WindowTitle", UNICODE_STRING), + ("DesktopInfo", UNICODE_STRING), + ("ShellInfo", UNICODE_STRING), + ("RuntimeData", UNICODE_STRING), + ("CurrentDirectores", RTL_DRIVE_LETTER_CURDIR * (32)), + ]
    + +PRTL_USER_PROCESS_PARAMETERS = POINTER(_RTL_USER_PROCESS_PARAMETERS) +RTL_USER_PROCESS_PARAMETERS = _RTL_USER_PROCESS_PARAMETERS + +
    +[docs] +class _LDR_DATA_TABLE_ENTRY(Structure): + _fields_ = [ + ("Reserved1", PVOID * (2)), + ("InMemoryOrderLinks", LIST_ENTRY), + ("Reserved2", PVOID * (2)), + ("DllBase", PVOID), + ("EntryPoint", PVOID), + ("SizeOfImage", PVOID), + ("FullDllName", UNICODE_STRING), + ("BaseDllName", UNICODE_STRING), + ("Reserved5", PVOID * (3)), + ("CheckSum", ULONG), + ("TimeDateStamp", ULONG), + ]
    + +LDR_DATA_TABLE_ENTRY = _LDR_DATA_TABLE_ENTRY +PLDR_DATA_TABLE_ENTRY = POINTER(_LDR_DATA_TABLE_ENTRY) + +
    +[docs] +class _PEB_LDR_DATA(Structure): + _fields_ = [ + ("Length", ULONG), + ("Initialized", BYTE), + ("SsHandle", PVOID), + ("InLoadOrderModuleList", _LIST_ENTRY), + ("InMemoryOrderModuleList", _LIST_ENTRY), + ("InInitializationOrderModuleList", _LIST_ENTRY), + ("EntryInProgress", PVOID), + ]
    + +PEB_LDR_DATA = _PEB_LDR_DATA +PPEB_LDR_DATA = POINTER(_PEB_LDR_DATA) + +
    +[docs] +class _ANON_PEB_SYSTEM_DEPENDENT_02(Union): + _fields_ = [ + ("FastPebLockRoutine", PVOID), + ("SparePtr1", PVOID), + ("AtlThunkSListPtr", PVOID), + ]
    + + + +
    +[docs] +class _ANON_PEB_SYSTEM_DEPENDENT_03(Union): + _fields_ = [ + ("FastPebUnlockRoutine", PVOID), + ("SparePtr2", PVOID), + ("IFEOKey", PVOID), + ]
    + + + +
    +[docs] +class _ANON_PEB_SYSTEM_DEPENDENT_06(Union): + _fields_ = [ + ("FreeList", PVOID), + ("SparePebPtr0", PVOID), + ("ApiSetMap", PVOID), + ]
    + + + +
    +[docs] +class _ANON_PEB_SYSTEM_DEPENDENT_07(Union): + _fields_ = [ + ("ReadOnlySharedMemoryHeap", PVOID), + ("HotpatchInformation", PVOID), + ("SparePvoid0", PVOID), + ]
    + + + +
    +[docs] +class _ANON_PEB_UNION_1(Union): + _fields_ = [ + ("KernelCallbackTable", PVOID), + ("UserSharedInfoPtr", PVOID), + ]
    + + + +
    +[docs] +class _ANON_PEB_UNION_2(Union): + _fields_ = [ + ("ImageProcessAffinityMask", PVOID), + ("ActiveProcessAffinityMask", PVOID), + ]
    + + + +class _ANON__PEB_SUB_UNION_1(Union): + _fields_ = [ + ("KernelCallbackTable", PVOID), + ("UserSharedInfoPtr", PVOID), + ] + + +class _ANON__PEB_SUB_UNION_2(Union): + _fields_ = [ + ("ImageProcessAffinityMask", PVOID), + ("ActiveProcessAffinityMask", PVOID), + ] + +
    +[docs] +class _PEB(Structure): + _anonymous_ = ("_SYSTEM_DEPENDENT_02","_SYSTEM_DEPENDENT_03","anon_01","_SYSTEM_DEPENDENT_06","_SYSTEM_DEPENDENT_07","anon_02") + _fields_ = [ + ("Reserved1", BYTE * (2)), + ("BeingDebugged", BYTE), + ("Reserved2", BYTE * (1)), + ("Mutant", PVOID), + ("ImageBaseAddress", PVOID), + ("Ldr", PPEB_LDR_DATA), + ("ProcessParameters", PRTL_USER_PROCESS_PARAMETERS), + ("SubSystemData", PVOID), + ("ProcessHeap", PVOID), + ("FastPebLock", PVOID), + ("_SYSTEM_DEPENDENT_02", _ANON_PEB_SYSTEM_DEPENDENT_02), + ("_SYSTEM_DEPENDENT_03", _ANON_PEB_SYSTEM_DEPENDENT_03), + ("_SYSTEM_DEPENDENT_04", PVOID), + ("anon_01", _ANON__PEB_SUB_UNION_1), + ("SystemReserved", DWORD), + ("_SYSTEM_DEPENDENT_05", DWORD), + ("_SYSTEM_DEPENDENT_06", _ANON_PEB_SYSTEM_DEPENDENT_06), + ("TlsExpansionCounter", PVOID), + ("TlsBitmap", PVOID), + ("TlsBitmapBits", DWORD * (2)), + ("ReadOnlySharedMemoryBase", PVOID), + ("_SYSTEM_DEPENDENT_07", _ANON_PEB_SYSTEM_DEPENDENT_07), + ("ReadOnlyStaticServerData", PVOID), + ("AnsiCodePageData", PVOID), + ("OemCodePageData", PVOID), + ("UnicodeCaseTableData", PVOID), + ("NumberOfProcessors", DWORD), + ("NtGlobalFlag", DWORD), + ("CriticalSectionTimeout", LARGE_INTEGER), + ("HeapSegmentReserve", PVOID), + ("HeapSegmentCommit", PVOID), + ("HeapDeCommitTotalFreeThreshold", PVOID), + ("HeapDeCommitFreeBlockThreshold", PVOID), + ("NumberOfHeaps", DWORD), + ("MaximumNumberOfHeaps", DWORD), + ("ProcessHeaps", PVOID), + ("GdiSharedHandleTable", PVOID), + ("ProcessStarterHelper", PVOID), + ("GdiDCAttributeList", PVOID), + ("LoaderLock", PVOID), + ("OSMajorVersion", DWORD), + ("OSMinorVersion", DWORD), + ("OSBuildNumber", WORD), + ("OSCSDVersion", WORD), + ("OSPlatformId", DWORD), + ("ImageSubsystem", DWORD), + ("ImageSubsystemMajorVersion", DWORD), + ("ImageSubsystemMinorVersion", PVOID), + ("anon_02", _ANON__PEB_SUB_UNION_2), + ("GdiHandleBuffer", PVOID * (26)), + ("GdiHandleBuffer2", BYTE * (32)), + ("PostProcessInitRoutine", PVOID), + ("TlsExpansionBitmap", PVOID), + ("TlsExpansionBitmapBits", DWORD * (32)), + ("SessionId", PVOID), + ("AppCompatFlags", ULARGE_INTEGER), + ("AppCompatFlagsUser", ULARGE_INTEGER), + ("pShimData", PVOID), + ("AppCompatInfo", PVOID), + ("CSDVersion", UNICODE_STRING), + ("ActivationContextData", PVOID), + ("ProcessAssemblyStorageMap", PVOID), + ("SystemDefaultActivationContextData", PVOID), + ("SystemAssemblyStorageMap", PVOID), + ("MinimumStackCommit", PVOID), + ]
    + +PEB = _PEB +PPEB = POINTER(_PEB) + +# Self referencing struct tricks +
    +[docs] +class _EXCEPTION_REGISTRATION_RECORD(Structure): + pass
    + + +_EXCEPTION_REGISTRATION_RECORD._fields_ = [ + ("Next", POINTER(_EXCEPTION_REGISTRATION_RECORD)), + ("Handler", PVOID), +] + +class _ANON__NT_TIB_SUB_UNION_1(Union): + _fields_ = [ + ("FiberData", PVOID), + ("Version", ULONG), + ] + +# Self referencing struct tricks +
    +[docs] +class _NT_TIB(Structure): + _anonymous_ = ("anon_01",)
    + + +NT_TIB = _NT_TIB +_NT_TIB._fields_ = [ + ("ExceptionList", POINTER(_EXCEPTION_REGISTRATION_RECORD)), + ("StackBase", PVOID), + ("StackLimit", PVOID), + ("SubSystemTib", PVOID), + ("anon_01", _ANON__NT_TIB_SUB_UNION_1), + ("ArbitraryUserPointer", PVOID), + ("Self", POINTER(_NT_TIB)), +] + +
    +[docs] +class _TEB(Structure): + _fields_ = [ + ("NtTib", _NT_TIB), + ("EnvironmentPointer", PVOID), + ("ClientId", _CLIENT_ID), + ("ActiveRpcHandle", PVOID), + ("ThreadLocalStoragePointer", PVOID), + ("ProcessEnvironmentBlock", POINTER(_PEB)), + ("LastErrorValue", ULONG), + ("CountOfOwnedCriticalSections", ULONG), + ("CsrClientThread", PVOID), + ("Win32ThreadInfo", PVOID), + ("User32Reserved", ULONG * (26)), + ("UserReserved", ULONG * (5)), + ("WOW32Reserved", PVOID), + ("CurrentLocale", ULONG), + ("FpSoftwareStatusRegister", ULONG), + ]
    + +TEB = _TEB + +class _ANON__ARM64_NT_NEON128_SUB_STRUCTURE_1(Structure): + _fields_ = [ + ("Low", ULONGLONG), + ("High", LONGLONG), + ] + +
    +[docs] +class _ARM64_NT_NEON128(Union): + _anonymous_ = ("DUMMYSTRUCTNAME",) + _fields_ = [ + ("DUMMYSTRUCTNAME", _ANON__ARM64_NT_NEON128_SUB_STRUCTURE_1), + ("D", DOUBLE * (2)), + ("S", FLOAT * (4)), + ("H", WORD * (8)), + ("B", BYTE * (16)), + ]
    + +ARM64_NT_NEON128 = _ARM64_NT_NEON128 +PARM64_NT_NEON128 = POINTER(_ARM64_NT_NEON128) + +class _ANON__ANON__ARM64_NT_CONTEXT_SUB_UNION_1_SUB_STRUCTURE_1(Structure): + _fields_ = [ + ("X0", DWORD64), + ("X1", DWORD64), + ("X2", DWORD64), + ("X3", DWORD64), + ("X4", DWORD64), + ("X5", DWORD64), + ("X6", DWORD64), + ("X7", DWORD64), + ("X8", DWORD64), + ("X9", DWORD64), + ("X10", DWORD64), + ("X11", DWORD64), + ("X12", DWORD64), + ("X13", DWORD64), + ("X14", DWORD64), + ("X15", DWORD64), + ("X16", DWORD64), + ("X17", DWORD64), + ("X18", DWORD64), + ("X19", DWORD64), + ("X20", DWORD64), + ("X21", DWORD64), + ("X22", DWORD64), + ("X23", DWORD64), + ("X24", DWORD64), + ("X25", DWORD64), + ("X26", DWORD64), + ("X27", DWORD64), + ("X28", DWORD64), + ("Fp", DWORD64), + ("Lr", DWORD64), + ] + +class _ANON__ARM64_NT_CONTEXT_SUB_UNION_1(Union): + _anonymous_ = ("DUMMYSTRUCTNAME",) + _fields_ = [ + ("DUMMYSTRUCTNAME", _ANON__ANON__ARM64_NT_CONTEXT_SUB_UNION_1_SUB_STRUCTURE_1), + ("X", DWORD64 * (31)), + ] + +
    +[docs] +class _ARM64_NT_CONTEXT(Structure): + _anonymous_ = ("DUMMYUNIONNAME",) + _fields_ = [ + ("ContextFlags", DWORD), + ("Cpsr", DWORD), + ("DUMMYUNIONNAME", _ANON__ARM64_NT_CONTEXT_SUB_UNION_1), + ("Sp", DWORD64), + ("Pc", DWORD64), + ("V", ARM64_NT_NEON128 * (32)), + ("Fpcr", DWORD), + ("Fpsr", DWORD), + ("Bcr", DWORD * (ARM64_MAX_BREAKPOINTS)), + ("Bvr", DWORD64 * (ARM64_MAX_BREAKPOINTS)), + ("Wcr", DWORD * (ARM64_MAX_WATCHPOINTS)), + ("Wvr", DWORD64 * (ARM64_MAX_WATCHPOINTS)), + ]
    + +ARM64_NT_CONTEXT = _ARM64_NT_CONTEXT +PARM64_NT_CONTEXT = POINTER(_ARM64_NT_CONTEXT) + +
    +[docs] +class _FLOATING_SAVE_AREA(Structure): + _fields_ = [ + ("ControlWord", DWORD), + ("StatusWord", DWORD), + ("TagWord", DWORD), + ("ErrorOffset", DWORD), + ("ErrorSelector", DWORD), + ("DataOffset", DWORD), + ("DataSelector", DWORD), + ("RegisterArea", BYTE * (80)), + ("Cr0NpxState", DWORD), + ]
    + +FLOATING_SAVE_AREA = _FLOATING_SAVE_AREA + +
    +[docs] +class _CONTEXT32(Structure): + _fields_ = [ + ("ContextFlags", DWORD), + ("Dr0", DWORD), + ("Dr1", DWORD), + ("Dr2", DWORD), + ("Dr3", DWORD), + ("Dr6", DWORD), + ("Dr7", DWORD), + ("FloatSave", FLOATING_SAVE_AREA), + ("SegGs", DWORD), + ("SegFs", DWORD), + ("SegEs", DWORD), + ("SegDs", DWORD), + ("Edi", DWORD), + ("Esi", DWORD), + ("Ebx", DWORD), + ("Edx", DWORD), + ("Ecx", DWORD), + ("Eax", DWORD), + ("Ebp", DWORD), + ("Eip", DWORD), + ("SegCs", DWORD), + ("EFlags", DWORD), + ("Esp", DWORD), + ("SegSs", DWORD), + ("ExtendedRegisters", BYTE * (512)), + ]
    + +CONTEXT32 = _CONTEXT32 +LPCONTEXT32 = POINTER(_CONTEXT32) +PCONTEXT32 = POINTER(_CONTEXT32) + +
    +[docs] +class _WOW64_FLOATING_SAVE_AREA(Structure): + _fields_ = [ + ("ControlWord", DWORD), + ("StatusWord", DWORD), + ("TagWord", DWORD), + ("ErrorOffset", DWORD), + ("ErrorSelector", DWORD), + ("DataOffset", DWORD), + ("DataSelector", DWORD), + ("RegisterArea", BYTE * (WOW64_SIZE_OF_80387_REGISTERS)), + ("Cr0NpxState", DWORD), + ]
    + +WOW64_FLOATING_SAVE_AREA = _WOW64_FLOATING_SAVE_AREA + +
    +[docs] +class _WOW64_CONTEXT(Structure): + _fields_ = [ + ("ContextFlags", DWORD), + ("Dr0", DWORD), + ("Dr1", DWORD), + ("Dr2", DWORD), + ("Dr3", DWORD), + ("Dr6", DWORD), + ("Dr7", DWORD), + ("FloatSave", WOW64_FLOATING_SAVE_AREA), + ("SegGs", DWORD), + ("SegFs", DWORD), + ("SegEs", DWORD), + ("SegDs", DWORD), + ("Edi", DWORD), + ("Esi", DWORD), + ("Ebx", DWORD), + ("Edx", DWORD), + ("Ecx", DWORD), + ("Eax", DWORD), + ("Ebp", DWORD), + ("Eip", DWORD), + ("SegCs", DWORD), + ("EFlags", DWORD), + ("Esp", DWORD), + ("SegSs", DWORD), + ("ExtendedRegisters", BYTE * (WOW64_MAXIMUM_SUPPORTED_EXTENSION)), + ]
    + +PWOW64_CONTEXT = POINTER(_WOW64_CONTEXT) +WOW64_CONTEXT = _WOW64_CONTEXT + +
    +[docs] +class _M128A(Structure): + _fields_ = [ + ("Low", ULONGLONG), + ("High", LONGLONG), + ]
    + +M128A = _M128A +PM128A = POINTER(_M128A) + +
    +[docs] +class _XSAVE_FORMAT_64(Structure): + _fields_ = [ + ("ControlWord", WORD), + ("StatusWord", WORD), + ("TagWord", BYTE), + ("Reserved1", BYTE), + ("ErrorOpcode", WORD), + ("ErrorOffset", DWORD), + ("ErrorSelector", WORD), + ("Reserved2", WORD), + ("DataOffset", DWORD), + ("DataSelector", WORD), + ("Reserved3", WORD), + ("MxCsr", DWORD), + ("MxCsr_Mask", DWORD), + ("FloatRegisters", M128A * (8)), + ("XmmRegisters", M128A * (16)), + ("Reserved4", BYTE * (96)), + ]
    + +PXSAVE_FORMAT_64 = POINTER(_XSAVE_FORMAT_64) +XSAVE_FORMAT_64 = _XSAVE_FORMAT_64 + +
    +[docs] +class _XSAVE_FORMAT_32(Structure): + _fields_ = [ + ("ControlWord", WORD), + ("StatusWord", WORD), + ("TagWord", BYTE), + ("Reserved1", BYTE), + ("ErrorOpcode", WORD), + ("ErrorOffset", DWORD), + ("ErrorSelector", WORD), + ("Reserved2", WORD), + ("DataOffset", DWORD), + ("DataSelector", WORD), + ("Reserved3", WORD), + ("MxCsr", DWORD), + ("MxCsr_Mask", DWORD), + ("FloatRegisters", M128A * (8)), + ("XmmRegisters", M128A * (8)), + ("Reserved4", BYTE * (192)), + ("StackControl", DWORD * (7)), + ("Cr0NpxState", DWORD), + ]
    + +PXSAVE_FORMAT_32 = POINTER(_XSAVE_FORMAT_32) +XSAVE_FORMAT_32 = _XSAVE_FORMAT_32 + +class _ANON__ANON__CONTEXT64_SUB_UNION_1_SUB_STRUCTURE_1(Structure): + _fields_ = [ + ("Header", M128A * (2)), + ("Legacy", M128A * (8)), + ("Xmm0", M128A), + ("Xmm1", M128A), + ("Xmm2", M128A), + ("Xmm3", M128A), + ("Xmm4", M128A), + ("Xmm5", M128A), + ("Xmm6", M128A), + ("Xmm7", M128A), + ("Xmm8", M128A), + ("Xmm9", M128A), + ("Xmm10", M128A), + ("Xmm11", M128A), + ("Xmm12", M128A), + ("Xmm13", M128A), + ("Xmm14", M128A), + ("Xmm15", M128A), + ] + +class _ANON__CONTEXT64_SUB_UNION_1(Union): + _anonymous_ = ("DUMMYSTRUCTNAME",) + _fields_ = [ + ("FltSave", XSAVE_FORMAT_64), + ("DUMMYSTRUCTNAME", _ANON__ANON__CONTEXT64_SUB_UNION_1_SUB_STRUCTURE_1), + ] + +
    +[docs] +class _CONTEXT64(Structure): + _anonymous_ = ("DUMMYUNIONNAME",) + _fields_ = [ + ("P1Home", DWORD64), + ("P2Home", DWORD64), + ("P3Home", DWORD64), + ("P4Home", DWORD64), + ("P5Home", DWORD64), + ("P6Home", DWORD64), + ("ContextFlags", DWORD), + ("MxCsr", DWORD), + ("SegCs", WORD), + ("SegDs", WORD), + ("SegEs", WORD), + ("SegFs", WORD), + ("SegGs", WORD), + ("SegSs", WORD), + ("EFlags", DWORD), + ("Dr0", DWORD64), + ("Dr1", DWORD64), + ("Dr2", DWORD64), + ("Dr3", DWORD64), + ("Dr6", DWORD64), + ("Dr7", DWORD64), + ("Rax", DWORD64), + ("Rcx", DWORD64), + ("Rdx", DWORD64), + ("Rbx", DWORD64), + ("Rsp", DWORD64), + ("Rbp", DWORD64), + ("Rsi", DWORD64), + ("Rdi", DWORD64), + ("R8", DWORD64), + ("R9", DWORD64), + ("R10", DWORD64), + ("R11", DWORD64), + ("R12", DWORD64), + ("R13", DWORD64), + ("R14", DWORD64), + ("R15", DWORD64), + ("Rip", DWORD64), + ("DUMMYUNIONNAME", _ANON__CONTEXT64_SUB_UNION_1), + ("VectorRegister", M128A * (26)), + ("VectorControl", DWORD64), + ("DebugControl", DWORD64), + ("LastBranchToRip", DWORD64), + ("LastBranchFromRip", DWORD64), + ("LastExceptionToRip", DWORD64), + ("LastExceptionFromRip", DWORD64), + ]
    + +CONTEXT64 = _CONTEXT64 +LPCONTEXT64 = POINTER(_CONTEXT64) +PCONTEXT64 = POINTER(_CONTEXT64) +
    [docs] class _TRACE_PROVIDER_INFO(Structure): @@ -5941,132 +7131,6 @@ SECTION_INHERIT = _SECTION_INHERIT -ProcessBasicInformation = EnumValue("_PROCESSINFOCLASS", "ProcessBasicInformation", 0x0) -ProcessQuotaLimits = EnumValue("_PROCESSINFOCLASS", "ProcessQuotaLimits", 0x1) -ProcessIoCounters = EnumValue("_PROCESSINFOCLASS", "ProcessIoCounters", 0x2) -ProcessVmCounters = EnumValue("_PROCESSINFOCLASS", "ProcessVmCounters", 0x3) -ProcessTimes = EnumValue("_PROCESSINFOCLASS", "ProcessTimes", 0x4) -ProcessBasePriority = EnumValue("_PROCESSINFOCLASS", "ProcessBasePriority", 0x5) -ProcessRaisePriority = EnumValue("_PROCESSINFOCLASS", "ProcessRaisePriority", 0x6) -ProcessDebugPort = EnumValue("_PROCESSINFOCLASS", "ProcessDebugPort", 0x7) -ProcessExceptionPort = EnumValue("_PROCESSINFOCLASS", "ProcessExceptionPort", 0x8) -ProcessAccessToken = EnumValue("_PROCESSINFOCLASS", "ProcessAccessToken", 0x9) -ProcessLdtInformation = EnumValue("_PROCESSINFOCLASS", "ProcessLdtInformation", 0xa) -ProcessLdtSize = EnumValue("_PROCESSINFOCLASS", "ProcessLdtSize", 0xb) -ProcessDefaultHardErrorMode = EnumValue("_PROCESSINFOCLASS", "ProcessDefaultHardErrorMode", 0xc) -ProcessIoPortHandlers = EnumValue("_PROCESSINFOCLASS", "ProcessIoPortHandlers", 0xd) -ProcessPooledUsageAndLimits = EnumValue("_PROCESSINFOCLASS", "ProcessPooledUsageAndLimits", 0xe) -ProcessWorkingSetWatch = EnumValue("_PROCESSINFOCLASS", "ProcessWorkingSetWatch", 0xf) -ProcessUserModeIOPL = EnumValue("_PROCESSINFOCLASS", "ProcessUserModeIOPL", 0x10) -ProcessEnableAlignmentFaultFixup = EnumValue("_PROCESSINFOCLASS", "ProcessEnableAlignmentFaultFixup", 0x11) -ProcessPriorityClass = EnumValue("_PROCESSINFOCLASS", "ProcessPriorityClass", 0x12) -ProcessWx86Information = EnumValue("_PROCESSINFOCLASS", "ProcessWx86Information", 0x13) -ProcessHandleCount = EnumValue("_PROCESSINFOCLASS", "ProcessHandleCount", 0x14) -ProcessAffinityMask = EnumValue("_PROCESSINFOCLASS", "ProcessAffinityMask", 0x15) -ProcessPriorityBoost = EnumValue("_PROCESSINFOCLASS", "ProcessPriorityBoost", 0x16) -ProcessDeviceMap = EnumValue("_PROCESSINFOCLASS", "ProcessDeviceMap", 0x17) -ProcessSessionInformation = EnumValue("_PROCESSINFOCLASS", "ProcessSessionInformation", 0x18) -ProcessForegroundInformation = EnumValue("_PROCESSINFOCLASS", "ProcessForegroundInformation", 0x19) -ProcessWow64Information = EnumValue("_PROCESSINFOCLASS", "ProcessWow64Information", 0x1a) -ProcessImageFileName = EnumValue("_PROCESSINFOCLASS", "ProcessImageFileName", 0x1b) -ProcessLUIDDeviceMapsEnabled = EnumValue("_PROCESSINFOCLASS", "ProcessLUIDDeviceMapsEnabled", 0x1c) -ProcessBreakOnTermination = EnumValue("_PROCESSINFOCLASS", "ProcessBreakOnTermination", 0x1d) -ProcessDebugObjectHandle = EnumValue("_PROCESSINFOCLASS", "ProcessDebugObjectHandle", 0x1e) -ProcessDebugFlags = EnumValue("_PROCESSINFOCLASS", "ProcessDebugFlags", 0x1f) -ProcessHandleTracing = EnumValue("_PROCESSINFOCLASS", "ProcessHandleTracing", 0x20) -ProcessIoPriority = EnumValue("_PROCESSINFOCLASS", "ProcessIoPriority", 0x21) -ProcessExecuteFlags = EnumValue("_PROCESSINFOCLASS", "ProcessExecuteFlags", 0x22) -ProcessTlsInformation = EnumValue("_PROCESSINFOCLASS", "ProcessTlsInformation", 0x23) -ProcessCookie = EnumValue("_PROCESSINFOCLASS", "ProcessCookie", 0x24) -ProcessImageInformation = EnumValue("_PROCESSINFOCLASS", "ProcessImageInformation", 0x25) -ProcessCycleTime = EnumValue("_PROCESSINFOCLASS", "ProcessCycleTime", 0x26) -ProcessPagePriority = EnumValue("_PROCESSINFOCLASS", "ProcessPagePriority", 0x27) -ProcessInstrumentationCallback = EnumValue("_PROCESSINFOCLASS", "ProcessInstrumentationCallback", 0x28) -ProcessThreadStackAllocation = EnumValue("_PROCESSINFOCLASS", "ProcessThreadStackAllocation", 0x29) -ProcessWorkingSetWatchEx = EnumValue("_PROCESSINFOCLASS", "ProcessWorkingSetWatchEx", 0x2a) -ProcessImageFileNameWin32 = EnumValue("_PROCESSINFOCLASS", "ProcessImageFileNameWin32", 0x2b) -ProcessImageFileMapping = EnumValue("_PROCESSINFOCLASS", "ProcessImageFileMapping", 0x2c) -ProcessAffinityUpdateMode = EnumValue("_PROCESSINFOCLASS", "ProcessAffinityUpdateMode", 0x2d) -ProcessMemoryAllocationMode = EnumValue("_PROCESSINFOCLASS", "ProcessMemoryAllocationMode", 0x2e) -ProcessGroupInformation = EnumValue("_PROCESSINFOCLASS", "ProcessGroupInformation", 0x2f) -ProcessTokenVirtualizationEnabled = EnumValue("_PROCESSINFOCLASS", "ProcessTokenVirtualizationEnabled", 0x30) -ProcessOwnerInformation = EnumValue("_PROCESSINFOCLASS", "ProcessOwnerInformation", 0x31) -ProcessWindowInformation = EnumValue("_PROCESSINFOCLASS", "ProcessWindowInformation", 0x32) -ProcessHandleInformation = EnumValue("_PROCESSINFOCLASS", "ProcessHandleInformation", 0x33) -ProcessMitigationPolicy = EnumValue("_PROCESSINFOCLASS", "ProcessMitigationPolicy", 0x34) -ProcessDynamicFunctionTableInformation = EnumValue("_PROCESSINFOCLASS", "ProcessDynamicFunctionTableInformation", 0x35) -ProcessHandleCheckingMode = EnumValue("_PROCESSINFOCLASS", "ProcessHandleCheckingMode", 0x36) -ProcessKeepAliveCount = EnumValue("_PROCESSINFOCLASS", "ProcessKeepAliveCount", 0x37) -ProcessRevokeFileHandles = EnumValue("_PROCESSINFOCLASS", "ProcessRevokeFileHandles", 0x38) -ProcessWorkingSetControl = EnumValue("_PROCESSINFOCLASS", "ProcessWorkingSetControl", 0x39) -ProcessHandleTable = EnumValue("_PROCESSINFOCLASS", "ProcessHandleTable", 0x3a) -ProcessCheckStackExtentsMode = EnumValue("_PROCESSINFOCLASS", "ProcessCheckStackExtentsMode", 0x3b) -ProcessCommandLineInformation = EnumValue("_PROCESSINFOCLASS", "ProcessCommandLineInformation", 0x3c) -ProcessProtectionInformation = EnumValue("_PROCESSINFOCLASS", "ProcessProtectionInformation", 0x3d) -ProcessMemoryExhaustion = EnumValue("_PROCESSINFOCLASS", "ProcessMemoryExhaustion", 0x3e) -ProcessFaultInformation = EnumValue("_PROCESSINFOCLASS", "ProcessFaultInformation", 0x3f) -ProcessTelemetryIdInformation = EnumValue("_PROCESSINFOCLASS", "ProcessTelemetryIdInformation", 0x40) -ProcessCommitReleaseInformation = EnumValue("_PROCESSINFOCLASS", "ProcessCommitReleaseInformation", 0x41) -ProcessReserved1Information = EnumValue("_PROCESSINFOCLASS", "ProcessReserved1Information", 0x42) -ProcessReserved2Information = EnumValue("_PROCESSINFOCLASS", "ProcessReserved2Information", 0x43) -ProcessSubsystemProcess = EnumValue("_PROCESSINFOCLASS", "ProcessSubsystemProcess", 0x44) -ProcessInPrivate = EnumValue("_PROCESSINFOCLASS", "ProcessInPrivate", 0x46) -ProcessRaiseUMExceptionOnInvalidHandleClose = EnumValue("_PROCESSINFOCLASS", "ProcessRaiseUMExceptionOnInvalidHandleClose", 0x47) -ProcessSubsystemInformation = EnumValue("_PROCESSINFOCLASS", "ProcessSubsystemInformation", 0x4b) -ProcessWin32kSyscallFilterInformation = EnumValue("_PROCESSINFOCLASS", "ProcessWin32kSyscallFilterInformation", 0x4f) -ProcessEnergyTrackingState = EnumValue("_PROCESSINFOCLASS", "ProcessEnergyTrackingState", 0x52) -MaxProcessInfoClass = EnumValue("_PROCESSINFOCLASS", "MaxProcessInfoClass", 0x53) -
    -[docs] -class _PROCESSINFOCLASS(EnumType): - values = [ProcessBasicInformation, ProcessQuotaLimits, ProcessIoCounters, ProcessVmCounters, ProcessTimes, ProcessBasePriority, ProcessRaisePriority, ProcessDebugPort, ProcessExceptionPort, ProcessAccessToken, ProcessLdtInformation, ProcessLdtSize, ProcessDefaultHardErrorMode, ProcessIoPortHandlers, ProcessPooledUsageAndLimits, ProcessWorkingSetWatch, ProcessUserModeIOPL, ProcessEnableAlignmentFaultFixup, ProcessPriorityClass, ProcessWx86Information, ProcessHandleCount, ProcessAffinityMask, ProcessPriorityBoost, ProcessDeviceMap, ProcessSessionInformation, ProcessForegroundInformation, ProcessWow64Information, ProcessImageFileName, ProcessLUIDDeviceMapsEnabled, ProcessBreakOnTermination, ProcessDebugObjectHandle, ProcessDebugFlags, ProcessHandleTracing, ProcessIoPriority, ProcessExecuteFlags, ProcessTlsInformation, ProcessCookie, ProcessImageInformation, ProcessCycleTime, ProcessPagePriority, ProcessInstrumentationCallback, ProcessThreadStackAllocation, ProcessWorkingSetWatchEx, ProcessImageFileNameWin32, ProcessImageFileMapping, ProcessAffinityUpdateMode, ProcessMemoryAllocationMode, ProcessGroupInformation, ProcessTokenVirtualizationEnabled, ProcessOwnerInformation, ProcessWindowInformation, ProcessHandleInformation, ProcessMitigationPolicy, ProcessDynamicFunctionTableInformation, ProcessHandleCheckingMode, ProcessKeepAliveCount, ProcessRevokeFileHandles, ProcessWorkingSetControl, ProcessHandleTable, ProcessCheckStackExtentsMode, ProcessCommandLineInformation, ProcessProtectionInformation, ProcessMemoryExhaustion, ProcessFaultInformation, ProcessTelemetryIdInformation, ProcessCommitReleaseInformation, ProcessReserved1Information, ProcessReserved2Information, ProcessSubsystemProcess, ProcessInPrivate, ProcessRaiseUMExceptionOnInvalidHandleClose, ProcessSubsystemInformation, ProcessWin32kSyscallFilterInformation, ProcessEnergyTrackingState, MaxProcessInfoClass] - mapper = FlagMapper(*values)
    - -PROCESSINFOCLASS = _PROCESSINFOCLASS - - -MemoryBasicInformation = EnumValue("_MEMORY_INFORMATION_CLASS", "MemoryBasicInformation", 0x0) -MemoryWorkingSetList = EnumValue("_MEMORY_INFORMATION_CLASS", "MemoryWorkingSetList", 0x1) -MemorySectionName = EnumValue("_MEMORY_INFORMATION_CLASS", "MemorySectionName", 0x2) -MemoryBasicVlmInformation = EnumValue("_MEMORY_INFORMATION_CLASS", "MemoryBasicVlmInformation", 0x3) -MemoryWorkingSetListEx = EnumValue("_MEMORY_INFORMATION_CLASS", "MemoryWorkingSetListEx", 0x4) -
    -[docs] -class _MEMORY_INFORMATION_CLASS(EnumType): - values = [MemoryBasicInformation, MemoryWorkingSetList, MemorySectionName, MemoryBasicVlmInformation, MemoryWorkingSetListEx] - mapper = FlagMapper(*values)
    - -MEMORY_INFORMATION_CLASS = _MEMORY_INFORMATION_CLASS - - -ThreadBasicInformation = EnumValue("_THREAD_INFORMATION_CLASS", "ThreadBasicInformation", 0x0) -ThreadTimes = EnumValue("_THREAD_INFORMATION_CLASS", "ThreadTimes", 0x1) -ThreadPriority = EnumValue("_THREAD_INFORMATION_CLASS", "ThreadPriority", 0x2) -ThreadBasePriority = EnumValue("_THREAD_INFORMATION_CLASS", "ThreadBasePriority", 0x3) -ThreadAffinityMask = EnumValue("_THREAD_INFORMATION_CLASS", "ThreadAffinityMask", 0x4) -ThreadImpersonationToken = EnumValue("_THREAD_INFORMATION_CLASS", "ThreadImpersonationToken", 0x5) -ThreadDescriptorTableEntry = EnumValue("_THREAD_INFORMATION_CLASS", "ThreadDescriptorTableEntry", 0x6) -ThreadEnableAlignmentFaultFixup = EnumValue("_THREAD_INFORMATION_CLASS", "ThreadEnableAlignmentFaultFixup", 0x7) -ThreadEventPair = EnumValue("_THREAD_INFORMATION_CLASS", "ThreadEventPair", 0x8) -ThreadQuerySetWin32StartAddress = EnumValue("_THREAD_INFORMATION_CLASS", "ThreadQuerySetWin32StartAddress", 0x9) -ThreadZeroTlsCell = EnumValue("_THREAD_INFORMATION_CLASS", "ThreadZeroTlsCell", 0xa) -ThreadPerformanceCount = EnumValue("_THREAD_INFORMATION_CLASS", "ThreadPerformanceCount", 0xb) -ThreadAmILastThread = EnumValue("_THREAD_INFORMATION_CLASS", "ThreadAmILastThread", 0xc) -ThreadIdealProcessor = EnumValue("_THREAD_INFORMATION_CLASS", "ThreadIdealProcessor", 0xd) -ThreadPriorityBoost = EnumValue("_THREAD_INFORMATION_CLASS", "ThreadPriorityBoost", 0xe) -ThreadSetTlsArrayAddress = EnumValue("_THREAD_INFORMATION_CLASS", "ThreadSetTlsArrayAddress", 0xf) -ThreadIsIoPending = EnumValue("_THREAD_INFORMATION_CLASS", "ThreadIsIoPending", 0x10) -ThreadHideFromDebugger = EnumValue("_THREAD_INFORMATION_CLASS", "ThreadHideFromDebugger", 0x11) -
    -[docs] -class _THREAD_INFORMATION_CLASS(EnumType): - values = [ThreadBasicInformation, ThreadTimes, ThreadPriority, ThreadBasePriority, ThreadAffinityMask, ThreadImpersonationToken, ThreadDescriptorTableEntry, ThreadEnableAlignmentFaultFixup, ThreadEventPair, ThreadQuerySetWin32StartAddress, ThreadZeroTlsCell, ThreadPerformanceCount, ThreadAmILastThread, ThreadIdealProcessor, ThreadPriorityBoost, ThreadSetTlsArrayAddress, ThreadIsIoPending, ThreadHideFromDebugger] - mapper = FlagMapper(*values)
    - -PTHREAD_INFORMATION_CLASS = POINTER(_THREAD_INFORMATION_CLASS) -THREAD_INFORMATION_CLASS = _THREAD_INFORMATION_CLASS - - VT_EMPTY = EnumValue("_VARENUM", "VT_EMPTY", 0x0) VT_NULL = EnumValue("_VARENUM", "VT_NULL", 0x1) VT_I2 = EnumValue("_VARENUM", "VT_I2", 0x2) @@ -6388,299 +7452,6 @@ PNT_PRODUCT_TYPE = POINTER(_NT_PRODUCT_TYPE) -# Self referencing struct tricks -
    -[docs] -class _LIST_ENTRY(Structure): pass
    - -LIST_ENTRY = _LIST_ENTRY -PLIST_ENTRY = POINTER(_LIST_ENTRY) -PRLIST_ENTRY = POINTER(_LIST_ENTRY) -_LIST_ENTRY._fields_ = [ - ("Flink", POINTER(_LIST_ENTRY)), - ("Blink", POINTER(_LIST_ENTRY)), -] - -
    -[docs] -class _PEB_LDR_DATA(Structure): - _fields_ = [ - ("Reserved1", BYTE * (8)), - ("Reserved2", PVOID * (3)), - ("InMemoryOrderModuleList", LIST_ENTRY), - ]
    - -PEB_LDR_DATA = _PEB_LDR_DATA -PPEB_LDR_DATA = POINTER(_PEB_LDR_DATA) - -class _LSA_UNICODE_STRING(Structure): - _fields_ = [ - ("Length", USHORT), - ("MaximumLength", USHORT), - ("Buffer", PVOID), - ] -LSA_UNICODE_STRING = _LSA_UNICODE_STRING -PLSA_UNICODE_STRING = POINTER(_LSA_UNICODE_STRING) -PUNICODE_STRING = POINTER(_LSA_UNICODE_STRING) -UNICODE_STRING = _LSA_UNICODE_STRING - -INITIAL_LSA_UNICODE_STRING = _LSA_UNICODE_STRING - -
    -[docs] -class _LSA_UNICODE_STRING(INITIAL_LSA_UNICODE_STRING): - @property - def str(self): - """The python string of the LSA_UNICODE_STRING object - - :type: :class:`unicode` - """ - if not self.Length: - return "" - if getattr(self, "_target", None) is not None: #remote ctypes :D -> TRICKS OF THE YEAR - raw_data = self._target.read_memory(self.Buffer, self.Length) - return raw_data.decode("utf16") - size = int(self.Length / 2) - return (ctypes.c_wchar * size).from_address(self.Buffer)[:] - - @classmethod - def from_string(cls, s): - utf16_len = len(s) * 2 - return cls(utf16_len, utf16_len, ctypes.cast(PWSTR(s), PVOID)) - - @classmethod - def from_size(cls, size): - buffer = ctypes.create_string_buffer(size) - return cls(size, size, ctypes.cast(buffer, PVOID)) - - def __repr__(self): - return windows.pycompat.urepr_encode(u"""<{0} "{1}" at {2}>""".format(type(self).__name__, self.str, hex(id(self)))) - - def __sprint__(self): - try: - return self.__repr__() - except TypeError as e: - # Bad buffer: print raw infos - return """<{0} len={1} maxlen={2} buffer={3}>""".format(type(self).__name__, self.Length, self.MaximumLength, self.Buffer)
    - - -LSA_UNICODE_STRING = _LSA_UNICODE_STRING -PLSA_UNICODE_STRING = POINTER(_LSA_UNICODE_STRING) -PUNICODE_STRING = POINTER(_LSA_UNICODE_STRING) -UNICODE_STRING = _LSA_UNICODE_STRING -
    -[docs] -class _CURDIR(Structure): - _fields_ = [ - ("DosPath", UNICODE_STRING), - ("Handle", PVOID), - ]
    - -CURDIR = _CURDIR -PCURDIR = POINTER(_CURDIR) - -
    -[docs] -class _RTL_DRIVE_LETTER_CURDIR(Structure): - _fields_ = [ - ("Flags", WORD), - ("Length", WORD), - ("TimeStamp", ULONG), - ("DosPath", UNICODE_STRING), - ]
    - -PRTL_DRIVE_LETTER_CURDIR = POINTER(_RTL_DRIVE_LETTER_CURDIR) -RTL_DRIVE_LETTER_CURDIR = _RTL_DRIVE_LETTER_CURDIR - -
    -[docs] -class _RTL_USER_PROCESS_PARAMETERS(Structure): - _fields_ = [ - ("MaximumLength", ULONG), - ("Length", ULONG), - ("Flags", ULONG), - ("DebugFlags", ULONG), - ("ConsoleHandle", PVOID), - ("ConsoleFlags", ULONG), - ("StandardInput", PVOID), - ("StandardOutput", PVOID), - ("StandardError", PVOID), - ("CurrentDirectory", CURDIR), - ("DllPath", UNICODE_STRING), - ("ImagePathName", UNICODE_STRING), - ("CommandLine", UNICODE_STRING), - ("Environment", PVOID), - ("StartingX", ULONG), - ("StartingY", ULONG), - ("CountX", ULONG), - ("CountY", ULONG), - ("CountCharsX", ULONG), - ("CountCharsY", ULONG), - ("FillAttribute", ULONG), - ("WindowFlags", ULONG), - ("ShowWindowFlags", ULONG), - ("WindowTitle", UNICODE_STRING), - ("DesktopInfo", UNICODE_STRING), - ("ShellInfo", UNICODE_STRING), - ("RuntimeData", UNICODE_STRING), - ("CurrentDirectores", RTL_DRIVE_LETTER_CURDIR * (32)), - ]
    - -PRTL_USER_PROCESS_PARAMETERS = POINTER(_RTL_USER_PROCESS_PARAMETERS) -RTL_USER_PROCESS_PARAMETERS = _RTL_USER_PROCESS_PARAMETERS - -
    -[docs] -class _ANON_PEB_SYSTEM_DEPENDENT_02(Union): - _fields_ = [ - ("FastPebLockRoutine", PVOID), - ("SparePtr1", PVOID), - ("AtlThunkSListPtr", PVOID), - ]
    - - - -
    -[docs] -class _ANON_PEB_SYSTEM_DEPENDENT_03(Union): - _fields_ = [ - ("FastPebUnlockRoutine", PVOID), - ("SparePtr2", PVOID), - ("IFEOKey", PVOID), - ]
    - - - -
    -[docs] -class _ANON_PEB_SYSTEM_DEPENDENT_06(Union): - _fields_ = [ - ("FreeList", PVOID), - ("SparePebPtr0", PVOID), - ("ApiSetMap", PVOID), - ]
    - - - -
    -[docs] -class _ANON_PEB_SYSTEM_DEPENDENT_07(Union): - _fields_ = [ - ("ReadOnlySharedMemoryHeap", PVOID), - ("HotpatchInformation", PVOID), - ("SparePvoid0", PVOID), - ]
    - - - -
    -[docs] -class _ANON_PEB_UNION_1(Union): - _fields_ = [ - ("KernelCallbackTable", PVOID), - ("UserSharedInfoPtr", PVOID), - ]
    - - - -
    -[docs] -class _ANON_PEB_UNION_2(Union): - _fields_ = [ - ("ImageProcessAffinityMask", PVOID), - ("ActiveProcessAffinityMask", PVOID), - ]
    - - - -class _ANON__PEB_SUB_UNION_1(Union): - _fields_ = [ - ("KernelCallbackTable", PVOID), - ("UserSharedInfoPtr", PVOID), - ] - - -class _ANON__PEB_SUB_UNION_2(Union): - _fields_ = [ - ("ImageProcessAffinityMask", PVOID), - ("ActiveProcessAffinityMask", PVOID), - ] - -
    -[docs] -class _PEB(Structure): - _anonymous_ = ("_SYSTEM_DEPENDENT_02","_SYSTEM_DEPENDENT_03","anon_01","_SYSTEM_DEPENDENT_06","_SYSTEM_DEPENDENT_07","anon_02") - _fields_ = [ - ("Reserved1", BYTE * (2)), - ("BeingDebugged", BYTE), - ("Reserved2", BYTE * (1)), - ("Mutant", PVOID), - ("ImageBaseAddress", PVOID), - ("Ldr", PPEB_LDR_DATA), - ("ProcessParameters", PRTL_USER_PROCESS_PARAMETERS), - ("SubSystemData", PVOID), - ("ProcessHeap", PVOID), - ("FastPebLock", PVOID), - ("_SYSTEM_DEPENDENT_02", _ANON_PEB_SYSTEM_DEPENDENT_02), - ("_SYSTEM_DEPENDENT_03", _ANON_PEB_SYSTEM_DEPENDENT_03), - ("_SYSTEM_DEPENDENT_04", PVOID), - ("anon_01", _ANON__PEB_SUB_UNION_1), - ("SystemReserved", DWORD), - ("_SYSTEM_DEPENDENT_05", DWORD), - ("_SYSTEM_DEPENDENT_06", _ANON_PEB_SYSTEM_DEPENDENT_06), - ("TlsExpansionCounter", PVOID), - ("TlsBitmap", PVOID), - ("TlsBitmapBits", DWORD * (2)), - ("ReadOnlySharedMemoryBase", PVOID), - ("_SYSTEM_DEPENDENT_07", _ANON_PEB_SYSTEM_DEPENDENT_07), - ("ReadOnlyStaticServerData", PVOID), - ("AnsiCodePageData", PVOID), - ("OemCodePageData", PVOID), - ("UnicodeCaseTableData", PVOID), - ("NumberOfProcessors", DWORD), - ("NtGlobalFlag", DWORD), - ("CriticalSectionTimeout", LARGE_INTEGER), - ("HeapSegmentReserve", PVOID), - ("HeapSegmentCommit", PVOID), - ("HeapDeCommitTotalFreeThreshold", PVOID), - ("HeapDeCommitFreeBlockThreshold", PVOID), - ("NumberOfHeaps", DWORD), - ("MaximumNumberOfHeaps", DWORD), - ("ProcessHeaps", PVOID), - ("GdiSharedHandleTable", PVOID), - ("ProcessStarterHelper", PVOID), - ("GdiDCAttributeList", PVOID), - ("LoaderLock", PVOID), - ("OSMajorVersion", DWORD), - ("OSMinorVersion", DWORD), - ("OSBuildNumber", WORD), - ("OSCSDVersion", WORD), - ("OSPlatformId", DWORD), - ("ImageSubsystem", DWORD), - ("ImageSubsystemMajorVersion", DWORD), - ("ImageSubsystemMinorVersion", PVOID), - ("anon_02", _ANON__PEB_SUB_UNION_2), - ("GdiHandleBuffer", PVOID * (26)), - ("GdiHandleBuffer2", BYTE * (32)), - ("PostProcessInitRoutine", PVOID), - ("TlsExpansionBitmap", PVOID), - ("TlsExpansionBitmapBits", DWORD * (32)), - ("SessionId", PVOID), - ("AppCompatFlags", ULARGE_INTEGER), - ("AppCompatFlagsUser", ULARGE_INTEGER), - ("pShimData", PVOID), - ("AppCompatInfo", PVOID), - ("CSDVersion", UNICODE_STRING), - ("ActivationContextData", PVOID), - ("ProcessAssemblyStorageMap", PVOID), - ("SystemDefaultActivationContextData", PVOID), - ("SystemAssemblyStorageMap", PVOID), - ("MinimumStackCommit", PVOID), - ]
    - -PEB = _PEB -PPEB = POINTER(_PEB) -
    [docs] class _SECURITY_ATTRIBUTES(Structure): @@ -6739,59 +7510,6 @@ PSYSTEM_PROCESS_ID_INFORMATION = POINTER(_SYSTEM_PROCESS_ID_INFORMATION) SYSTEM_PROCESS_ID_INFORMATION = _SYSTEM_PROCESS_ID_INFORMATION -
    -[docs] -class _CLIENT_ID(Structure): - _fields_ = [ - ("UniqueProcess", HANDLE), - ("UniqueThread", HANDLE), - ]
    - -CLIENT_ID = _CLIENT_ID -PCLIENT_ID = POINTER(_CLIENT_ID) - -
    -[docs] -class _CLIENT_ID64(Structure): - _fields_ = [ - ("UniqueProcess", ULONG64), - ("UniqueThread", ULONG64), - ]
    - -CLIENT_ID64 = _CLIENT_ID64 -PCLIENT_ID64 = POINTER(_CLIENT_ID64) - -
    -[docs] -class _CLIENT_ID32(Structure): - _fields_ = [ - ("UniqueProcess", ULONG), - ("UniqueThread", ULONG), - ]
    - -CLIENT_ID32 = _CLIENT_ID32 -PCLIENT_ID32 = POINTER(_CLIENT_ID32) - -
    -[docs] -class _LDR_DATA_TABLE_ENTRY(Structure): - _fields_ = [ - ("Reserved1", PVOID * (2)), - ("InMemoryOrderLinks", LIST_ENTRY), - ("Reserved2", PVOID * (2)), - ("DllBase", PVOID), - ("EntryPoint", PVOID), - ("SizeOfImage", PVOID), - ("FullDllName", UNICODE_STRING), - ("BaseDllName", UNICODE_STRING), - ("Reserved5", PVOID * (3)), - ("CheckSum", ULONG), - ("TimeDateStamp", ULONG), - ]
    - -LDR_DATA_TABLE_ENTRY = _LDR_DATA_TABLE_ENTRY -PLDR_DATA_TABLE_ENTRY = POINTER(_LDR_DATA_TABLE_ENTRY) -
    [docs] class _MEMORY_BASIC_INFORMATION(Structure): @@ -7151,264 +7869,6 @@ PPROCESS_INFORMATION = POINTER(_PROCESS_INFORMATION) PROCESS_INFORMATION = _PROCESS_INFORMATION -
    -[docs] -class _FLOATING_SAVE_AREA(Structure): - _fields_ = [ - ("ControlWord", DWORD), - ("StatusWord", DWORD), - ("TagWord", DWORD), - ("ErrorOffset", DWORD), - ("ErrorSelector", DWORD), - ("DataOffset", DWORD), - ("DataSelector", DWORD), - ("RegisterArea", BYTE * (80)), - ("Cr0NpxState", DWORD), - ]
    - -FLOATING_SAVE_AREA = _FLOATING_SAVE_AREA - -
    -[docs] -class _CONTEXT32(Structure): - _fields_ = [ - ("ContextFlags", DWORD), - ("Dr0", DWORD), - ("Dr1", DWORD), - ("Dr2", DWORD), - ("Dr3", DWORD), - ("Dr6", DWORD), - ("Dr7", DWORD), - ("FloatSave", FLOATING_SAVE_AREA), - ("SegGs", DWORD), - ("SegFs", DWORD), - ("SegEs", DWORD), - ("SegDs", DWORD), - ("Edi", DWORD), - ("Esi", DWORD), - ("Ebx", DWORD), - ("Edx", DWORD), - ("Ecx", DWORD), - ("Eax", DWORD), - ("Ebp", DWORD), - ("Eip", DWORD), - ("SegCs", DWORD), - ("EFlags", DWORD), - ("Esp", DWORD), - ("SegSs", DWORD), - ("ExtendedRegisters", BYTE * (512)), - ]
    - -CONTEXT32 = _CONTEXT32 -LPCONTEXT32 = POINTER(_CONTEXT32) -PCONTEXT32 = POINTER(_CONTEXT32) - -
    -[docs] -class _WOW64_FLOATING_SAVE_AREA(Structure): - _fields_ = [ - ("ControlWord", DWORD), - ("StatusWord", DWORD), - ("TagWord", DWORD), - ("ErrorOffset", DWORD), - ("ErrorSelector", DWORD), - ("DataOffset", DWORD), - ("DataSelector", DWORD), - ("RegisterArea", BYTE * (WOW64_SIZE_OF_80387_REGISTERS)), - ("Cr0NpxState", DWORD), - ]
    - -WOW64_FLOATING_SAVE_AREA = _WOW64_FLOATING_SAVE_AREA - -
    -[docs] -class _WOW64_CONTEXT(Structure): - _fields_ = [ - ("ContextFlags", DWORD), - ("Dr0", DWORD), - ("Dr1", DWORD), - ("Dr2", DWORD), - ("Dr3", DWORD), - ("Dr6", DWORD), - ("Dr7", DWORD), - ("FloatSave", WOW64_FLOATING_SAVE_AREA), - ("SegGs", DWORD), - ("SegFs", DWORD), - ("SegEs", DWORD), - ("SegDs", DWORD), - ("Edi", DWORD), - ("Esi", DWORD), - ("Ebx", DWORD), - ("Edx", DWORD), - ("Ecx", DWORD), - ("Eax", DWORD), - ("Ebp", DWORD), - ("Eip", DWORD), - ("SegCs", DWORD), - ("EFlags", DWORD), - ("Esp", DWORD), - ("SegSs", DWORD), - ("ExtendedRegisters", BYTE * (WOW64_MAXIMUM_SUPPORTED_EXTENSION)), - ]
    - -PWOW64_CONTEXT = POINTER(_WOW64_CONTEXT) -WOW64_CONTEXT = _WOW64_CONTEXT - -
    -[docs] -class _M128A(Structure): - _fields_ = [ - ("Low", ULONGLONG), - ("High", LONGLONG), - ]
    - -M128A = _M128A -PM128A = POINTER(_M128A) - -
    -[docs] -class _XSAVE_FORMAT_64(Structure): - _fields_ = [ - ("ControlWord", WORD), - ("StatusWord", WORD), - ("TagWord", BYTE), - ("Reserved1", BYTE), - ("ErrorOpcode", WORD), - ("ErrorOffset", DWORD), - ("ErrorSelector", WORD), - ("Reserved2", WORD), - ("DataOffset", DWORD), - ("DataSelector", WORD), - ("Reserved3", WORD), - ("MxCsr", DWORD), - ("MxCsr_Mask", DWORD), - ("FloatRegisters", M128A * (8)), - ("XmmRegisters", M128A * (16)), - ("Reserved4", BYTE * (96)), - ]
    - -PXSAVE_FORMAT_64 = POINTER(_XSAVE_FORMAT_64) -XSAVE_FORMAT_64 = _XSAVE_FORMAT_64 - -
    -[docs] -class _XSAVE_FORMAT_32(Structure): - _fields_ = [ - ("ControlWord", WORD), - ("StatusWord", WORD), - ("TagWord", BYTE), - ("Reserved1", BYTE), - ("ErrorOpcode", WORD), - ("ErrorOffset", DWORD), - ("ErrorSelector", WORD), - ("Reserved2", WORD), - ("DataOffset", DWORD), - ("DataSelector", WORD), - ("Reserved3", WORD), - ("MxCsr", DWORD), - ("MxCsr_Mask", DWORD), - ("FloatRegisters", M128A * (8)), - ("XmmRegisters", M128A * (8)), - ("Reserved4", BYTE * (192)), - ("StackControl", DWORD * (7)), - ("Cr0NpxState", DWORD), - ]
    - -PXSAVE_FORMAT_32 = POINTER(_XSAVE_FORMAT_32) -XSAVE_FORMAT_32 = _XSAVE_FORMAT_32 - -
    -[docs] -class _TMP_DUMMYSTRUCTNAME(Structure): - _fields_ = [ - ("Header", M128A * (2)), - ("Legacy", M128A * (8)), - ("Xmm0", M128A), - ("Xmm1", M128A), - ("Xmm2", M128A), - ("Xmm3", M128A), - ("Xmm4", M128A), - ("Xmm5", M128A), - ("Xmm6", M128A), - ("Xmm7", M128A), - ("Xmm8", M128A), - ("Xmm9", M128A), - ("Xmm10", M128A), - ("Xmm11", M128A), - ("Xmm12", M128A), - ("Xmm13", M128A), - ("Xmm14", M128A), - ("Xmm15", M128A), - ]
    - -TMP_DUMMYSTRUCTNAME = _TMP_DUMMYSTRUCTNAME - -
    -[docs] -class _TMP_CONTEXT64_SUBUNION(Union): - _fields_ = [ - ("FltSave", XSAVE_FORMAT_64), - ("DUMMYSTRUCTNAME", TMP_DUMMYSTRUCTNAME), - ]
    - -TMP_CONTEXT64_SUBUNION = _TMP_CONTEXT64_SUBUNION - -
    -[docs] -class _CONTEXT64(Structure): - _fields_ = [ - ("P1Home", DWORD64), - ("P2Home", DWORD64), - ("P3Home", DWORD64), - ("P4Home", DWORD64), - ("P5Home", DWORD64), - ("P6Home", DWORD64), - ("ContextFlags", DWORD), - ("MxCsr", DWORD), - ("SegCs", WORD), - ("SegDs", WORD), - ("SegEs", WORD), - ("SegFs", WORD), - ("SegGs", WORD), - ("SegSs", WORD), - ("EFlags", DWORD), - ("Dr0", DWORD64), - ("Dr1", DWORD64), - ("Dr2", DWORD64), - ("Dr3", DWORD64), - ("Dr6", DWORD64), - ("Dr7", DWORD64), - ("Rax", DWORD64), - ("Rcx", DWORD64), - ("Rdx", DWORD64), - ("Rbx", DWORD64), - ("Rsp", DWORD64), - ("Rbp", DWORD64), - ("Rsi", DWORD64), - ("Rdi", DWORD64), - ("R8", DWORD64), - ("R9", DWORD64), - ("R10", DWORD64), - ("R11", DWORD64), - ("R12", DWORD64), - ("R13", DWORD64), - ("R14", DWORD64), - ("R15", DWORD64), - ("Rip", DWORD64), - ("DUMMYUNIONNAME", TMP_CONTEXT64_SUBUNION), - ("VectorRegister", M128A * (26)), - ("VectorControl", DWORD64), - ("DebugControl", DWORD64), - ("LastBranchToRip", DWORD64), - ("LastBranchFromRip", DWORD64), - ("LastExceptionToRip", DWORD64), - ("LastExceptionFromRip", DWORD64), - ]
    - -CONTEXT64 = _CONTEXT64 -LPCONTEXT64 = POINTER(_CONTEXT64) -PCONTEXT64 = POINTER(_CONTEXT64) -
    [docs] class tagPROCESSENTRY32W(Structure): @@ -7581,7 +8041,8 @@ # Self referencing struct tricks
    [docs] -class _EXCEPTION_RECORD(Structure): pass
    +class _EXCEPTION_RECORD(Structure): + pass
    EXCEPTION_RECORD = _EXCEPTION_RECORD PEXCEPTION_RECORD = POINTER(_EXCEPTION_RECORD) @@ -10361,7 +10822,8 @@ # Self referencing struct tricks
    [docs] -class _CERT_CHAIN_CONTEXT(Structure): pass
    +class _CERT_CHAIN_CONTEXT(Structure): + pass
    CERT_CHAIN_CONTEXT = _CERT_CHAIN_CONTEXT PCCERT_CHAIN_CONTEXT = POINTER(_CERT_CHAIN_CONTEXT) @@ -10754,6 +11216,20 @@ PSTRUCT_PLAINTEXTKEYBLOB = POINTER(_STRUCT_PLAINTEXTKEYBLOB) STRUCT_PLAINTEXTKEYBLOB = _STRUCT_PLAINTEXTKEYBLOB +
    +[docs] +class _CERT_REQUEST_INFO(Structure): + _fields_ = [ + ("dwVersion", DWORD), + ("Subject", CERT_NAME_BLOB), + ("SubjectPublicKeyInfo", CERT_PUBLIC_KEY_INFO), + ("cAttribute", DWORD), + ("rgAttribute", PCRYPT_ATTRIBUTE), + ]
    + +CERT_REQUEST_INFO = _CERT_REQUEST_INFO +PCERT_REQUEST_INFO = POINTER(_CERT_REQUEST_INFO) +
    [docs] class _EXCEPTION_DEBUG_INFO(Structure): @@ -13239,7 +13715,9 @@ # Self referencing struct tricks
    [docs] -class _TRUSTEE_A(Structure): pass
    +class _TRUSTEE_A(Structure): + _anonymous_ = ("anon_01",)
    + PTRUSTEEA = POINTER(_TRUSTEE_A) PTRUSTEE_A = POINTER(_TRUSTEE_A) @@ -13279,7 +13757,9 @@ # Self referencing struct tricks
    [docs] -class _TRUSTEE_W(Structure): pass
    +class _TRUSTEE_W(Structure): + _anonymous_ = ("anon_01",)
    + PTRUSTEEW = POINTER(_TRUSTEE_W) PTRUSTEE_W = POINTER(_TRUSTEE_W) @@ -13309,97 +13789,6 @@ PEXPLICIT_ACCESSW = POINTER(_EXPLICIT_ACCESS_W) PEXPLICIT_ACCESS_W = POINTER(_EXPLICIT_ACCESS_W) -ComputerNameNetBIOS = EnumValue("_COMPUTER_NAME_FORMAT", "ComputerNameNetBIOS", 0x0) -ComputerNameDnsHostname = EnumValue("_COMPUTER_NAME_FORMAT", "ComputerNameDnsHostname", 0x1) -ComputerNameDnsDomain = EnumValue("_COMPUTER_NAME_FORMAT", "ComputerNameDnsDomain", 0x2) -ComputerNameDnsFullyQualified = EnumValue("_COMPUTER_NAME_FORMAT", "ComputerNameDnsFullyQualified", 0x3) -ComputerNamePhysicalNetBIOS = EnumValue("_COMPUTER_NAME_FORMAT", "ComputerNamePhysicalNetBIOS", 0x4) -ComputerNamePhysicalDnsHostname = EnumValue("_COMPUTER_NAME_FORMAT", "ComputerNamePhysicalDnsHostname", 0x5) -ComputerNamePhysicalDnsDomain = EnumValue("_COMPUTER_NAME_FORMAT", "ComputerNamePhysicalDnsDomain", 0x6) -ComputerNamePhysicalDnsFullyQualified = EnumValue("_COMPUTER_NAME_FORMAT", "ComputerNamePhysicalDnsFullyQualified", 0x7) -ComputerNameMax = EnumValue("_COMPUTER_NAME_FORMAT", "ComputerNameMax", 0x8) -
    -[docs] -class _COMPUTER_NAME_FORMAT(EnumType): - values = [ComputerNameNetBIOS, ComputerNameDnsHostname, ComputerNameDnsDomain, ComputerNameDnsFullyQualified, ComputerNamePhysicalNetBIOS, ComputerNamePhysicalDnsHostname, ComputerNamePhysicalDnsDomain, ComputerNamePhysicalDnsFullyQualified, ComputerNameMax] - mapper = FlagMapper(*values)
    - -COMPUTER_NAME_FORMAT = _COMPUTER_NAME_FORMAT - - -
    -[docs] -class _SYSTEM_PROCESS_INFORMATION(Structure): - _fields_ = [ - ("NextEntryOffset", ULONG), - ("NumberOfThreads", ULONG), - ("Reserved1", BYTE * (24)), - ("CreateTime", LARGE_INTEGER), - ("UserTime", LARGE_INTEGER), - ("KernelTime", LARGE_INTEGER), - ("ImageName", UNICODE_STRING), - ("BasePriority", LONG), - ("UniqueProcessId", HANDLE), - ("InheritedFromUniqueProcessId", PVOID), - ("HandleCount", ULONG), - ("Reserved4", BYTE * (4)), - ("Reserved5", PVOID * (1)), - ("PeakVirtualSize", PVOID), - ("VirtualSize", PVOID), - ("PageFaultCount", PVOID), - ("PeakWorkingSetSize", PVOID), - ("WorkingSetSize", PVOID), - ("QuotaPeakPagedPoolUsage", PVOID), - ("QuotaPagedPoolUsage", PVOID), - ("QuotaPeakNonPagedPoolUsage", PVOID), - ("QuotaNonPagedPoolUsage", PVOID), - ("PagefileUsage", PVOID), - ("PeakPagefileUsage", SIZE_T), - ("PrivatePageCount", SIZE_T), - ("Reserved6", LARGE_INTEGER * (6)), - ]
    - -PSYSTEM_PROCESS_INFORMATION = POINTER(_SYSTEM_PROCESS_INFORMATION) -SYSTEM_PROCESS_INFORMATION = _SYSTEM_PROCESS_INFORMATION - -
    -[docs] -class _SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION(Structure): - _fields_ = [ - ("IdleTime", LARGE_INTEGER), - ("KernelTime", LARGE_INTEGER), - ("UserTime", LARGE_INTEGER), - ("Reserved1", LARGE_INTEGER * (2)), - ("Reserved2", ULONG), - ]
    - -PSYSTEM_PROCESSOR_PERFORMANCE_INFORMATION = POINTER(_SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION) -SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION = _SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION - -
    -[docs] -class _SYSTEM_REGISTRY_QUOTA_INFORMATION(Structure): - _fields_ = [ - ("RegistryQuotaAllowed", ULONG), - ("RegistryQuotaUsed", ULONG), - ("Reserved1", PVOID), - ]
    - -PSYSTEM_REGISTRY_QUOTA_INFORMATION = POINTER(_SYSTEM_REGISTRY_QUOTA_INFORMATION) -SYSTEM_REGISTRY_QUOTA_INFORMATION = _SYSTEM_REGISTRY_QUOTA_INFORMATION - -
    -[docs] -class _SYSTEM_BASIC_INFORMATION(Structure): - _fields_ = [ - ("Reserved1", BYTE * (24)), - ("Reserved2", PVOID * (4)), - ("NumberOfProcessors", CHAR), - ]
    - -PSYSTEM_BASIC_INFORMATION = POINTER(_SYSTEM_BASIC_INFORMATION) -SYSTEM_BASIC_INFORMATION = _SYSTEM_BASIC_INFORMATION -
    [docs] class _TIME_ZONE_INFORMATION(Structure): @@ -15031,7 +15420,8 @@ # Self referencing struct tricks
    [docs] -class addrinfoW(Structure): pass
    +class addrinfoW(Structure): + pass
    ADDRINFOW = addrinfoW PADDRINFOW = POINTER(addrinfoW) @@ -15118,7 +15508,8 @@ # Self referencing struct tricks
    [docs] -class addrinfo(Structure): pass
    +class addrinfo(Structure): + pass
    ADDRINFOA = addrinfo PADDRINFOA = POINTER(addrinfo) diff --git a/docs/build/html/_modules/windows/pe_parse.html b/docs/build/html/_modules/windows/pe_parse.html index 49a38f1..1e55747 100644 --- a/docs/build/html/_modules/windows/pe_parse.html +++ b/docs/build/html/_modules/windows/pe_parse.html @@ -4,12 +4,12 @@ - windows.pe_parse — PythonForWindows 1.0.2 documentation + windows.pe_parse — PythonForWindows 1.0.3 documentation - + @@ -25,7 +25,7 @@
  • modules |
    • -
  • PythonForWindows 1.0.2 documentation »
    • +
  • PythonForWindows 1.0.3 documentation »
  • Module code »
  • windows.pe_parse
    • @@ -42,6 +42,7 @@ import windows.hooks as hooks import windows.utils as utils +import windows.generated_def as gdef from windows.generated_def.winstructs import * from windows.utils import transform_ctypes_fields import windows.remotectypes as rctypes @@ -77,9 +78,9 @@ # We can force bitness as the field we access are bitness-independant pe = GetPEFile(baseaddr, target, force_bitness=32) machine = pe.get_NT_HEADER().FileHeader.Machine - if machine == 0x14c: + if machine == gdef.IMAGE_FILE_MACHINE_I386: return 32 - elif machine == 0x8664: + elif machine in (gdef.IMAGE_FILE_MACHINE_AMD64, gdef.IMAGE_FILE_MACHINE_ARM64): return 64 else: raise ValueError("Unknow PE target machine <0x{0:x}>".format(machine)) @@ -150,7 +151,7 @@ if self.target is None: name = get_string(self.target, ctypes.addressof(self.Name))[:8] else: - name = get_string(self.target, self._base_addr)[:8] + name = self.target.read_memory(self._base_addr, 8).split(b"\x00", 1)[0].decode("ascii") # Decode as UTF-8 as the MS doc say ? return name @@ -549,7 +550,7 @@
  • modules |
    • -
  • PythonForWindows 1.0.2 documentation »
    • +
  • PythonForWindows 1.0.3 documentation »
  • Module code »
  • windows.pe_parse
    • diff --git a/docs/build/html/_modules/windows/remotectypes.html b/docs/build/html/_modules/windows/remotectypes.html index 634cc49..1d5f901 100644 --- a/docs/build/html/_modules/windows/remotectypes.html +++ b/docs/build/html/_modules/windows/remotectypes.html @@ -4,12 +4,12 @@ - windows.remotectypes — PythonForWindows 1.0.2 documentation + windows.remotectypes — PythonForWindows 1.0.3 documentation - + @@ -25,7 +25,7 @@
  • modules |
    • -
  • PythonForWindows 1.0.2 documentation »
    • +
  • PythonForWindows 1.0.3 documentation »
  • Module code »
  • windows.remotectypes
    • @@ -599,7 +599,7 @@
  • modules |
    • -
  • PythonForWindows 1.0.2 documentation »
    • +
  • PythonForWindows 1.0.3 documentation »
  • Module code »
  • windows.remotectypes
    • diff --git a/docs/build/html/_modules/windows/rpc/client.html b/docs/build/html/_modules/windows/rpc/client.html index a9585b1..7ba2584 100644 --- a/docs/build/html/_modules/windows/rpc/client.html +++ b/docs/build/html/_modules/windows/rpc/client.html @@ -216,7 +216,7 @@ this.version = (5,7) this.flags = gdef.ORPCF_LOCAL # Returned correct type with mandatory fields filed - lthis = find_correct_localthis_for_version() + lthis = fill_correct_localthis_for_version() return buffer(req)[:] + buffer(this)[:] + buffer(lthis)[:] + params return buffer(req)[:] + params @@ -255,8 +255,11 @@ "raise if request_type == RESPONSE_TYPE_FAIL" request_type = struct.unpack("<I", response.data[:4])[0] if request_type == gdef.RPC_RESPONSE_TYPE_FAIL: - error_code = struct.unpack("<5I", response.data)[2] - raise ValueError("RPC Response error {0} ({1!r})".format(error_code, KNOWN_RPC_ERROR_CODE.get(error_code, error_code))) + effective_error_code = error_code = struct.unpack("<5I", response.data)[2] + # https://learn.microsoft.com/en-us/windows/win32/com/structure-of-com-error-codes + if gdef.HRESULT_FACILITY(error_code) == gdef.FACILITY_WIN32: + effective_error_code = effective_error_code & 0xffff + raise ValueError("RPC Response error {0:#x} ({1!r})".format(error_code, KNOWN_RPC_ERROR_CODE[effective_error_code])) return request_type def _get_response_effective_data(self, response): @@ -267,33 +270,41 @@ data = response.data[ctypes.sizeof(ALPC_RPC_RESPONSE):] else: # Response in view M extract size from PORT_MESSAGE & read data from view - assert response.port_message.u1.s1.TotalLength >= 0x48 # At least 0x20 of data + assert response.port_message.u1.s1.DataLength >= ctypes.sizeof(ALPC_RPC_RESPONSE) # 0x20 rpcdatasize = struct.unpack("<I", response.data[0x18:0x1c])[0] # ctypes.sizeof(ALPC_RPC_RESPONSE) viewattr = response.view_attribute assert viewattr.ViewSize >= rpcdatasize data = windows.current_process.read_memory(viewattr.ViewBase, rpcdatasize) + # We have copied the data from the view: free it + # It looks like: + # windows.winproxy.NtAlpcDeleteSectionView(self.alpc_client.handle, 0, viewattr.ViewBase) + # Will ne be enough, as it will wait for the message to be reused to unmap the section.. + # And the current architecture encourage creating new message every time if response_header.request_id == self.REQUEST_IDENTIFIER_ORPC: # Parse & remove ORPC headers (orpcthat + LocalThat) - orpcthat = gdef.ORPCTHAT32.from_buffer_copy(data) - data = data[ctypes.sizeof(orpcthat):] - if orpcthat.extensions != 0: - print("Parsing extension !") - # Parse extension : code have not been tested a lot - write_array_extend = gdef.WireExtentArray.from_buffer_copy(data) - data = data[ctypes.sizeof(gdef.WireExtentArray):] - if write_array_extend.rounded_size != 2: - raise NotImplementedError("orpcthat.extensions: WireExtentArray.rounded_size != 2") - for value in write_array_extend.unique_flag: - if value != 0: - data = self._pass_wire_extend(data) - localthat_type = find_correct_localthat_for_version() - if localthat_type is not None: - localthat = localthat_type.from_buffer_copy(data) - # Check localthat pointers are empty - for field in ("pAsyncResponseBlock", "containerErrorInformation", "containerPassthroughData"): - if getattr(localthat, field, 0) != 0: - raise NotImplementedError("ORPC Response with localthat.{0} != 0".format(field)) - data = data[ctypes.sizeof(localthat):] + data = self._pass_orpc_response_structures(data) + return data + + def _pass_orpc_response_structures(self, data): + orpcthat = gdef.ORPCTHAT32.from_buffer_copy(data) + data = data[ctypes.sizeof(orpcthat):] + if orpcthat.extensions != 0: + # Parse extension : code have not been tested a lot + write_array_extend = gdef.WireExtentArray.from_buffer_copy(data) + data = data[ctypes.sizeof(gdef.WireExtentArray):] + if write_array_extend.rounded_size != 2: + raise NotImplementedError("orpcthat.extensions: WireExtentArray.rounded_size != 2") + for value in write_array_extend.unique_flag: + if value != 0: + data = self._pass_wire_extend(data) + localthat_type = find_correct_localthat_for_version() + if localthat_type is not None: + localthat = localthat_type.from_buffer_copy(data) + # Check localthat pointers are empty + for field in ("pAsyncResponseBlock", "containerErrorInformation", "containerPassthroughData"): + if getattr(localthat, field, 0) != 0: + raise NotImplementedError("ORPC Response with localthat.{0} != 0".format(field)) + data = data[ctypes.sizeof(localthat):] return data def _pass_wire_extend(self, data): @@ -319,7 +330,7 @@ # Nb fields: 7 # 10.0.16299.1 -> 10.0.26100.2454 -def find_correct_localthis_for_version(): +def fill_correct_localthis_for_version(): vmaj, vmin = windows.system.version if (vmaj, vmin) < (6, 1): return None diff --git a/docs/build/html/_modules/windows/rpc/ndr.html b/docs/build/html/_modules/windows/rpc/ndr.html index 345faa8..b233c8a 100644 --- a/docs/build/html/_modules/windows/rpc/ndr.html +++ b/docs/build/html/_modules/windows/rpc/ndr.html @@ -4,12 +4,12 @@ - windows.rpc.ndr — PythonForWindows 1.0.2 documentation + windows.rpc.ndr — PythonForWindows 1.0.3 documentation - + @@ -25,7 +25,7 @@
  • modules |
    • -
  • PythonForWindows 1.0.2 documentation »
    • +
  • PythonForWindows 1.0.3 documentation »
  • Module code »
  • windows.rpc.ndr
    • @@ -229,6 +229,8 @@ assert size1 == size2 assert zero == 0 s = stream.read(size1 * 2) + if stream.use_memoryview: + return bytearray(s).decode("utf-16-le") return s.decode("utf-16-le") @classmethod @@ -652,10 +654,14 @@ [docs] class NdrStream(object): """A stream of bytes used for NDR unpacking""" - def __init__(self, data): + def __init__(self, data, use_memoryview=False): + """""" self.fulldata = data - self.data = data - # self.data = memoryview(data) # FAST but need some code rewrite at some places + self.use_memoryview = use_memoryview + if use_memoryview: + self.data = memoryview(data) # FAST but need some code rewrite at some places + else: + self.data = data def partial_unpack(self, format): size = struct.calcsize(format) @@ -757,7 +763,7 @@
  • modules |
    • -
  • PythonForWindows 1.0.2 documentation »
    • +
  • PythonForWindows 1.0.3 documentation »
  • Module code »
  • windows.rpc.ndr
    • diff --git a/docs/build/html/_modules/windows/syswow64.html b/docs/build/html/_modules/windows/syswow64.html index 427958d..24178c6 100644 --- a/docs/build/html/_modules/windows/syswow64.html +++ b/docs/build/html/_modules/windows/syswow64.html @@ -4,12 +4,12 @@ - windows.syswow64 — PythonForWindows 1.0.2 documentation + windows.syswow64 — PythonForWindows 1.0.3 documentation - + @@ -25,7 +25,7 @@
  • modules |
    • -
  • PythonForWindows 1.0.2 documentation »
    • +
  • PythonForWindows 1.0.3 documentation »
  • Module code »
  • windows.syswow64
    • @@ -212,19 +212,20 @@ def get_current_process_syswow_peb(): current_process = windows.current_process - - class CurrentProcessReadSyswow(process.Process): - bitness = 64 - def _get_handle(self): - return winproxy.OpenProcess(dwProcessId=current_process.pid) - - def read_memory(self, addr, size): - buffer_addr = ctypes.create_string_buffer(size) - winproxy.NtWow64ReadVirtualMemory64(self.handle, addr, buffer_addr, size) - return buffer_addr[:] peb_addr = get_current_process_syswow_peb_addr() return windows.winobject.process.RemotePEB64(peb_addr, CurrentProcessReadSyswow()) +class CurrentProcessReadSyswow(process.Process): + bitness = 64 + + def _get_handle(self): + # GetCurrentProcess() is not accepted for NtWow64ReadVirtualMemory64 :( + return winproxy.OpenProcess(dwProcessId=windows.current_process.pid) + + def read_memory(self, addr, size): + buffer_addr = ctypes.create_string_buffer(size) + winproxy.NtWow64ReadVirtualMemory64(self.handle, addr, buffer_addr, size) + return buffer_addr[:] class ReadSyswow64Process(process.Process): def __init__(self, target): @@ -432,7 +433,7 @@
  • modules |
    • -
  • PythonForWindows 1.0.2 documentation »
    • +
  • PythonForWindows 1.0.3 documentation »
  • Module code »
  • windows.syswow64
    • diff --git a/docs/build/html/_modules/windows/utils/winutils.html b/docs/build/html/_modules/windows/utils/winutils.html index 0baa07b..abb12fe 100644 --- a/docs/build/html/_modules/windows/utils/winutils.html +++ b/docs/build/html/_modules/windows/utils/winutils.html @@ -4,12 +4,12 @@ - windows.utils.winutils — PythonForWindows 1.0.2 documentation + windows.utils.winutils — PythonForWindows 1.0.3 documentation - + @@ -25,7 +25,7 @@
  • modules |
    • -
  • PythonForWindows 1.0.2 documentation »
    • +
  • PythonForWindows 1.0.3 documentation »
  • Module code »
  • windows.utils.winutils
    • @@ -75,19 +75,6 @@ return mod.pe.exports[func_name] -def is_wow_64(hProcess): - try: - fnIsWow64Process = get_func_addr("kernel32.dll", "IsWow64Process") - except winproxy.WinproxyError: - return False - IsWow64Process = ctypes.WINFUNCTYPE(BOOL, HANDLE, ctypes.POINTER(BOOL))(fnIsWow64Process) - Wow64Process = BOOL() - res = IsWow64Process(hProcess, ctypes.byref(Wow64Process)) - if res: - return bool(Wow64Process) - raise ctypes.WinError() - -
    [docs] def create_file_from_handle(handle, mode="r"): @@ -136,14 +123,35 @@
    [docs] -def create_process(path, args=None, dwCreationFlags=0, show_windows=True): - """A convenient wrapper arround :func:`windows.winproxy.CreateProcessW`""" +def create_process(path, args=None, dwCreationFlags=0, show_windows=True, machine=None): + """A convenient wrapper arround :func:`windows.winproxy.CreateProcessW` + ..note: + The machine param only works starting at vista and should be used on arm64 computer + """ proc_info = PROCESS_INFORMATION() + StartupInfo = None lpStartupInfo = None + + if machine is not None: + buffer = ctypes.create_string_buffer(0x100) + size = gdef.DWORD64(len(buffer)) + machine = gdef.WORD(machine) + windows.winproxy.InitializeProcThreadAttributeList(buffer, 1, 0, size) + windows.winproxy.UpdateProcThreadAttribute(buffer, 0, gdef.PROC_THREAD_ATTRIBUTE_MACHINE_TYPE, ctypes.addressof(machine), ctypes.sizeof(machine), None, None) + + startup_infoex = gdef.STARTUPINFOEXW() + startup_infoex.StartupInfo.cb = ctypes.sizeof(gdef.STARTUPINFOEXW) + startup_infoex.lpAttributeList = ctypes.cast(buffer, gdef.PVOID) + StartupInfo = startup_infoex.StartupInfo + + dwCreationFlags |= gdef.EXTENDED_STARTUPINFO_PRESENT + if show_windows: - StartupInfo = STARTUPINFOW() - StartupInfo.cb = ctypes.sizeof(StartupInfo) + if StartupInfo is None: + StartupInfo = STARTUPINFOW() + StartupInfo.cb = ctypes.sizeof(StartupInfo) StartupInfo.dwFlags = 0 + if StartupInfo: lpStartupInfo = ctypes.byref(StartupInfo) lpCommandLine = None if isinstance(path, bytes): @@ -160,6 +168,8 @@ dbgprint("CreateProcessW new thread handle {:#x}".format(proc_info.hThread), "HANDLE") dbgprint("Automatic close of thread handle {:#x}".format(proc_info.hThread), "HANDLE") windows.winproxy.CloseHandle(proc_info.hThread) # Give access to a WinThread in addition of the WinProcess ? + if machine: + windows.winproxy.DeleteProcThreadAttributeList(buffer) return windows.winobject.process.WinProcess(pid=proc_info.dwProcessId, handle=proc_info.hProcess)
    @@ -360,6 +370,16 @@ microsecond=systime.wMilliseconds * 1000, ) +IMAGE_FILE_MACHINE_TO_PROC_ARCH = { + gdef.IMAGE_FILE_MACHINE_I386: gdef.PROCESSOR_ARCHITECTURE_INTEL, + gdef.IMAGE_FILE_MACHINE_AMD64: gdef.PROCESSOR_ARCHITECTURE_AMD64, + gdef.IMAGE_FILE_MACHINE_ARM64: gdef.PROCESSOR_ARCHITECTURE_ARM64, + gdef.IMAGE_FILE_MACHINE_UNKNOWN: gdef.PROCESSOR_ARCHITECTURE_UNKNOWN +} + +def image_file_machine_to_processor_architecture(image_file_machine): + return IMAGE_FILE_MACHINE_TO_PROC_ARCH[image_file_machine] + class FixedInteractiveConsole(code.InteractiveConsole): def raw_input(self, prompt=">>>"): sys.stdout.write(prompt) @@ -626,6 +646,14 @@ # addr = windows.winproxy.MapViewOfFile(h, dwDesiredAccess=FILE_MAP_READ, dwNumberOfBytesToMap=1) # return addr +def get_system_info(native=False): + res = gdef.SYSTEM_INFO() + if native: + windows.winproxy.GetNativeSystemInfo(res) + else: + windows.winproxy.GetSystemInfo(res) + return res + def decompress_buffer(buffer, comptype=gdef.COMPRESSION_FORMAT_LZNT1, uncompress_size=None): if uncompress_size is None: uncompress_size = len(buffer) * 10 @@ -700,7 +728,7 @@
    [docs] class DisableWow64FsRedirection(object): - """ + r""" A context manager that disable the SysWow64 Filesystem Redirection :: if is_process_32_bits: @@ -752,7 +780,7 @@
  • modules |
    • -
  • PythonForWindows 1.0.2 documentation »
    • +
  • PythonForWindows 1.0.3 documentation »
  • Module code »
  • windows.utils.winutils
    • diff --git a/docs/build/html/_modules/windows/winobject/event_log.html b/docs/build/html/_modules/windows/winobject/event_log.html index 342ae0d..41b4d49 100644 --- a/docs/build/html/_modules/windows/winobject/event_log.html +++ b/docs/build/html/_modules/windows/winobject/event_log.html @@ -4,12 +4,12 @@ - windows.winobject.event_log — PythonForWindows 1.0.2 documentation + windows.winobject.event_log — PythonForWindows 1.0.3 documentation - + @@ -25,7 +25,7 @@
  • modules |
    • -
  • PythonForWindows 1.0.2 documentation »
    • +
  • PythonForWindows 1.0.3 documentation »
  • Module code »
  • windows.winobject.event_log
    • @@ -1279,7 +1279,7 @@
  • modules |
    • -
  • PythonForWindows 1.0.2 documentation »
    • +
  • PythonForWindows 1.0.3 documentation »
  • Module code »
  • windows.winobject.event_log
    • diff --git a/docs/build/html/_modules/windows/winobject/handle.html b/docs/build/html/_modules/windows/winobject/handle.html index ba2c3d0..3bef4d7 100644 --- a/docs/build/html/_modules/windows/winobject/handle.html +++ b/docs/build/html/_modules/windows/winobject/handle.html @@ -4,12 +4,12 @@ - windows.winobject.handle — PythonForWindows 1.0.2 documentation + windows.winobject.handle — PythonForWindows 1.0.3 documentation - + @@ -25,7 +25,7 @@
  • modules |
    • -
  • PythonForWindows 1.0.2 documentation »
    • +
  • PythonForWindows 1.0.3 documentation »
  • Module code »
  • windows.winobject.handle
    • @@ -186,6 +186,8 @@ def enumerate_handles_syswow64(): + if windows.current_process._is_x86_on_arm64: + raise NotImplementedError("Crossing heaven gate x86 -> arm64 not implemented") size_needed = gdef.ULONG() # Should at least be sizeof(gdef.SYSTEM_HANDLE_INFORMATION) tmp_buffer = windows.utils.BUFFER(gdef.SYSTEM_HANDLE_INFORMATION64)() @@ -267,7 +269,7 @@
  • modules |
    • -
  • PythonForWindows 1.0.2 documentation »
    • +
  • PythonForWindows 1.0.3 documentation »
  • Module code »
  • windows.winobject.handle
    • diff --git a/docs/build/html/_modules/windows/winobject/object_manager.html b/docs/build/html/_modules/windows/winobject/object_manager.html index b9bc35b..fddc93e 100644 --- a/docs/build/html/_modules/windows/winobject/object_manager.html +++ b/docs/build/html/_modules/windows/winobject/object_manager.html @@ -4,12 +4,12 @@ - windows.winobject.object_manager — PythonForWindows 1.0.2 documentation + windows.winobject.object_manager — PythonForWindows 1.0.3 documentation - + @@ -25,7 +25,7 @@
  • modules |
    • -
  • PythonForWindows 1.0.2 documentation »
    • +
  • PythonForWindows 1.0.3 documentation »
  • Module code »
  • windows.winobject.object_manager
    • @@ -224,13 +224,13 @@
    [docs] def __getitem__(self, name): - """Query object ``name`` from the directory, split and subquery on ``\\``:: + r"""Query object ``name`` from the directory, split and subquery on ``\``:: >>> obj <KernelObject "\Windows" (type="Directory")> >>> obj["WindowStations"]["WinSta0"] <KernelObject "\Windows\WindowStations" (type="Directory")> - >>> obj["WindowStations\\WinSta0"] + >>> obj[r"WindowStations\\WinSta0"] <KernelObject "\Windows\WindowStations" (type="Directory")> :rtype: :class:`KernelObject` @@ -317,7 +317,7 @@
  • modules |
    • -
  • PythonForWindows 1.0.2 documentation »
    • +
  • PythonForWindows 1.0.3 documentation »
  • Module code »
  • windows.winobject.object_manager
    • diff --git a/docs/build/html/_modules/windows/winobject/process.html b/docs/build/html/_modules/windows/winobject/process.html index 5fe2f2e..050b45a 100644 --- a/docs/build/html/_modules/windows/winobject/process.html +++ b/docs/build/html/_modules/windows/winobject/process.html @@ -4,12 +4,12 @@ - windows.winobject.process — PythonForWindows 1.0.2 documentation + windows.winobject.process — PythonForWindows 1.0.3 documentation - + @@ -25,7 +25,7 @@
  • modules |
    • -
  • PythonForWindows 1.0.2 documentation »
    • +
  • PythonForWindows 1.0.3 documentation »
  • Module code »
  • windows.winobject.process
    • @@ -51,6 +51,7 @@ import windows import windows.native_exec.simple_x86 as x86 import windows.native_exec.simple_x64 as x64 +import windows.native_exec.simple_arm64 as arm64 import windows.remotectypes as rctypes import windows.generated_def as gdef @@ -106,27 +107,82 @@ class Process(utils.AutoHandle): - @utils.fixedpropety + @utils.fixedproperty def is_wow_64(self): """``True`` if the process is a SysWow64 process (32bit process on 64bits system). :type: :class:`bool` """ - # return utils.is_wow_64(self.handle) - return utils.is_wow_64(self.limited_handle) + if not windows.winproxy.is_implemented(windows.winproxy.IsWow64Process): + return False + Wow64Process = gdef.BOOL() + windows.winproxy.IsWow64Process(self.handle, Wow64Process) + return bool(Wow64Process) - @utils.fixedpropety + + + @utils.fixedproperty + def is_wow_64_2(self): + if not windows.winproxy.is_implemented(windows.winproxy.IsWow64Process2): + return None, None + processMachine = gdef.USHORT() + nativeMachine = gdef.USHORT() + windows.winproxy.IsWow64Process2(self.handle, processMachine, nativeMachine) + return (gdef.IMAGE_FILE_MACHINE_MAPPER[processMachine.value], + gdef.IMAGE_FILE_MACHINE_MAPPER[nativeMachine.value]) + + + @utils.fixedproperty def bitness(self): """The bitness of the process :returns: :class:`int` -- 32 or 64 """ - if windows.system.bitness == 32: - return 32 - if self.is_wow_64: + if windows.system.bitness == 32 or self.is_wow_64: return 32 return 64 + @utils.fixedproperty + def architecture(self): + # Syswow2 will exactly tell us the architecture + if windows.winproxy.is_implemented(windows.winproxy.IsWow64Process2): + process_machine, native_machine = self.is_wow_64_2 + if process_machine != gdef.IMAGE_FILE_MACHINE_UNKNOWN: + return process_machine + + if windows.system.architecture == gdef.PROCESSOR_ARCHITECTURE_ARM64: + # May be ARM64 or AMD64 as X64TA64 is not considered WOW64 + # ProcessMachineTypeInfo is from build 22000 + # What if not implemented ? parse target main binary PE ? + machine_archi = gdef.PROCESS_MACHINE_INFORMATION() + windows.winproxy.GetProcessInformation(self.handle, gdef.ProcessMachineTypeInfo, ctypes.byref(machine_archi), ctypes.sizeof(machine_archi)) + return gdef.IMAGE_FILE_MACHINE_MAPPER[machine_archi.ProcessMachine] + + # No IsWow64Process2 -> No ARM + # So its up on x86 -> x64 based on process bitness + if self.bitness == 32: + return gdef.IMAGE_FILE_MACHINE_I386 + return gdef.IMAGE_FILE_MACHINE_AMD64 + + @utils.fixedproperty + def _is_x86_on_arm64(self): + return (windows.system.architecture == gdef.PROCESSOR_ARCHITECTURE_ARM64 and + self.architecture == gdef.IMAGE_FILE_MACHINE_I386) + + @utils.fixedproperty + def _is_x86_on_x64(self): + return (windows.system.architecture == gdef.PROCESSOR_ARCHITECTURE_AMD64 and + self.architecture == gdef.IMAGE_FILE_MACHINE_I386) + + @utils.fixedproperty + def _is_native_architecture(self): + return ((windows.system.architecture == gdef.PROCESSOR_ARCHITECTURE_INTEL and + self.architecture == gdef.IMAGE_FILE_MACHINE_I386) or + (windows.system.architecture == gdef.PROCESSOR_ARCHITECTURE_AMD64 and + self.architecture == gdef.IMAGE_FILE_MACHINE_AMD64) or + (windows.system.architecture == gdef.PROCESSOR_ARCHITECTURE_ARM64 and + self.architecture == gdef.IMAGE_FILE_MACHINE_ARM64)) + @utils.fixedpropety def limited_handle(self): if windows.system.version[0] <= 5: @@ -134,14 +190,26 @@ return winproxy.OpenProcess(PROCESS_QUERY_INFORMATION, dwProcessId=self.pid) return winproxy.OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION, dwProcessId=self.pid) + @utils.fixedproperty + def name(self): + """Name of the process - @utils.fixedpropety + :type: :class:`str` + """ + buffer = ctypes.create_unicode_buffer(0x1024) + rsize = winproxy.GetProcessImageFileNameW(self.limited_handle, buffer) + # GetProcessImageFileNameW returns the fullpath + return buffer[:rsize].split("\\")[-1] + + @utils.fixedproperty def ppid(self): """Parent Process ID :type: :class:`int` """ if windows.current_process.bitness == 32 and self.bitness == 64: + if windows.current_process._is_x86_on_arm64: + raise NotImplementedError("Crossing heaven gate x86 -> arm64 not implemented") xtype = windows.remotectypes.transform_type_to_remote64bits(PROCESS_BASIC_INFORMATION) # Fuck-it <3 data = (ctypes.c_char * ctypes.sizeof(xtype))() @@ -212,6 +280,8 @@ def virtual_protect(self, addr, size, protect, old_protect=None): """Change the access right of one or more page of the process""" if windows.current_process.bitness == 32 and self.bitness == 64: + if windows.current_process._is_x86_on_arm64: + raise NotImplementedError("Crossing heaven gate x86 -> arm64 not implemented") if size & 0x0fff: size = ((size >> 12) + 1) << 12 if old_protect is None: @@ -242,6 +312,8 @@ :rtype: :class:`~windows.generated_def.winstructs.MEMORY_BASIC_INFORMATION` """ if windows.current_process.bitness == 32 and self.bitness == 64: + if windows.current_process._is_x86_on_arm64: + raise NotImplementedError("Crossing heaven gate x86 -> arm64 not implemented") res = MEMORY_BASIC_INFORMATION64() try: v = windows.syswow64.NtQueryVirtualMemory_32_to_64(ProcessHandle=self.handle, BaseAddress=addr, MemoryInformationClass=MemoryBasicInformation, MemoryInformation=res) @@ -322,6 +394,8 @@ for i, data in enumerate(info_array): info_array[i].VirtualAddress = addresses[i] if windows.current_process.bitness == 32 and self.bitness == 64: + if windows.current_process._is_x86_on_arm64: + raise NotImplementedError("Crossing heaven gate x86 -> arm64 not implemented") windows.syswow64.NtQueryVirtualMemory_32_to_64(self.handle, 0, MemoryWorkingSetListEx, info_array) else: winproxy.QueryWorkingSetEx(self.handle, ctypes.byref(info_array), ctypes.sizeof(info_array)) @@ -552,11 +626,12 @@ return [h for h in windows.system.handles if h.dwProcessId == pid] def __del__(self): - super(Process, self).__del__() - # Same logic that AutoHandle.__del__ for Process.limited_handle - # Assert that Process inherit AutoHandle # sys.path is not None -> check if python shutdown if sys.path is not None and hasattr(self, "_limited_handle") and self._limited_handle: + # Same logic that AutoHandle.__del__ for Process.limited_handle + # Assert that Process inherit AutoHandle + # Call super after check as Process could be None during destruction + super(Process, self).__del__() # Prevent some bug where dbgprint might be None when __del__ is called in a closing process # This line is bad -> it reopens a handle closed by 'super(Process, self).__del__()' ._. dbgprint("Closing limited handle {0} for {1}".format(hex(self._limited_handle), self), "HANDLE") if dbgprint is not None else None @@ -603,7 +678,14 @@ [docs] class CurrentThread(Thread): """The current thread""" - @property #It's not a fixedpropety because executing thread might change + + get_teb_code_by_architecture = { + gdef.IMAGE_FILE_MACHINE_I386: x86.assemble("mov eax, fs:[0x18]; ret"), + gdef.IMAGE_FILE_MACHINE_AMD64: x64.assemble("mov rax, gs:[0x30]; ret"), + gdef.IMAGE_FILE_MACHINE_ARM64: arm64.assemble("mov x0, x18; ret") + } + + @property #It's not a fixedproperty because executing thread might change def tid(self): """Thread ID @@ -611,6 +693,15 @@ """ return winproxy.GetCurrentThreadId() + @property #It's not a fixedproperty because executing thread might change + def teb_base(self): + get_teb_base_code = self.get_teb_code_by_architecture[self.owner.architecture] + return self.owner.execute(get_teb_base_code) + + @property + def teb(self): + return TEB.from_address(self.teb_base) + @property def owner(self): """The current process @@ -632,8 +723,6 @@ return winproxy.ExitThread(code)
    - -
    [docs] def wait(self, timeout=INFINITE): @@ -647,37 +736,12 @@ [docs] class CurrentProcess(Process): """The current process""" - get_peb = None - - get_peb_32_code = x86.MultipleInstr() - get_peb_32_code += x86.Mov('EAX', x86.mem('fs:[0x30]')) - get_peb_32_code += x86.Ret() - get_peb_32_code = get_peb_32_code.get_code() - - get_peb_64_code = x64.MultipleInstr() - get_peb_64_code += x64.Mov('RAX', x64.mem('gs:[0x60]')) - get_peb_64_code += x64.Ret() - get_peb_64_code = get_peb_64_code.get_code() - allocator = native_exec.native_function.allocator - name = "CurrentProcess" # Used by Winthread for __repr__ - - # Use RtlGetCurrentPeb ? - def get_peb_builtin(self): - if self.get_peb is not None: - return self.get_peb - if self.bitness == 32: - get_peb = native_exec.create_function(self.get_peb_32_code, [PVOID]) - else: - get_peb = native_exec.create_function(self.get_peb_64_code, [PVOID]) - self.get_peb = get_peb - return get_peb - def _get_handle(self): return winproxy.GetCurrentProcess() - @utils.fixedpropety + @utils.fixedproperty def limited_handle(self): return winproxy.GetCurrentProcess() @@ -693,23 +757,21 @@ """ return os.getpid() - @utils.fixedpropety # leave it has fixed property as we don't care if CurrentProcess is never collected + @utils.fixedproperty # leave it has fixed property as we don't care if CurrentProcess is never collected def peb(self): """The Process Environment Block of the current process :type: :class:`PEB` """ - return PEB.from_address(self.get_peb_builtin()()) + return PEB.from_address(windows.winproxy.RtlGetCurrentPeb()) - @utils.fixedpropety + @utils.fixedproperty def bitness(self): """The bitness of the process :type: :class:`int` -- 32 or 64 """ - import platform - bits = platform.architecture()[0] - return int(bits[:2]) + return ctypes.sizeof(gdef.PVOID) * 8 # byte to bits
    [docs] @@ -798,7 +860,7 @@ raise ValueError("wait() on current thread")
    - @utils.fixedpropety + @utils.fixedproperty def peb_syswow(self): """The 64bits PEB of a SysWow64 process @@ -806,6 +868,8 @@ """ if not self.is_wow_64: raise ValueError("Not a syswow process") + if windows.current_process._is_x86_on_arm64: + raise NotImplementedError("Crossing heaven gate x86 -> arm64 not implemented") return windows.syswow64.get_current_process_syswow_peb() # TODO: use ctypes.string_at / ctypes.wstring_at for read_string / read_wstring ? @@ -850,21 +914,21 @@ # Create a DeadThread if thread is already dead ? return WinThread(handle=handle) - @utils.fixedpropety + @utils.fixedproperty def tid(self): """Thread ID :type: :class:`int`""" return self._get_thread_id(self.handle) - @utils.fixedpropety + @utils.fixedproperty def owner_pid(self): res = THREAD_BASIC_INFORMATION() windows.winproxy.NtQueryInformationThread(self.handle, ThreadBasicInformation, byref(res), ctypes.sizeof(res)) owner_id = res.ClientId.UniqueProcess return owner_id - @utils.fixedpropety + @utils.fixedproperty def owner(self): """The Process owning the thread @@ -947,6 +1011,8 @@ :type: :class:`int` """ if windows.current_process.bitness == 32 and self.owner.bitness == 64: + if windows.current_process._is_x86_on_arm64: + raise NotImplementedError("Crossing heaven gate x86 -> arm64 not implemented") res = ULONGLONG() windows.syswow64.NtQueryInformationThread_32_to_64(self.handle, ThreadQuerySetWin32StartAddress, byref(res), ctypes.sizeof(res)) return res.value @@ -966,6 +1032,9 @@ # - Want the TEB of a 64b process # - Want the TEB64 of a Wowprocess # It's the same code for both + if windows.current_process._is_x86_on_arm64: + raise NotImplementedError("Crossing heaven gate x86 -> arm64 not implemented") + if windows.current_process.is_wow_64: restype = rctypes.transform_type_to_remote64bits(THREAD_BASIC_INFORMATION) ressize = (ctypes.sizeof(restype)) @@ -995,7 +1064,11 @@ # TebBase->NtTib.ExceptionList = (PVOID)Teb32Base; return self.owner.read_dword(main_teb_addr) - + @property + def teb(self): + if self.owner.bitness == 32: + return RemoteTEB32(self.teb_base, target=self.owner) + return RemoteTEB64(self.teb_base, target=self.owner) @property def teb_syswow_base(self): @@ -1008,6 +1081,12 @@ # just return the main TEB return self._get_principal_teb_addr() + @property + def teb_syswow(self): + if windows.current_process.bitness == 64: + return RemoteTEB64(self.teb_syswow_base, self.owner) + else: #current is 32bits + return RemoteTEB64(self.teb_syswow_base, windows.syswow64.ReadSyswow64Process(self.owner))
    [docs] @@ -1069,8 +1148,6 @@ @staticmethod def _get_thread_id_manual(handle): - if windows.current_process.bitness == 32 and self.owner.bitness == 64: - raise NotImplementedError("[_get_thread_id_manual] 32 -> 64 (XP64 bits + Syswow process ?)") res = THREAD_BASIC_INFORMATION() windows.winproxy.NtQueryInformationThread(handle, ThreadBasicInformation, byref(res), ctypes.sizeof(res)) id2 = res.ClientId.UniqueThread @@ -1113,18 +1190,7 @@ return cls(pid=pid, name=name, ppid=ppid) - @utils.fixedpropety - def name(self): - """Name of the process - - :type: :class:`str` - """ - buffer = ctypes.create_unicode_buffer(0x1024) - rsize = winproxy.GetProcessImageFileNameW(self.limited_handle, buffer) - # GetProcessImageFileNameW returns the fullpath - return buffer[:rsize].split("\\")[-1] - - @utils.fixedpropety + @utils.fixedproperty def pid(self): """Process ID @@ -1149,13 +1215,13 @@
    [docs] - def virtual_alloc(self, size, prot=PAGE_EXECUTE_READWRITE, addr=None): + def virtual_alloc(self, size, prot=PAGE_EXECUTE_READWRITE, addr=None, type=gdef.MEM_COMMIT): """Allocate memory in the process :return: The address of the allocated memory :rtype: :class:`int` """ - return winproxy.VirtualAllocEx(self.handle, lpAddress=addr, dwSize=size, flProtect=prot)
    + return winproxy.VirtualAllocEx(self.handle, lpAddress=addr, dwSize=size, flAllocationType=type, flProtect=prot)
    @@ -1236,11 +1302,16 @@ :rtype: :class:`WinThread` or :class:`DeadThread` """ + # We are using NtCreateThreadEx as its more permissive about cross-bitness / cross-architecture + # And we can asume we known what we are doing -> So no safeguard ;) + thread_handle = HANDLE() if windows.current_process.bitness == 32 and self.bitness == 64: - thread_handle = HANDLE() + if self._is_x86_on_arm64: + raise NotImplementedError("Crossing heaven gate x86 -> arm64 not implemented") windows.syswow64.NtCreateThreadEx_32_to_64(ThreadHandle=byref(thread_handle) ,ProcessHandle=self.handle, lpStartAddress=addr, lpParameter=param) - return WinThread._from_handle(thread_handle.value) - return WinThread._from_handle(winproxy.CreateRemoteThread(hProcess=self.handle, lpStartAddress=addr, lpParameter=param))
    + else: + windows.winproxy.NtCreateThreadEx(ThreadHandle=byref(thread_handle) ,ProcessHandle=self.handle, lpStartAddress=addr, lpParameter=param) + return WinThread._from_handle(thread_handle.value)
    @@ -1257,55 +1328,62 @@
    [docs] def execute_python(self, pycode): - """Execute Python code into the remote process. + """Execute Python code in the remote process. This function waits for the remote process to end and raises an exception if the remote thread raised one - """ + + .. note:: + This method is incompatible with Microsoft Store builds of python, as the interpreter DLLs do not grant execute to Users. + See workaround: https://hakril.github.io/PythonForWindows/build/html/sample.html#microsoft-store-python-injection + """ return injection.safe_execute_python(self, pycode)
    [docs] def execute_python_unsafe(self, pycode): - """Execute Python code into the remote process. + """Execute Python code in the remote process. :rtype: :rtype: :class:`WinThread` or :class:`DeadThread` : The thread executing the python code + + .. note:: + This method is incompatible with Microsoft Store builds of python, as the interpreter DLLs do not grant execute to Users. + See workaround: https://hakril.github.io/PythonForWindows/build/html/sample.html#microsoft-store-python-injection """ return injection.execute_python_code(self, pycode)
    - - - @utils.fixedpropety + @utils.fixedproperty def peb_addr(self): - """The address of the PEB + """The address of the PEB. :type: :class:`int` """ - if windows.current_process.bitness == 32 and self.bitness == 64: + if windows.current_process._is_x86_on_arm64 and not self.bitness == 32: + raise NotImplementedError("Crossing heaven gate x86 -> arm64 not implemented") + + if windows.current_process.bitness == 32 and self.bitness == 64: # Intel to Intel x = windows.remotectypes.transform_type_to_remote64bits(PROCESS_BASIC_INFORMATION) # Fuck-it <3 data = (ctypes.c_char * ctypes.sizeof(x))() - windows.syswow64.NtQueryInformationProcess_32_to_64(self.handle, ProcessInformation=data, ProcessInformationLength=ctypes.sizeof(x)) + windows.syswow64.NtQueryInformationProcess_32_to_64(self.handle, gdef.ProcessBasicInformation, ProcessInformation=data) peb_offset = x.PebBaseAddress.offset peb_addr = struct.unpack("<Q", data[x.PebBaseAddress.offset: x.PebBaseAddress.offset+8])[0] elif windows.current_process.bitness == 64 and self.bitness == 32: - information_type = 26 y = ULONGLONG() - winproxy.NtQueryInformationProcess(self.handle, information_type, byref(y), sizeof(y)) + winproxy.NtQueryInformationProcess(self.handle, gdef.ProcessWow64Information, byref(y), sizeof(y)) peb_addr = y.value else: - information_type = 0 x = PROCESS_BASIC_INFORMATION() - winproxy.NtQueryInformationProcess(self.handle, information_type, x) + winproxy.NtQueryInformationProcess(self.handle, gdef.ProcessBasicInformation, x) peb_addr = ctypes.cast(x.PebBaseAddress, PVOID).value if peb_addr is None: raise ValueError("Could not get peb addr of process {0}".format(self.name)) return peb_addr - # Not a fixedpropety to prevent ref-cycle and uncollectable WinProcess + # Not a fixedproperty to prevent ref-cycle and uncollectable WinProcess # Try with a weakref ? @property def peb(self): @@ -1319,10 +1397,14 @@ return RemotePEB32(self.peb_addr, self) return RemotePEB(self.peb_addr, self) - @utils.fixedpropety + @utils.fixedproperty def peb_syswow_addr(self): if not self.is_wow_64: raise ValueError("Not a syswow process") + + if windows.current_process._is_x86_on_arm64: + raise NotImplementedError("Crossing heaven gate x86 -> arm64 not implemented") + if windows.current_process.bitness == 64: information_type = 0 x = PROCESS_BASIC_INFORMATION() @@ -1338,7 +1420,7 @@ peb_addr = struct.unpack("<Q", data[x.PebBaseAddress.offset: x.PebBaseAddress.offset+8])[0] return peb_addr - # Not a fixedpropety to prevent ref-cycle and uncollectable WinProcess + # Not a fixedproperty to prevent ref-cycle and uncollectable WinProcess # Try with a weakref ? @property def peb_syswow(self): @@ -1362,8 +1444,6 @@ - - def transform_ctypes_fields(struct, replacement): return [(name, replacement.get(name, type)) for name, type in struct._fields_] @@ -1409,11 +1489,6 @@ -class LIST_ENTRY_PTR(PVOID): - def TO_LDR_ENTRY(self): - return LDR_DATA_TABLE_ENTRY.from_address(self.value - sizeof(PVOID) * 2) - -
    [docs] class PEB(gdef.PEB): @@ -1450,13 +1525,13 @@ :type: [:class:`LoadedModule`] -- List of loaded modules """ res = [] - list_entry_ptr = ctypes.cast(self.Ldr.contents.InMemoryOrderModuleList.Flink, LIST_ENTRY_PTR) - current_dll = list_entry_ptr.TO_LDR_ENTRY() + first_flink = self.Ldr.contents.InMemoryOrderModuleList.Flink[0] + current_dll = first_flink.get_real_struct(LoadedModule, LoadedModule.InMemoryOrderLinks) while current_dll.DllBase: res.append(current_dll) - list_entry_ptr = ctypes.cast(current_dll.InMemoryOrderLinks.Flink, LIST_ENTRY_PTR) - current_dll = list_entry_ptr.TO_LDR_ENTRY() - return [LoadedModule.from_address(addressof(LDR)) for LDR in res] + next_flink = current_dll.InMemoryOrderLinks.Flink[0] + current_dll = next_flink.get_real_struct(LoadedModule, LoadedModule.InMemoryOrderLinks) + return res @staticmethod def _extract_environment(env_block_addr, target): @@ -1487,7 +1562,6 @@ return apisetmap.get_api_set_map_for_current_process(self.ApiSetMap)
    - # Memory stuff class EPSAPI_WORKING_SET_BLOCK_BASE(object): @@ -1599,9 +1673,24 @@ raise NotImplementedError("ApiSetMap for remote process not implemented yet") +# TEB enhanced, same bitness as PEB (current process) +class TEB(gdef.TEB): + @property + def peb(self): + return ctypes.cast(self.ProcessEnvironmentBlock, ctypes.POINTER(PEB))[0] +# mote TEB enhanced, same bitness as PEB (current process) +class RemoteTEB(rctypes.RemoteStructure.from_structure(TEB)): + @property + def peb(self): + ctypes_peb = self.ProcessEnvironmentBlock.value + return RemotePEB(ctypes_peb, self._target) if CurrentProcess().bitness == 32: + RemoteLoadedModule32 = RemoteLoadedModule + RemotePEB32 = RemotePEB + RemoteTEB32 = RemoteTEB + class RemoteLoadedModule64(rctypes.transform_type_to_remote64bits(LoadedModule)): @property def pe(self): @@ -1616,7 +1705,6 @@ def ptr_flink_to_remote_module(self, ptr_value): return RemoteLoadedModule64(ptr_value - ctypes.sizeof(rctypes.c_void_p64) * 2, self._target) - @property def exe(self): """The executable of the process, as pointed by PEB.ImageBaseAddress @@ -1649,7 +1737,17 @@ apisetmap = RemotePEB.apisetmap + class RemoteTEB64(rctypes.transform_type_to_remote64bits(TEB)): + @property + def peb(self): + ctypes_peb = self.ProcessEnvironmentBlock.value + return RemotePEB64(ctypes_peb, self._target) + + if CurrentProcess().bitness == 64: + RemoteLoadedModule64 = RemoteLoadedModule + RemotePEB64 = RemotePEB + RemoteTEB64 = RemoteTEB class RemoteLoadedModule32(rctypes.transform_type_to_remote32bits(LoadedModule)): @property @@ -1696,6 +1794,12 @@ return self._extract_environment(self.ProcessParameters.contents.Environment, self._target) apisetmap = RemotePEB.apisetmap + + class RemoteTEB32(rctypes.transform_type_to_remote32bits(TEB)): + @property + def peb(self): + ctypes_peb = self.ProcessEnvironmentBlock.value + return RemotePEB32(ctypes_peb, self._target)
    @@ -1727,7 +1831,7 @@
  • modules |
    • -
  • PythonForWindows 1.0.2 documentation »
    • +
  • PythonForWindows 1.0.3 documentation »
  • Module code »
  • windows.winobject.process
    • diff --git a/docs/build/html/_modules/windows/winobject/system.html b/docs/build/html/_modules/windows/winobject/system.html index 40a51db..691e04b 100644 --- a/docs/build/html/_modules/windows/winobject/system.html +++ b/docs/build/html/_modules/windows/winobject/system.html @@ -49,7 +49,6 @@ import windows.generated_def as gdef - from windows.winobject import process from windows.winobject import network from windows.winobject import registry @@ -128,7 +127,7 @@ @property def logicaldrives(self): - """List of logical drives [C:\, ...] + """List of logical drives [C:\\, ...] :type: [:class:`~windows.winobject.volume.LogicalDrive`] -- A list of LogicalDrive """ @@ -301,12 +300,77 @@ result = tuple(result_tup[:2]) return result + # Based on: + # https://jrsoftware.org/ishelp/index.php?topic=winvernotes + # https://en.wikipedia.org/wiki/List_of_Microsoft_Windows_versions + + WINDOWS_10_BUILD_NUMBER_VERSION = { + # (build_number, is_workstation): "version_name" + (10240, True): u"Windows 10 Version 1507", + (10586, True): u"Windows 10 Version 1511", + (14393, True): u"Windows 10 Version 1607", + (15063, True): u"Windows 10 Version 1703", + (16299, True): u"Windows 10 Version 1709", + (17134, True): u"Windows 10 Version 1803", + (17763, True): u"Windows 10 Version 1809", + (18362, True): u"Windows 10 Version 1903", + (18363, True): u"Windows 10 Version 1909", + (19041, True): u"Windows 10 Version 2004", + (19042, True): u"Windows 10 Version 20H2", + (19043, True): u"Windows 10 Version 21H1", + (19044, True): u"Windows 10 Version 21H2", + (19045, True): u"Windows 10 Version 22H2", + (22000, True): u"Windows 11 Version 21H2", + (22621, True): u"Windows 11 Version 22H2", + (22631, True): u"Windows 11 Version 23H2", + (26100, True): u"Windows 11 Version 24H2", + + (14393, False): u"Windows Server 2016", + # 16299 : Windows Server, version 1709 ? + # 17134 : Windows Server, version 1803 ? + # 17134 : Windows Server, version 1803 ? + (17763, False): u"Windows Server 2019", + # 18362 : Windows Server, version 1903 ? + # 18363 : Windows Server, version 1909 ? + # 19041 : Windows Server, version 2004 ? + # 19042 : Windows Server, version 20H2 ? + (20348, False): u"Windows Server 2022", + # 25398 : Windows Server, version 23H2 ? + (26100, False): u"Windows Server 2025", + } + + def _get_version_name_for_10_build(self, build_number, is_workstation): + try: + return self.WINDOWS_10_BUILD_NUMBER_VERSION[(build_number, is_workstation)] + except KeyError as e: + return u"Unknown Windows 10+ <versionstr={0} | is_workstation={1}>".format(self.versionstr, is_workstation) + @utils.fixedpropety def version_name(self): """The name of the system version, values are: + * Windows Server 2025 + * Windows 11 Version 24H2 + * Windows 11 Version 23H2 + * Windows 11 Version 22H2 + * Windows 11 Version 21H2 + * Windows 10 Version 22H2 + * Windows 10 Version 21H2 + * Windows Server 2022 + * Windows 10 Version 21H1 + * Windows 10 Version 20H2 + * Windows 10 Version 2004 + * Windows 10 Version 1909 + * Windows 10 Version 1903 + * Windows Server 2019 + * Windows 10 Version 1809 + * Windows 10 Version 1803 + * Windows 10 Version 1709 + * Windows 10 Version 1703 + * Windows 10 Version 1607 + * Windows 10 Version 1511 + * Windows 10 Version 1507 * Windows Server 2016 - * Windows 10 * Windows Server 2012 R2 * Windows 8.1 * Windows Server 2012 @@ -316,19 +380,20 @@ * Windows Server 2008 * Windows Vista * Windows XP Professional x64 Edition - * TODO: version (5.2) + is_workstation + bitness == 32 (don't even know if possible..) + * Unknown: version (5.2) + is_workstation + bitness == 32 (don't even know if possible..) * Windows Server 2003 R2 * Windows Server 2003 * Windows XP * Windows 2000 - * "Unknow Windows <version={0} | is_workstation={1}>".format(version, is_workstation) + * "Unknown Windows 10+ <versionstr={0} | is_workstation={1}>".format(self.versionstr, is_workstation) + * "Unknown Windows <version={0} | is_workstation={1}>".format(version, is_workstation) - :type: :class:`str` + :type: :class:`unicode` """ version = self.version is_workstation = self.product_type == gdef.VER_NT_WORKSTATION if version == (10, 0): - return [u"Windows Server 2016", u"Windows 10"][is_workstation] + return self._get_version_name_for_10_build(self.build_number, is_workstation) elif version == (6, 3): return [u"Windows Server 2012 R2", u"Windows 8.1"][is_workstation] elif version == (6, 2): @@ -343,7 +408,7 @@ if self.bitness == 64: return u"Windows XP Professional x64 Edition" else: - return u"TODO: version (5.2) + is_workstation + bitness == 32" + return u"Unknown: version (5.2) + is_workstation + bitness == 32" elif metric != 0: return u"Windows Server 2003 R2" else: @@ -353,7 +418,7 @@ elif version == (5, 0): return u"Windows 2000" else: - return u"Unknow Windows <version={0} | is_workstation={1}>".format(version, is_workstation) + return u"Unknown Windows <version={0} | is_workstation={1}>".format(version, is_workstation) VERSION_MAPPER = gdef.FlagMapper(gdef.VER_NT_WORKSTATION, gdef.VER_NT_DOMAIN_CONTROLLER, gdef.VER_NT_SERVER) @utils.fixedpropety @@ -561,6 +626,24 @@ # These are the part that do not move much between XP & Win10 return gdef.PFW_MINIMAL_KUSER_SHARED_DATA.from_address(gdef.MM_SHARED_USER_DATA_VA) + @utils.fixedproperty + def architecture(self): + # Retrieve system processor architecture + # It's not that easy as x64-on-ARM64 will lie on most API except IsWow64Process2 + # EX: GetNativeSystemInfo will returns PROCESSOR_ARCHITECTURE_AMD64 + if windows.winproxy.is_implemented(windows.winproxy.IsWow64Process2): + process_machine, native_machine = windows.current_process.is_wow_64_2 + try: + return utils.image_file_machine_to_processor_architecture(native_machine) + except KeyError as e: + raise ValueError("Unknown IsWow64Process2(native_machine:#x) -> {0}".format(native_machine)) + + # No IsWow64Process2 -> assert it cannot be ARM64 and thus GetNativeSystemInfo will not lie ? + sysinfo = gdef.SYSTEM_INFO() + windows.winproxy.GetNativeSystemInfo(sysinfo) + return gdef.PROCESSOR_ARCHITECTURE_MAPPER[sysinfo.wProcessorArchitecture] + + @staticmethod def enumerate_processes(): @@ -596,7 +679,7 @@ @staticmethod def enumerate_threads(): - return [WinThread._from_THREADENTRY32(th) for th in System.enumerate_threads_generator()] + return [process.WinThread._from_THREADENTRY32(th) for th in System.enumerate_threads_generator()] def enumerate_threads_setup_owners(self): diff --git a/docs/build/html/_modules/windows/winobject/system_module.html b/docs/build/html/_modules/windows/winobject/system_module.html index 6657732..8a99a96 100644 --- a/docs/build/html/_modules/windows/winobject/system_module.html +++ b/docs/build/html/_modules/windows/winobject/system_module.html @@ -4,12 +4,12 @@ - windows.winobject.system_module — PythonForWindows 1.0.2 documentation + windows.winobject.system_module — PythonForWindows 1.0.3 documentation - + @@ -25,7 +25,7 @@
  • modules |
    • -
  • PythonForWindows 1.0.2 documentation »
    • +
  • PythonForWindows 1.0.3 documentation »
  • Module code »
  • windows.winobject.system_module
    • @@ -92,6 +92,8 @@ return list(modules) def enumerate_kernel_modules_syswow64(): + if windows.current_process._is_x86_on_arm64: + raise NotImplementedError("Crossing heaven gate x86 -> arm64 not implemented") cbsize = gdef.DWORD() windows.syswow64.NtQuerySystemInformation_32_to_64(gdef.SystemModuleInformation, None, 0, ctypes.addressof(cbsize)) raw_buffer = (cbsize.value * gdef.BYTE)() @@ -130,7 +132,7 @@
  • modules |
    • -
  • PythonForWindows 1.0.2 documentation »
    • +
  • PythonForWindows 1.0.3 documentation »
  • Module code »
  • windows.winobject.system_module
    • diff --git a/docs/build/html/_modules/windows/winobject/wmi.html b/docs/build/html/_modules/windows/winobject/wmi.html index 621ed05..c725e5e 100644 --- a/docs/build/html/_modules/windows/winobject/wmi.html +++ b/docs/build/html/_modules/windows/winobject/wmi.html @@ -4,12 +4,12 @@ - windows.winobject.wmi — PythonForWindows 1.0.2 documentation + windows.winobject.wmi — PythonForWindows 1.0.3 documentation - + @@ -25,7 +25,7 @@
  • modules |
    • -
  • PythonForWindows 1.0.2 documentation »
    • +
  • PythonForWindows 1.0.3 documentation »
  • Module code »
  • windows.winobject.wmi
    • @@ -602,11 +602,11 @@
    [docs] class WmiManager(dict): - """The main WMI class exposed, used to list and access differents WMI namespace, can be used as a dict to access + r"""The main WMI class exposed, used to list and access differents WMI namespace, can be used as a dict to access :class:`WmiNamespace` by name Example: - >>> windows.system.wmi["root\\SecurityCenter2"] + >>> windows.system.wmi[r"root\SecurityCenter2"] <WmiNamespace "root\SecurityCenter2"> """ DEFAULT_NAMESPACE = "root\\cimv2" #: The default namespace for :func:`select` & :func:`query` @@ -676,7 +676,7 @@
  • modules |
    • -
  • PythonForWindows 1.0.2 documentation »
    • +
  • PythonForWindows 1.0.3 documentation »
  • Module code »
  • windows.winobject.wmi
    • diff --git a/docs/build/html/_sources/sample.rst.txt b/docs/build/html/_sources/sample.rst.txt index dc255cf..50c93a2 100644 --- a/docs/build/html/_sources/sample.rst.txt +++ b/docs/build/html/_sources/sample.rst.txt @@ -69,6 +69,20 @@ Output .. _token_sample: + +Microsoft Store Python Injection +'''''''''''''''''''''''''''''''' + +Python execution in remote process fails with Microsoft Store builds of pythons (`mspython`), as the interpreter DLLs do not grant execute to Users. +This sample shows a workaround by user https://github.com/dariushoule by copying needed mspython files to a temporary directory and injecting those instead. + +.. literalinclude:: ..\..\samples\process\msstore_interpreter_remote_python.py + +Output + +.. literalinclude:: samples_output\process_msstore_interpreter_remote_python.txt + + Token """"" diff --git a/docs/build/html/_sources/windef_generated.rst.txt b/docs/build/html/_sources/windef_generated.rst.txt index 01097f6..98b8e04 100644 --- a/docs/build/html/_sources/windef_generated.rst.txt +++ b/docs/build/html/_sources/windef_generated.rst.txt @@ -152,6 +152,9 @@ WinDef .. autodata:: SORF_OXRES8 .. autodata:: SORF_NULL .. autodata:: SORF_NOPING +.. autodata:: UNIQUE_FLAG_PADDING +.. autodata:: MAINHDRSIG +.. autodata:: ENTRYHDRSIG .. autodata:: CWCSTORAGENAME .. autodata:: STGM_DIRECT .. autodata:: STGM_TRANSACTED @@ -496,6 +499,15 @@ WinDef .. autodata:: ERROR_SEVERITY_INFORMATIONAL .. autodata:: ERROR_SEVERITY_WARNING .. autodata:: ERROR_SEVERITY_ERROR +.. autodata:: FACILITY_WINDOWS +.. autodata:: FACILITY_WIN32 +.. autodata:: FACILITY_STORAGE +.. autodata:: FACILITY_RPC +.. autodata:: FACILITY_NULL +.. autodata:: FACILITY_ITF +.. autodata:: FACILITY_DISPATCH +.. autodata:: STATUS_SEVERITY_SUCCESS +.. autodata:: STATUS_SEVERITY_COERROR .. autodata:: EVENT_TRACE_FLAG_DISPATCHER .. autodata:: EVENT_TRACE_FLAG_VIRTUAL_ALLOC .. autodata:: EVENT_TRACE_FLAG_VAMAP @@ -1133,6 +1145,89 @@ WinDef .. autodata:: NMPWAIT_WAIT_FOREVER .. autodata:: NMPWAIT_NOWAIT .. autodata:: NMPWAIT_USE_DEFAULT_WAIT +.. autodata:: ProcThreadAttributeParentProcess +.. autodata:: ProcThreadAttributeExtendedFlags +.. autodata:: ProcThreadAttributeHandleList +.. autodata:: ProcThreadAttributeGroupAffinity +.. autodata:: ProcThreadAttributePreferredNode +.. autodata:: ProcThreadAttributeIdealProcessor +.. autodata:: ProcThreadAttributeUmsThread +.. autodata:: ProcThreadAttributeMitigationPolicy +.. autodata:: ProcThreadAttributePackageFullName +.. autodata:: ProcThreadAttributeSecurityCapabilities +.. autodata:: ProcThreadAttributeConsoleReference +.. autodata:: ProcThreadAttributeProtectionLevel +.. autodata:: ProcThreadAttributeOsMaxVersionTested +.. autodata:: ProcThreadAttributeJobList +.. autodata:: ProcThreadAttributeChildProcessPolicy +.. autodata:: ProcThreadAttributeAllApplicationPackagesPolicy +.. autodata:: ProcThreadAttributeWin32kFilter +.. autodata:: ProcThreadAttributeSafeOpenPromptOriginClaim +.. autodata:: ProcThreadAttributeDesktopAppPolicy +.. autodata:: ProcThreadAttributeBnoIsolation +.. autodata:: ProcThreadAttributePseudoConsole +.. autodata:: ProcThreadAttributeIsolationManifest +.. autodata:: ProcThreadAttributeMitigationAuditPolicy +.. autodata:: ProcThreadAttributeMachineType +.. autodata:: ProcThreadAttributeComponentFilter +.. autodata:: ProcThreadAttributeEnableOptionalXStateFeatures +.. autodata:: ProcThreadAttributeCreateStore +.. autodata:: ProcThreadAttributeTrustedApp +.. autodata:: ProcThreadAttributeSveVectorLength +.. autodata:: PROC_THREAD_ATTRIBUTE_NUMBER +.. autodata:: PROC_THREAD_ATTRIBUTE_THREAD +.. autodata:: PROC_THREAD_ATTRIBUTE_INPUT +.. autodata:: PROC_THREAD_ATTRIBUTE_ADDITIVE +.. autodata:: PROC_THREAD_ATTRIBUTE_PARENT_PROCESS +.. autodata:: PROC_THREAD_ATTRIBUTE_HANDLE_LIST +.. autodata:: PROC_THREAD_ATTRIBUTE_GROUP_AFFINITY +.. autodata:: PROC_THREAD_ATTRIBUTE_PREFERRED_NODE +.. autodata:: PROC_THREAD_ATTRIBUTE_IDEAL_PROCESSOR +.. autodata:: PROC_THREAD_ATTRIBUTE_UMS_THREAD +.. autodata:: PROC_THREAD_ATTRIBUTE_MITIGATION_POLICY +.. autodata:: PROC_THREAD_ATTRIBUTE_SECURITY_CAPABILITIES +.. autodata:: PROC_THREAD_ATTRIBUTE_PROTECTION_LEVEL +.. autodata:: PROC_THREAD_ATTRIBUTE_PSEUDOCONSOLE +.. autodata:: PROC_THREAD_ATTRIBUTE_MACHINE_TYPE +.. autodata:: PROC_THREAD_ATTRIBUTE_ENABLE_OPTIONAL_XSTATE_FEATURES +.. autodata:: PROC_THREAD_ATTRIBUTE_SVE_VECTOR_LENGTH +.. autodata:: PROCESSOR_INTEL_386 +.. autodata:: PROCESSOR_INTEL_486 +.. autodata:: PROCESSOR_INTEL_PENTIUM +.. autodata:: PROCESSOR_INTEL_IA64 +.. autodata:: PROCESSOR_MIPS_R4000 +.. autodata:: PROCESSOR_ALPHA_21064 +.. autodata:: PROCESSOR_PPC_601 +.. autodata:: PROCESSOR_PPC_603 +.. autodata:: PROCESSOR_PPC_604 +.. autodata:: PROCESSOR_PPC_620 +.. autodata:: PROCESSOR_HITACHI_SH3 +.. autodata:: PROCESSOR_HITACHI_SH3E +.. autodata:: PROCESSOR_HITACHI_SH4 +.. autodata:: PROCESSOR_MOTOROLA_821 +.. autodata:: PROCESSOR_SHx_SH3 +.. autodata:: PROCESSOR_SHx_SH4 +.. autodata:: PROCESSOR_STRONGARM +.. autodata:: PROCESSOR_ARM720 +.. autodata:: PROCESSOR_ARM820 +.. autodata:: PROCESSOR_ARM920 +.. autodata:: PROCESSOR_ARM_7TDMI +.. autodata:: PROCESSOR_OPTIL +.. autodata:: PROCESSOR_ARCHITECTURE_INTEL +.. autodata:: PROCESSOR_ARCHITECTURE_MIPS +.. autodata:: PROCESSOR_ARCHITECTURE_ALPHA +.. autodata:: PROCESSOR_ARCHITECTURE_PPC +.. autodata:: PROCESSOR_ARCHITECTURE_SHX +.. autodata:: PROCESSOR_ARCHITECTURE_ARM +.. autodata:: PROCESSOR_ARCHITECTURE_IA64 +.. autodata:: PROCESSOR_ARCHITECTURE_ALPHA64 +.. autodata:: PROCESSOR_ARCHITECTURE_MSIL +.. autodata:: PROCESSOR_ARCHITECTURE_AMD64 +.. autodata:: PROCESSOR_ARCHITECTURE_IA32_ON_WIN64 +.. autodata:: PROCESSOR_ARCHITECTURE_NEUTRAL +.. autodata:: PROCESSOR_ARCHITECTURE_ARM64 +.. autodata:: PROCESSOR_ARCHITECTURE_ARM32_ON_WIN64 +.. autodata:: PROCESSOR_ARCHITECTURE_UNKNOWN .. autodata:: HKEY_CLASSES_ROOT .. autodata:: HKEY_CURRENT_USER .. autodata:: HKEY_LOCAL_MACHINE @@ -1754,6 +1849,45 @@ WinDef .. autodata:: SPC_FINANCIAL_CRITERIA_OBJID .. autodata:: SPC_LINK_OBJID .. autodata:: SPC_SIGINFO_OBJID +.. autodata:: CONTEXT_I386 +.. autodata:: CONTEXT_AMD64 +.. autodata:: CONTEXT_ARM +.. autodata:: CONTEXT_ARM64 +.. autodata:: CONTEXT_i386 +.. autodata:: CONTEXT_i486 +.. autodata:: WOW64_CONTEXT_i386 +.. autodata:: WOW64_CONTEXT_i486 +.. autodata:: CONTEXT_CONTROL +.. autodata:: CONTEXT_INTEGER +.. autodata:: CONTEXT_SEGMENTS +.. autodata:: CONTEXT_FLOATING_POINT +.. autodata:: CONTEXT_DEBUG_REGISTERS +.. autodata:: CONTEXT_EXTENDED_REGISTERS +.. autodata:: CONTEXT_FULL +.. autodata:: CONTEXT_ALL +.. autodata:: CONTEXT_XSTATE +.. autodata:: WOW64_CONTEXT_CONTROL +.. autodata:: WOW64_CONTEXT_INTEGER +.. autodata:: WOW64_CONTEXT_SEGMENTS +.. autodata:: WOW64_CONTEXT_FLOATING_POINT +.. autodata:: WOW64_CONTEXT_DEBUG_REGISTERS +.. autodata:: WOW64_CONTEXT_EXTENDED_REGISTERS +.. autodata:: WOW64_CONTEXT_FULL +.. autodata:: WOW64_CONTEXT_ALL +.. autodata:: WOW64_CONTEXT_XSTATE +.. autodata:: WOW64_CONTEXT_EXCEPTION_ACTIVE +.. autodata:: WOW64_CONTEXT_SERVICE_ACTIVE +.. autodata:: WOW64_CONTEXT_EXCEPTION_REQUEST +.. autodata:: WOW64_CONTEXT_EXCEPTION_REPORTING +.. autodata:: CONTEXT_ARM64_CONTROL +.. autodata:: CONTEXT_ARM64_INTEGER +.. autodata:: CONTEXT_ARM64_FLOATING_POINT +.. autodata:: CONTEXT_ARM64_DEBUG_REGISTERS +.. autodata:: CONTEXT_ARM64_X18 +.. autodata:: CONTEXT_UNWOUND_TO_CALL +.. autodata:: CONTEXT_RET_TO_GUEST +.. autodata:: ARM64_MAX_BREAKPOINTS +.. autodata:: ARM64_MAX_WATCHPOINTS .. autodata:: FILE_VER_GET_LOCALISED .. autodata:: FILE_VER_GET_NEUTRAL .. autodata:: FILE_VER_GET_PREFETCHED @@ -1865,19 +1999,6 @@ WinDef .. autodata:: TH32CS_SNAPMODULE32 .. autodata:: TH32CS_SNAPALL .. autodata:: TH32CS_INHERIT -.. autodata:: CONTEXT_I386 -.. autodata:: CONTEXT_AMD64 -.. autodata:: CONTEXT_ARM -.. autodata:: CONTEXT_ARM64 -.. autodata:: CONTEXT_CONTROL -.. autodata:: CONTEXT_INTEGER -.. autodata:: CONTEXT_SEGMENTS -.. autodata:: CONTEXT_FLOATING_POINT -.. autodata:: CONTEXT_DEBUG_REGISTERS -.. autodata:: CONTEXT_EXTENDED_REGISTERS -.. autodata:: CONTEXT_FULL -.. autodata:: CONTEXT_ALL -.. autodata:: CONTEXT_XSTATE .. autodata:: PAGE_NOACCESS .. autodata:: PAGE_READONLY .. autodata:: PAGE_READWRITE @@ -2910,6 +3031,7 @@ WinDef .. autodata:: IMAGE_FILE_MACHINE_M32R .. autodata:: IMAGE_FILE_MACHINE_CEE .. autodata:: IMAGE_FILE_MACHINE_ARM64 +.. autodata:: IMAGE_FILE_MACHINE_TARGET_HOST .. autodata:: CERT_QUERY_OBJECT_FILE .. autodata:: CERT_QUERY_OBJECT_BLOB .. autodata:: CERT_QUERY_CONTENT_CERT @@ -3222,6 +3344,37 @@ WinDef .. autodata:: CRYPT_SGCKEY .. autodata:: CRYPT_ARCHIVABLE .. autodata:: CRYPT_FORCE_KEY_PROTECTION_HIGH +.. autodata:: CERT_RDN_ANY_TYPE +.. autodata:: CERT_RDN_ENCODED_BLOB +.. autodata:: CERT_RDN_OCTET_STRING +.. autodata:: CERT_RDN_NUMERIC_STRING +.. autodata:: CERT_RDN_PRINTABLE_STRING +.. autodata:: CERT_RDN_TELETEX_STRING +.. autodata:: CERT_RDN_T61_STRING +.. autodata:: CERT_RDN_VIDEOTEX_STRING +.. autodata:: CERT_RDN_IA5_STRING +.. autodata:: CERT_RDN_GRAPHIC_STRING +.. autodata:: CERT_RDN_VISIBLE_STRING +.. autodata:: CERT_RDN_ISO646_STRING +.. autodata:: CERT_RDN_GENERAL_STRING +.. autodata:: CERT_RDN_UNIVERSAL_STRING +.. autodata:: CERT_RDN_INT4_STRING +.. autodata:: CERT_RDN_BMP_STRING +.. autodata:: CERT_RDN_UNICODE_STRING +.. autodata:: CERT_RDN_UTF8_STRING +.. autodata:: CERT_RDN_TYPE_MASK +.. autodata:: CERT_RDN_FLAGS_MASK +.. autodata:: CERT_RDN_ENABLE_T61_UNICODE_FLAG +.. autodata:: CERT_RDN_ENABLE_UTF8_UNICODE_FLAG +.. autodata:: CERT_RDN_FORCE_UTF8_UNICODE_FLAG +.. autodata:: CERT_RDN_DISABLE_CHECK_TYPE_FLAG +.. autodata:: CERT_RDN_DISABLE_IE4_UTF8_FLAG +.. autodata:: CRYPT_DECODE_NOCOPY_FLAG +.. autodata:: CRYPT_DECODE_TO_BE_SIGNED_FLAG +.. autodata:: CRYPT_DECODE_SHARE_OID_STRING_FLAG +.. autodata:: CRYPT_DECODE_NO_SIGNATURE_BYTE_REVERSAL_FLAG +.. autodata:: CRYPT_DECODE_ALLOC_FLAG +.. autodata:: CRYPT_UNICODE_NAME_DECODE_DISABLE_IE4_UTF8_FLAG .. autodata:: CRYPT_ENCODE_DECODE_NONE .. autodata:: X509_CERT .. autodata:: X509_CERT_TO_BE_SIGNED @@ -3360,6 +3513,10 @@ WinDef .. autodata:: CMSG_CTRL_VERIFY_SIGNATURE_EX .. autodata:: CMSG_CTRL_ADD_CMS_SIGNER_INFO .. autodata:: CMSG_CTRL_ENABLE_STRONG_SIGNATURE +.. autodata:: CERT_SET_KEY_PROV_HANDLE_PROP_ID +.. autodata:: CERT_SET_KEY_CONTEXT_PROP_ID +.. autodata:: CERT_NCRYPT_KEY_SPEC +.. autodata:: CERT_REQUEST_V1 .. autodata:: WSADESCRIPTION_LEN .. autodata:: WSASYS_STATUS_LEN .. autodata:: WSAPROTOCOL_LEN diff --git a/docs/build/html/_sources/winfuncs_generated.rst.txt b/docs/build/html/_sources/winfuncs_generated.rst.txt index 80cb453..e42bd53 100644 --- a/docs/build/html/_sources/winfuncs_generated.rst.txt +++ b/docs/build/html/_sources/winfuncs_generated.rst.txt @@ -326,6 +326,10 @@ Functions .. function:: CertCloseStore(hCertStore, dwFlags) +.. function:: CryptSignAndEncodeCertificate(hBCryptKey, dwKeySpec, dwCertEncodingType, lpszStructType, pvStructInfo, pSignatureAlgorithm, pvHashAuxInfo, pbEncoded, pcbEncoded) + +.. function:: CryptSignCertificate(hBCryptKey, dwKeySpec, dwCertEncodingType, pbEncodedToBeSigned, cbEncodedToBeSigned, pSignatureAlgorithm, pvHashAuxInfo, pbSignature, pcbSignature) + .. function:: OpenVirtualDisk(VirtualStorageType, Path, VirtualDiskAccessMask, Flags, Parameters, Handle) .. function:: AttachVirtualDisk(VirtualDiskHandle, SecurityDescriptor, Flags, ProviderSpecificFlags, Parameters, Overlapped) @@ -592,6 +596,10 @@ Functions .. function:: UnmapViewOfFile(lpBaseAddress) +.. function:: NCryptOpenKey(hProvider, phKey, pszKeyName, dwLegacyKeySpec, dwFlags) + +.. function:: NCryptOpenStorageProvider(phProvider, pszProviderName, dwFlags) + .. function:: NetQueryDisplayInformation(ServerName, Level, Index, EntriesRequested, PreferredMaximumLength, ReturnedEntryCount, SortedBuffer) .. function:: NetUserEnum(servername, level, filter, bufptr, prefmaxlen, entriesread, totalentries, resume_handle) @@ -696,6 +704,12 @@ Functions .. function:: FreeLibrary(hLibModule) +.. function:: GetProcessInformation(hProcess, ProcessInformationClass, ProcessInformation, ProcessInformationSize) + +.. function:: SetProcessInformation(hProcess, ProcessInformationClass, ProcessInformation, ProcessInformationSize) + +.. function:: RtlGetCurrentPeb() + .. function:: RegQueryValueExA(hKey, lpValueName, lpReserved, lpType, lpData, lpcbData) .. function:: RegQueryValueExW(hKey, lpValueName, lpReserved, lpType, lpData, lpcbData) @@ -1212,6 +1226,42 @@ Functions .. function:: LookupAccountNameW(lpSystemName, lpAccountName, Sid, cbSid, ReferencedDomainName, cchReferencedDomainName, peUse) +.. function:: GetNativeSystemInfo(lpSystemInfo) + +.. function:: GetSystemInfo(lpSystemInfo) + +.. function:: IsWow64Process(hProcess, Wow64Process) + +.. function:: IsWow64Process2(hProcess, pProcessMachine, pNativeMachine) + +.. function:: IsWow64GuestMachineSupported(WowGuestMachine, MachineIsSupported) + +.. function:: GetSystemWow64DirectoryA(lpBuffer, uSize) + +.. function:: GetSystemWow64DirectoryW(lpBuffer, uSize) + +.. function:: GetSystemWow64Directory2A(lpBuffer, uSize, ImageFileMachineType) + +.. function:: GetSystemWow64Directory2W(lpBuffer, uSize, ImageFileMachineType) + +.. function:: Wow64DisableWow64FsRedirection(OldValue) + +.. function:: Wow64EnableWow64FsRedirection(Wow64FsEnableRedirection) + +.. function:: Wow64RevertWow64FsRedirection(OlValue) + +.. function:: Wow64GetThreadContext(hThread, lpContext) + +.. function:: Wow64SetThreadContext(hThread, lpContext) + +.. function:: Wow64SetThreadDefaultGuestMachine(Machine) + +.. function:: Wow64SuspendThread(hThread) + +.. function:: NtWow64ReadVirtualMemory64(hProcess, lpBaseAddress, lpBuffer, nSize, lpNumberOfBytesRead) + +.. function:: NtWow64WriteVirtualMemory64(hProcess, lpBaseAddress, lpBuffer, nSize, lpNumberOfBytesWritten) + .. function:: FileTimeToSystemTime(lpFileTime, lpSystemTime) .. function:: SystemTimeToFileTime(lpSystemTime, lpFileTime) @@ -1348,6 +1398,8 @@ Functions .. function:: CreateRemoteThread(hProcess, lpThreadAttributes, dwStackSize, lpStartAddress, lpParameter, dwCreationFlags, lpThreadId) +.. function:: CreateRemoteThreadEx(hProcess, lpThreadAttributes, dwStackSize, lpStartAddress, lpParameter, dwCreationFlags, lpAttributeList, lpThreadId) + .. function:: CreateProcessA(lpApplicationName, lpCommandLine, lpProcessAttributes, lpThreadAttributes, bInheritHandles, dwCreationFlags, lpEnvironment, lpCurrentDirectory, lpStartupInfo, lpProcessInformation) .. function:: CreateProcessW(lpApplicationName, lpCommandLine, lpProcessAttributes, lpThreadAttributes, bInheritHandles, dwCreationFlags, lpEnvironment, lpCurrentDirectory, lpStartupInfo, lpProcessInformation) @@ -1368,12 +1420,8 @@ Functions .. function:: ReadProcessMemory(hProcess, lpBaseAddress, lpBuffer, nSize, lpNumberOfBytesRead) -.. function:: NtWow64ReadVirtualMemory64(hProcess, lpBaseAddress, lpBuffer, nSize, lpNumberOfBytesRead) - .. function:: WriteProcessMemory(hProcess, lpBaseAddress, lpBuffer, nSize, lpNumberOfBytesWritten) -.. function:: NtWow64WriteVirtualMemory64(hProcess, lpBaseAddress, lpBuffer, nSize, lpNumberOfBytesWritten) - .. function:: GetCurrentProcess() .. function:: CreateFileA(lpFileName, dwDesiredAccess, dwShareMode, lpSecurityAttributes, dwCreationDisposition, dwFlagsAndAttributes, hTemplateFile) @@ -1466,14 +1514,6 @@ Functions .. function:: DeviceIoControl(hDevice, dwIoControlCode, lpInBuffer, nInBufferSize, lpOutBuffer, nOutBufferSize, lpBytesReturned, lpOverlapped) -.. function:: Wow64DisableWow64FsRedirection(OldValue) - -.. function:: Wow64RevertWow64FsRedirection(OldValue) - -.. function:: Wow64EnableWow64FsRedirection(Wow64FsEnableRedirection) - -.. function:: Wow64GetThreadContext(hThread, lpContext) - .. function:: SetConsoleCtrlHandler(HandlerRoutine, Add) .. function:: GlobalAlloc(uFlags, dwBytes) @@ -1528,8 +1568,6 @@ Functions .. function:: GetProcessId(Process) -.. function:: Wow64SetThreadContext(hThread, lpContext) - .. function:: GetMappedFileNameW(hProcess, lpv, lpFilename, nSize) .. function:: GetMappedFileNameA(hProcess, lpv, lpFilename, nSize) diff --git a/docs/build/html/_sources/winstructs_generated.rst.txt b/docs/build/html/_sources/winstructs_generated.rst.txt index 3892063..0e85324 100644 --- a/docs/build/html/_sources/winstructs_generated.rst.txt +++ b/docs/build/html/_sources/winstructs_generated.rst.txt @@ -247,6 +247,8 @@ Simple types .. autoclass:: NET_API_STATUS +.. autoclass:: SECURITY_STATUS + .. autoclass:: PVOID32 .. autoclass:: PVOID64 @@ -255,6 +257,8 @@ Simple types .. autoclass:: NCRYPT_PROV_HANDLE +.. autoclass:: BCRYPT_KEY_HANDLE + .. autoclass:: NCRYPT_KEY_HANDLE .. autoclass:: NCRYPT_HASH_HANDLE @@ -2716,6 +2720,124 @@ CONTAINERVERSION :class:`CONTAINER_EXTENT_ARRAY` +__MIDL_ILocalObjectExporter_0006 +'''''''''''''''''''''''''''''''' +.. class:: MIDL_ILocalObjectExporter_0006 + + Alias for :class:`__MIDL_ILocalObjectExporter_0006` + +.. class:: __MIDL_ILocalObjectExporter_0006 + + .. attribute:: dwTid + + :class:`ULONG` + + + .. attribute:: dwPid + + :class:`ULONG` + + + .. attribute:: dwAuthnHint + + :class:`ULONG` + + + .. attribute:: version + + :class:`tagCOMVERSION` + + + .. attribute:: ipidRemUnknown + + :class:`_GUID` + + + .. attribute:: dwFlags + + :class:`ULONG` + + + .. attribute:: psa + + :class:`tagDUALSTRINGARRAY` + + + .. attribute:: guidProcessIdentifier + + :class:`_GUID` + + + .. attribute:: processHostId + + :class:`UINT64` + + + .. attribute:: clientDependencyBehavior + + :class:`INT` + + + .. attribute:: packageFullName + + :class:`HSTRING__` + + + .. attribute:: userSid + + :class:`HSTRING__` + + + .. attribute:: appcontainerSid + + :class:`HSTRING__` + +_PRIV_RESOLVER_INFO_17763 +''''''''''''''''''''''''' +.. class:: PPRIV_RESOLVER_INFO_17763 + + Pointer to :class:`_PRIV_RESOLVER_INFO_17763` + +.. class:: PRIV_RESOLVER_INFO_17763 + + Alias for :class:`_PRIV_RESOLVER_INFO_17763` + +.. class:: _PRIV_RESOLVER_INFO_17763 + + .. attribute:: OxidServer + + :class:`UINT64` + + + .. attribute:: pServerORBindings + + :class:`tagDUALSTRINGARRAY` + + + .. attribute:: OxidInfo + + :class:`MIDL_ILocalObjectExporter_0006` + + + .. attribute:: LocalMidOfRemote + + :class:`UINT64` + + + .. attribute:: DllServerModel + + :class:`ULONG` + + + .. attribute:: pwszDllServer + + :class:`WCHAR` + + + .. attribute:: FoundInROT + + :class:`INT` + _MIDL_ILocalObjectExporter_0007 ''''''''''''''''''''''''''''''' .. class:: MIDL_ILocalObjectExporter_0007 @@ -2908,48 +3030,6 @@ _LOCALTHIS :class:`PVOID` -_LOCALTHIS32 -'''''''''''' -.. class:: LOCALTHIS32 - - Alias for :class:`_LOCALTHIS32` - -.. class:: _LOCALTHIS32 - - .. attribute:: dwFlags - - :class:`DWORD` - - - .. attribute:: dwClientThread - - :class:`DWORD` - - - .. attribute:: passthroughTraceActivity - - :class:`GUID` - - - .. attribute:: callTraceActivity - - :class:`GUID` - - - .. attribute:: asyncRequestBlock - - :class:`MIDL_XmitDefs_0001` - - - .. attribute:: reserved - - :class:`DWORD` - - - .. attribute:: pTouchedAstaArray - - :class:`PVOID32` - _MIDL_XmitDefs_0007 ''''''''''''''''''' .. class:: _MIDL_XmitDefs_0007 @@ -3177,6 +3257,468 @@ _LOCALTHAT :class:`CONTAINERTHAT` +tagORPCTHAT +''''''''''' +.. class:: ORPCTHAT + + Alias for :class:`tagORPCTHAT` + +.. class:: tagORPCTHAT + + .. attribute:: flags + + :class:`ULONG` + + + .. attribute:: extensions + + :class:`tagORPC_EXTENT_ARRAY` + +ORPCTHAT32 +'''''''''' +.. class:: ORPCTHAT32 + + .. attribute:: flags + + :class:`ULONG` + + + .. attribute:: extensions + + :class:`PVOID32` + +WireExtentArray +''''''''''''''' +.. class:: WireExtentArray + + .. attribute:: size + + :class:`ULONG` + + + .. attribute:: reserved + + :class:`ULONG` + + + .. attribute:: unique + + :class:`ULONG` + + + .. attribute:: rounded_size + + :class:`ULONG` + + + .. attribute:: unique_flag + + :class:`ULONG` ``[UNIQUE_FLAG_PADDING]`` + +WireExtent +'''''''''' +.. class:: WireExtent + + .. attribute:: rounded_size + + :class:`ULONG` + + + .. attribute:: id + + :class:`GUID` + + + .. attribute:: size + + :class:`ULONG` + +tagMainHeader +''''''''''''' +.. class:: MainHeader + + Alias for :class:`tagMainHeader` + +.. class:: tagMainHeader + + .. attribute:: Signature + + :class:`ULONG` + + + .. attribute:: Version + + :class:`ULONG` + + + .. attribute:: cPolicies + + :class:`ULONG` + + + .. attribute:: cbBuffer + + :class:`ULONG` + + + .. attribute:: cbSize + + :class:`ULONG` + + + .. attribute:: hr + + :class:`LONG` + + + .. attribute:: hrServer + + :class:`LONG` + + + .. attribute:: reserved + + :class:`LONG` + +LOCALTHIS32_NT_62 +''''''''''''''''' +.. class:: LOCALTHIS32_NT_62 + + .. attribute:: dwFlags + + :class:`ULONG` + + + .. attribute:: dwClientThread + + :class:`ULONG` + +__MIDL_XmitDefs_0001_NT_63 +'''''''''''''''''''''''''' +.. class:: __MIDL_XmitDefs_0001_NT_63 + + .. attribute:: size + + :class:`ULONG` + + + .. attribute:: reserved + + :class:`ULONG` + + + .. attribute:: pAstaOxids + + :class:`UINT64` + +LOCALTHIS32_NT_63 +''''''''''''''''' +.. class:: LOCALTHIS32_NT_63 + + .. attribute:: dwFlags + + :class:`ULONG` + + + .. attribute:: dwClientThread + + :class:`ULONG` + + + .. attribute:: reserved + + :class:`ULONG` + + + .. attribute:: pTouchedAstaArray + + :class:`PVOID32` + +LOCALTHAT32_NT_63 +''''''''''''''''' +.. class:: LOCALTHAT32_NT_63 + + .. attribute:: marshalingSetAcknowledgmentOxid + + :class:`UINT64` + + + .. attribute:: marshalingSetId + + :class:`UINT64` + +__MIDL_XmitDefs_0002_NT_1607 +'''''''''''''''''''''''''''' +.. class:: __MIDL_XmitDefs_0002_NT_1607 + + .. attribute:: size + + :class:`ULONG` + + + .. attribute:: reserved + + :class:`ULONG` + + + .. attribute:: pAstaOxids + + :class:`PVOID32` + +__MIDL_XmitDefs_0001_NT_1607 +'''''''''''''''''''''''''''' +.. class:: MIDL_XmitDefs_0001_NT_1607 + + Alias for :class:`__MIDL_XmitDefs_0001_NT_1607` + +.. class:: __MIDL_XmitDefs_0001_NT_1607 + + .. attribute:: asyncOperationId + + :class:`_GUID` + + + .. attribute:: oxidClientProcessNA + + :class:`UINT64` + + + .. attribute:: originalClientLogicalThreadId + + :class:`_GUID` + + + .. attribute:: uClientCausalityTraceId + + :class:`UINT64` + +_LOCALTHIS32_NT_1607 +'''''''''''''''''''' +.. class:: LOCALTHIS32_NT_1607 + + Alias for :class:`_LOCALTHIS32_NT_1607` + +.. class:: _LOCALTHIS32_NT_1607 + + .. attribute:: dwFlags + + :class:`ULONG` + + + .. attribute:: dwClientThread + + :class:`ULONG` + + + .. attribute:: asyncRequestBlock + + :class:`MIDL_XmitDefs_0001_NT_1607` + + + .. attribute:: reserved + + :class:`ULONG` + + + .. attribute:: pTouchedAstaArray + + :class:`PVOID32` + +__MIDL_XmitDefs_0007 +'''''''''''''''''''' +.. class:: MIDL_XmitDefs_0007 + + Alias for :class:`__MIDL_XmitDefs_0007` + +.. class:: __MIDL_XmitDefs_0007 + + .. attribute:: pointOfFailure + + :class:`INT` + + + .. attribute:: hrFailure + + :class:`HRESULT` + + + .. attribute:: sizeOfMarshaledErrorInfo + + :class:`ULONG` + + + .. attribute:: reserved + + :class:`ULONG` + + + .. attribute:: pMarshaledErrorInfo + + :class:`BYTE` + +__MIDL_XmitDefs_0005 +'''''''''''''''''''' +.. class:: MIDL_XmitDefs_0005 + + Alias for :class:`__MIDL_XmitDefs_0005` + +.. class:: __MIDL_XmitDefs_0005 + + .. attribute:: sizeOfMarshaledResults + + :class:`ULONG` + + + .. attribute:: reserved + + :class:`ULONG` + + + .. attribute:: pMarshaledResults + + :class:`BYTE` + +__MIDL_XmitDefs_0008 +'''''''''''''''''''' +.. class:: MIDL_XmitDefs_0008 + + Alias for :class:`__MIDL_XmitDefs_0008` + +.. class:: __MIDL_XmitDefs_0008 + + .. attribute:: outcome + + :class:`INT` + + + .. attribute:: successDetails + + :class:`MIDL_XmitDefs_0005` + + + .. attribute:: failureDetails + + :class:`MIDL_XmitDefs_0007` + +__MIDL_XmitDefs_0010 +'''''''''''''''''''' +.. class:: MIDL_XmitDefs_0010 + + Alias for :class:`__MIDL_XmitDefs_0010` + +.. class:: __MIDL_XmitDefs_0010 + + .. attribute:: asyncStatus + + :class:`ULONG` + + + .. attribute:: reserved1 + + :class:`ULONG` + + + .. attribute:: uServerCausalityTraceId + + :class:`UINT64` + + + .. attribute:: reserved2 + + :class:`ULONG` + + + .. attribute:: pOutcomeDetails + + :class:`PVOID32` + +LOCALTHAT32_NT_1607 +''''''''''''''''''' +.. class:: LOCALTHAT32_NT_1607 + + .. attribute:: marshalingSetAcknowledgmentOxid + + :class:`UINT64` + + + .. attribute:: marshalingSetId + + :class:`UINT64` + + + .. attribute:: reserved + + :class:`ULONG` + + + .. attribute:: pAsyncResponseBlock + + :class:`PVOID32` + +_LOCALTHAT32_10_1903 +'''''''''''''''''''' +.. class:: LOCALTHAT32_10_1903 + + Alias for :class:`_LOCALTHAT32_10_1903` + +.. class:: _LOCALTHAT32_10_1903 + + .. attribute:: marshalingSetId + + :class:`UINT64` + + + .. attribute:: pAsyncResponseBlock + + :class:`PVOID32` + + + .. attribute:: containerPassthroughData + + :class:`PVOID32` + +_LOCALTHIS32 +'''''''''''' +.. class:: LOCALTHIS32 + + Alias for :class:`_LOCALTHIS32` + +.. class:: _LOCALTHIS32 + + .. attribute:: dwFlags + + :class:`DWORD` + + + .. attribute:: dwClientThread + + :class:`DWORD` + + + .. attribute:: passthroughTraceActivity + + :class:`GUID` + + + .. attribute:: callTraceActivity + + :class:`GUID` + + + .. attribute:: asyncRequestBlock + + :class:`MIDL_XmitDefs_0001` + + + .. attribute:: reserved + + :class:`DWORD` + + + .. attribute:: pTouchedAstaArray + + :class:`PVOID32` + _LOCALTHAT32 '''''''''''' .. class:: LOCALTHAT32 @@ -3209,36 +3751,6 @@ _LOCALTHAT32 :class:`PVOID32` -tagORPCTHAT -''''''''''' -.. class:: ORPCTHAT - - Alias for :class:`tagORPCTHAT` - -.. class:: tagORPCTHAT - - .. attribute:: flags - - :class:`ULONG` - - - .. attribute:: extensions - - :class:`tagORPC_EXTENT_ARRAY` - -ORPCTHAT32 -'''''''''' -.. class:: ORPCTHAT32 - - .. attribute:: flags - - :class:`ULONG` - - - .. attribute:: extensions - - :class:`PVOID32` - _VIRTUAL_STORAGE_TYPE ''''''''''''''''''''' .. class:: PVIRTUAL_STORAGE_TYPE @@ -7448,6 +7960,28 @@ _IMAGE_LOAD_CONFIG_DIRECTORY64 :class:`ULONGLONG` +_PROCESS_MACHINE_INFORMATION +'''''''''''''''''''''''''''' +.. class:: PROCESS_MACHINE_INFORMATION + + Alias for :class:`_PROCESS_MACHINE_INFORMATION` + +.. class:: _PROCESS_MACHINE_INFORMATION + + .. attribute:: ProcessMachine + + :class:`USHORT` + + + .. attribute:: Res0 + + :class:`USHORT` + + + .. attribute:: MachineAttributes + + :class:`MACHINE_ATTRIBUTES` + _MEM_ADDRESS_REQUIREMENTS ''''''''''''''''''''''''' .. class:: MEM_ADDRESS_REQUIREMENTS @@ -8001,6 +8535,128 @@ _SHFILEOPSTRUCTA :class:`PCSTR` +_LIST_ENTRY +''''''''''' +.. class:: LIST_ENTRY + + Alias for :class:`_LIST_ENTRY` + +.. class:: PLIST_ENTRY + + Pointer to :class:`_LIST_ENTRY` + +.. class:: PRLIST_ENTRY + + Pointer to :class:`_LIST_ENTRY` + +.. class:: _LIST_ENTRY + + .. attribute:: Flink + + :class:`_LIST_ENTRY` + + + .. attribute:: Blink + + :class:`_LIST_ENTRY` + +_LSA_UNICODE_STRING +''''''''''''''''''' +.. class:: LSA_UNICODE_STRING + + Alias for :class:`_LSA_UNICODE_STRING` + +.. class:: PLSA_UNICODE_STRING + + Pointer to :class:`_LSA_UNICODE_STRING` + +.. class:: PUNICODE_STRING + + Pointer to :class:`_LSA_UNICODE_STRING` + +.. class:: UNICODE_STRING + + Alias for :class:`_LSA_UNICODE_STRING` + +.. class:: _LSA_UNICODE_STRING + + .. attribute:: Length + + :class:`USHORT` + + + .. attribute:: MaximumLength + + :class:`USHORT` + + + .. attribute:: Buffer + + :class:`PVOID` + +_CLIENT_ID +'''''''''' +.. class:: CLIENT_ID + + Alias for :class:`_CLIENT_ID` + +.. class:: PCLIENT_ID + + Pointer to :class:`_CLIENT_ID` + +.. class:: _CLIENT_ID + + .. attribute:: UniqueProcess + + :class:`HANDLE` + + + .. attribute:: UniqueThread + + :class:`HANDLE` + +_CLIENT_ID64 +'''''''''''' +.. class:: CLIENT_ID64 + + Alias for :class:`_CLIENT_ID64` + +.. class:: PCLIENT_ID64 + + Pointer to :class:`_CLIENT_ID64` + +.. class:: _CLIENT_ID64 + + .. attribute:: UniqueProcess + + :class:`ULONG64` + + + .. attribute:: UniqueThread + + :class:`ULONG64` + +_CLIENT_ID32 +'''''''''''' +.. class:: CLIENT_ID32 + + Alias for :class:`_CLIENT_ID32` + +.. class:: PCLIENT_ID32 + + Pointer to :class:`_CLIENT_ID32` + +.. class:: _CLIENT_ID32 + + .. attribute:: UniqueProcess + + :class:`ULONG` + + + .. attribute:: UniqueThread + + :class:`ULONG` + _IMAGEHLP_MODULE64 '''''''''''''''''' .. class:: IMAGEHLP_MODULE64 @@ -9463,6 +10119,2127 @@ _tagSTACKFRAME_EX :class:`DWORD` +_SYSTEM_PROCESS_INFORMATION +''''''''''''''''''''''''''' +.. class:: PSYSTEM_PROCESS_INFORMATION + + Pointer to :class:`_SYSTEM_PROCESS_INFORMATION` + +.. class:: SYSTEM_PROCESS_INFORMATION + + Alias for :class:`_SYSTEM_PROCESS_INFORMATION` + +.. class:: _SYSTEM_PROCESS_INFORMATION + + .. attribute:: NextEntryOffset + + :class:`ULONG` + + + .. attribute:: NumberOfThreads + + :class:`ULONG` + + + .. attribute:: Reserved1 + + :class:`BYTE` ``[24]`` + + + .. attribute:: CreateTime + + :class:`LARGE_INTEGER` + + + .. attribute:: UserTime + + :class:`LARGE_INTEGER` + + + .. attribute:: KernelTime + + :class:`LARGE_INTEGER` + + + .. attribute:: ImageName + + :class:`UNICODE_STRING` + + + .. attribute:: BasePriority + + :class:`LONG` + + + .. attribute:: UniqueProcessId + + :class:`HANDLE` + + + .. attribute:: InheritedFromUniqueProcessId + + :class:`PVOID` + + + .. attribute:: HandleCount + + :class:`ULONG` + + + .. attribute:: Reserved4 + + :class:`BYTE` ``[4]`` + + + .. attribute:: Reserved5 + + :class:`PVOID` + + + .. attribute:: PeakVirtualSize + + :class:`PVOID` + + + .. attribute:: VirtualSize + + :class:`PVOID` + + + .. attribute:: PageFaultCount + + :class:`PVOID` + + + .. attribute:: PeakWorkingSetSize + + :class:`PVOID` + + + .. attribute:: WorkingSetSize + + :class:`PVOID` + + + .. attribute:: QuotaPeakPagedPoolUsage + + :class:`PVOID` + + + .. attribute:: QuotaPagedPoolUsage + + :class:`PVOID` + + + .. attribute:: QuotaPeakNonPagedPoolUsage + + :class:`PVOID` + + + .. attribute:: QuotaNonPagedPoolUsage + + :class:`PVOID` + + + .. attribute:: PagefileUsage + + :class:`PVOID` + + + .. attribute:: PeakPagefileUsage + + :class:`SIZE_T` + + + .. attribute:: PrivatePageCount + + :class:`SIZE_T` + + + .. attribute:: Reserved6 + + :class:`LARGE_INTEGER` ``[6]`` + +_SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION +''''''''''''''''''''''''''''''''''''''''' +.. class:: PSYSTEM_PROCESSOR_PERFORMANCE_INFORMATION + + Pointer to :class:`_SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION` + +.. class:: SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION + + Alias for :class:`_SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION` + +.. class:: _SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION + + .. attribute:: IdleTime + + :class:`LARGE_INTEGER` + + + .. attribute:: KernelTime + + :class:`LARGE_INTEGER` + + + .. attribute:: UserTime + + :class:`LARGE_INTEGER` + + + .. attribute:: Reserved1 + + :class:`LARGE_INTEGER` ``[2]`` + + + .. attribute:: Reserved2 + + :class:`ULONG` + +_SYSTEM_REGISTRY_QUOTA_INFORMATION +'''''''''''''''''''''''''''''''''' +.. class:: PSYSTEM_REGISTRY_QUOTA_INFORMATION + + Pointer to :class:`_SYSTEM_REGISTRY_QUOTA_INFORMATION` + +.. class:: SYSTEM_REGISTRY_QUOTA_INFORMATION + + Alias for :class:`_SYSTEM_REGISTRY_QUOTA_INFORMATION` + +.. class:: _SYSTEM_REGISTRY_QUOTA_INFORMATION + + .. attribute:: RegistryQuotaAllowed + + :class:`ULONG` + + + .. attribute:: RegistryQuotaUsed + + :class:`ULONG` + + + .. attribute:: Reserved1 + + :class:`PVOID` + +_SYSTEM_BASIC_INFORMATION +''''''''''''''''''''''''' +.. class:: PSYSTEM_BASIC_INFORMATION + + Pointer to :class:`_SYSTEM_BASIC_INFORMATION` + +.. class:: SYSTEM_BASIC_INFORMATION + + Alias for :class:`_SYSTEM_BASIC_INFORMATION` + +.. class:: _SYSTEM_BASIC_INFORMATION + + .. attribute:: Reserved1 + + :class:`BYTE` ``[24]`` + + + .. attribute:: Reserved2 + + :class:`PVOID` ``[4]`` + + + .. attribute:: NumberOfProcessors + + :class:`CHAR` + +_SYSTEM_INFO +'''''''''''' +.. class:: LPSYSTEM_INFO + + Pointer to :class:`_SYSTEM_INFO` + +.. class:: SYSTEM_INFO + + Alias for :class:`_SYSTEM_INFO` + +.. class:: _SYSTEM_INFO + + .. attribute:: DUMMYUNIONNAME + + :class:`_ANON__SYSTEM_INFO_SUB_UNION_1` + + + .. attribute:: dwPageSize + + :class:`DWORD` + + + .. attribute:: lpMinimumApplicationAddress + + :class:`LPVOID` + + + .. attribute:: lpMaximumApplicationAddress + + :class:`LPVOID` + + + .. attribute:: dwActiveProcessorMask + + :class:`DWORD_PTR` + + + .. attribute:: dwNumberOfProcessors + + :class:`DWORD` + + + .. attribute:: dwProcessorType + + :class:`DWORD` + + + .. attribute:: dwAllocationGranularity + + :class:`DWORD` + + + .. attribute:: wProcessorLevel + + :class:`WORD` + + + .. attribute:: wProcessorRevision + + :class:`WORD` + +_CURDIR +''''''' +.. class:: CURDIR + + Alias for :class:`_CURDIR` + +.. class:: PCURDIR + + Pointer to :class:`_CURDIR` + +.. class:: _CURDIR + + .. attribute:: DosPath + + :class:`UNICODE_STRING` + + + .. attribute:: Handle + + :class:`PVOID` + +_RTL_DRIVE_LETTER_CURDIR +'''''''''''''''''''''''' +.. class:: PRTL_DRIVE_LETTER_CURDIR + + Pointer to :class:`_RTL_DRIVE_LETTER_CURDIR` + +.. class:: RTL_DRIVE_LETTER_CURDIR + + Alias for :class:`_RTL_DRIVE_LETTER_CURDIR` + +.. class:: _RTL_DRIVE_LETTER_CURDIR + + .. attribute:: Flags + + :class:`WORD` + + + .. attribute:: Length + + :class:`WORD` + + + .. attribute:: TimeStamp + + :class:`ULONG` + + + .. attribute:: DosPath + + :class:`UNICODE_STRING` + +_RTL_USER_PROCESS_PARAMETERS +'''''''''''''''''''''''''''' +.. class:: PRTL_USER_PROCESS_PARAMETERS + + Pointer to :class:`_RTL_USER_PROCESS_PARAMETERS` + +.. class:: RTL_USER_PROCESS_PARAMETERS + + Alias for :class:`_RTL_USER_PROCESS_PARAMETERS` + +.. class:: _RTL_USER_PROCESS_PARAMETERS + + .. attribute:: MaximumLength + + :class:`ULONG` + + + .. attribute:: Length + + :class:`ULONG` + + + .. attribute:: Flags + + :class:`ULONG` + + + .. attribute:: DebugFlags + + :class:`ULONG` + + + .. attribute:: ConsoleHandle + + :class:`PVOID` + + + .. attribute:: ConsoleFlags + + :class:`ULONG` + + + .. attribute:: StandardInput + + :class:`PVOID` + + + .. attribute:: StandardOutput + + :class:`PVOID` + + + .. attribute:: StandardError + + :class:`PVOID` + + + .. attribute:: CurrentDirectory + + :class:`CURDIR` + + + .. attribute:: DllPath + + :class:`UNICODE_STRING` + + + .. attribute:: ImagePathName + + :class:`UNICODE_STRING` + + + .. attribute:: CommandLine + + :class:`UNICODE_STRING` + + + .. attribute:: Environment + + :class:`PVOID` + + + .. attribute:: StartingX + + :class:`ULONG` + + + .. attribute:: StartingY + + :class:`ULONG` + + + .. attribute:: CountX + + :class:`ULONG` + + + .. attribute:: CountY + + :class:`ULONG` + + + .. attribute:: CountCharsX + + :class:`ULONG` + + + .. attribute:: CountCharsY + + :class:`ULONG` + + + .. attribute:: FillAttribute + + :class:`ULONG` + + + .. attribute:: WindowFlags + + :class:`ULONG` + + + .. attribute:: ShowWindowFlags + + :class:`ULONG` + + + .. attribute:: WindowTitle + + :class:`UNICODE_STRING` + + + .. attribute:: DesktopInfo + + :class:`UNICODE_STRING` + + + .. attribute:: ShellInfo + + :class:`UNICODE_STRING` + + + .. attribute:: RuntimeData + + :class:`UNICODE_STRING` + + + .. attribute:: CurrentDirectores + + :class:`RTL_DRIVE_LETTER_CURDIR` ``[32]`` + +_LDR_DATA_TABLE_ENTRY +''''''''''''''''''''' +.. class:: LDR_DATA_TABLE_ENTRY + + Alias for :class:`_LDR_DATA_TABLE_ENTRY` + +.. class:: PLDR_DATA_TABLE_ENTRY + + Pointer to :class:`_LDR_DATA_TABLE_ENTRY` + +.. class:: _LDR_DATA_TABLE_ENTRY + + .. attribute:: Reserved1 + + :class:`PVOID` ``[2]`` + + + .. attribute:: InMemoryOrderLinks + + :class:`LIST_ENTRY` + + + .. attribute:: Reserved2 + + :class:`PVOID` ``[2]`` + + + .. attribute:: DllBase + + :class:`PVOID` + + + .. attribute:: EntryPoint + + :class:`PVOID` + + + .. attribute:: SizeOfImage + + :class:`PVOID` + + + .. attribute:: FullDllName + + :class:`UNICODE_STRING` + + + .. attribute:: BaseDllName + + :class:`UNICODE_STRING` + + + .. attribute:: Reserved5 + + :class:`PVOID` ``[3]`` + + + .. attribute:: CheckSum + + :class:`ULONG` + + + .. attribute:: TimeDateStamp + + :class:`ULONG` + +_PEB_LDR_DATA +''''''''''''' +.. class:: PEB_LDR_DATA + + Alias for :class:`_PEB_LDR_DATA` + +.. class:: PPEB_LDR_DATA + + Pointer to :class:`_PEB_LDR_DATA` + +.. class:: _PEB_LDR_DATA + + .. attribute:: Length + + :class:`ULONG` + + + .. attribute:: Initialized + + :class:`BYTE` + + + .. attribute:: SsHandle + + :class:`PVOID` + + + .. attribute:: InLoadOrderModuleList + + :class:`_LIST_ENTRY` + + + .. attribute:: InMemoryOrderModuleList + + :class:`_LIST_ENTRY` + + + .. attribute:: InInitializationOrderModuleList + + :class:`_LIST_ENTRY` + + + .. attribute:: EntryInProgress + + :class:`PVOID` + +_ANON_PEB_SYSTEM_DEPENDENT_02 +''''''''''''''''''''''''''''' +.. class:: _ANON_PEB_SYSTEM_DEPENDENT_02 + + .. attribute:: FastPebLockRoutine + + :class:`PVOID` + + + .. attribute:: SparePtr1 + + :class:`PVOID` + + + .. attribute:: AtlThunkSListPtr + + :class:`PVOID` + +_ANON_PEB_SYSTEM_DEPENDENT_03 +''''''''''''''''''''''''''''' +.. class:: _ANON_PEB_SYSTEM_DEPENDENT_03 + + .. attribute:: FastPebUnlockRoutine + + :class:`PVOID` + + + .. attribute:: SparePtr2 + + :class:`PVOID` + + + .. attribute:: IFEOKey + + :class:`PVOID` + +_ANON_PEB_SYSTEM_DEPENDENT_06 +''''''''''''''''''''''''''''' +.. class:: _ANON_PEB_SYSTEM_DEPENDENT_06 + + .. attribute:: FreeList + + :class:`PVOID` + + + .. attribute:: SparePebPtr0 + + :class:`PVOID` + + + .. attribute:: ApiSetMap + + :class:`PVOID` + +_ANON_PEB_SYSTEM_DEPENDENT_07 +''''''''''''''''''''''''''''' +.. class:: _ANON_PEB_SYSTEM_DEPENDENT_07 + + .. attribute:: ReadOnlySharedMemoryHeap + + :class:`PVOID` + + + .. attribute:: HotpatchInformation + + :class:`PVOID` + + + .. attribute:: SparePvoid0 + + :class:`PVOID` + +_ANON_PEB_UNION_1 +''''''''''''''''' +.. class:: _ANON_PEB_UNION_1 + + .. attribute:: KernelCallbackTable + + :class:`PVOID` + + + .. attribute:: UserSharedInfoPtr + + :class:`PVOID` + +_ANON_PEB_UNION_2 +''''''''''''''''' +.. class:: _ANON_PEB_UNION_2 + + .. attribute:: ImageProcessAffinityMask + + :class:`PVOID` + + + .. attribute:: ActiveProcessAffinityMask + + :class:`PVOID` + +_PEB +'''' +.. class:: PEB + + Alias for :class:`_PEB` + +.. class:: PPEB + + Pointer to :class:`_PEB` + +.. class:: _PEB + + .. attribute:: Reserved1 + + :class:`BYTE` ``[2]`` + + + .. attribute:: BeingDebugged + + :class:`BYTE` + + + .. attribute:: Reserved2 + + :class:`BYTE` + + + .. attribute:: Mutant + + :class:`PVOID` + + + .. attribute:: ImageBaseAddress + + :class:`PVOID` + + + .. attribute:: Ldr + + :class:`PPEB_LDR_DATA` + + + .. attribute:: ProcessParameters + + :class:`PRTL_USER_PROCESS_PARAMETERS` + + + .. attribute:: SubSystemData + + :class:`PVOID` + + + .. attribute:: ProcessHeap + + :class:`PVOID` + + + .. attribute:: FastPebLock + + :class:`PVOID` + + + .. attribute:: _SYSTEM_DEPENDENT_02 + + :class:`_ANON_PEB_SYSTEM_DEPENDENT_02` + + + .. attribute:: _SYSTEM_DEPENDENT_03 + + :class:`_ANON_PEB_SYSTEM_DEPENDENT_03` + + + .. attribute:: _SYSTEM_DEPENDENT_04 + + :class:`PVOID` + + + .. attribute:: anon_01 + + :class:`_ANON__PEB_SUB_UNION_1` + + + .. attribute:: SystemReserved + + :class:`DWORD` + + + .. attribute:: _SYSTEM_DEPENDENT_05 + + :class:`DWORD` + + + .. attribute:: _SYSTEM_DEPENDENT_06 + + :class:`_ANON_PEB_SYSTEM_DEPENDENT_06` + + + .. attribute:: TlsExpansionCounter + + :class:`PVOID` + + + .. attribute:: TlsBitmap + + :class:`PVOID` + + + .. attribute:: TlsBitmapBits + + :class:`DWORD` ``[2]`` + + + .. attribute:: ReadOnlySharedMemoryBase + + :class:`PVOID` + + + .. attribute:: _SYSTEM_DEPENDENT_07 + + :class:`_ANON_PEB_SYSTEM_DEPENDENT_07` + + + .. attribute:: ReadOnlyStaticServerData + + :class:`PVOID` + + + .. attribute:: AnsiCodePageData + + :class:`PVOID` + + + .. attribute:: OemCodePageData + + :class:`PVOID` + + + .. attribute:: UnicodeCaseTableData + + :class:`PVOID` + + + .. attribute:: NumberOfProcessors + + :class:`DWORD` + + + .. attribute:: NtGlobalFlag + + :class:`DWORD` + + + .. attribute:: CriticalSectionTimeout + + :class:`LARGE_INTEGER` + + + .. attribute:: HeapSegmentReserve + + :class:`PVOID` + + + .. attribute:: HeapSegmentCommit + + :class:`PVOID` + + + .. attribute:: HeapDeCommitTotalFreeThreshold + + :class:`PVOID` + + + .. attribute:: HeapDeCommitFreeBlockThreshold + + :class:`PVOID` + + + .. attribute:: NumberOfHeaps + + :class:`DWORD` + + + .. attribute:: MaximumNumberOfHeaps + + :class:`DWORD` + + + .. attribute:: ProcessHeaps + + :class:`PVOID` + + + .. attribute:: GdiSharedHandleTable + + :class:`PVOID` + + + .. attribute:: ProcessStarterHelper + + :class:`PVOID` + + + .. attribute:: GdiDCAttributeList + + :class:`PVOID` + + + .. attribute:: LoaderLock + + :class:`PVOID` + + + .. attribute:: OSMajorVersion + + :class:`DWORD` + + + .. attribute:: OSMinorVersion + + :class:`DWORD` + + + .. attribute:: OSBuildNumber + + :class:`WORD` + + + .. attribute:: OSCSDVersion + + :class:`WORD` + + + .. attribute:: OSPlatformId + + :class:`DWORD` + + + .. attribute:: ImageSubsystem + + :class:`DWORD` + + + .. attribute:: ImageSubsystemMajorVersion + + :class:`DWORD` + + + .. attribute:: ImageSubsystemMinorVersion + + :class:`PVOID` + + + .. attribute:: anon_02 + + :class:`_ANON__PEB_SUB_UNION_2` + + + .. attribute:: GdiHandleBuffer + + :class:`PVOID` ``[26]`` + + + .. attribute:: GdiHandleBuffer2 + + :class:`BYTE` ``[32]`` + + + .. attribute:: PostProcessInitRoutine + + :class:`PVOID` + + + .. attribute:: TlsExpansionBitmap + + :class:`PVOID` + + + .. attribute:: TlsExpansionBitmapBits + + :class:`DWORD` ``[32]`` + + + .. attribute:: SessionId + + :class:`PVOID` + + + .. attribute:: AppCompatFlags + + :class:`ULARGE_INTEGER` + + + .. attribute:: AppCompatFlagsUser + + :class:`ULARGE_INTEGER` + + + .. attribute:: pShimData + + :class:`PVOID` + + + .. attribute:: AppCompatInfo + + :class:`PVOID` + + + .. attribute:: CSDVersion + + :class:`UNICODE_STRING` + + + .. attribute:: ActivationContextData + + :class:`PVOID` + + + .. attribute:: ProcessAssemblyStorageMap + + :class:`PVOID` + + + .. attribute:: SystemDefaultActivationContextData + + :class:`PVOID` + + + .. attribute:: SystemAssemblyStorageMap + + :class:`PVOID` + + + .. attribute:: MinimumStackCommit + + :class:`PVOID` + +_EXCEPTION_REGISTRATION_RECORD +'''''''''''''''''''''''''''''' +.. class:: _EXCEPTION_REGISTRATION_RECORD + + .. attribute:: Next + + :class:`_EXCEPTION_REGISTRATION_RECORD` + + + .. attribute:: Handler + + :class:`PVOID` + +_NT_TIB +''''''' +.. class:: NT_TIB + + Alias for :class:`_NT_TIB` + +.. class:: _NT_TIB + + .. attribute:: ExceptionList + + :class:`_EXCEPTION_REGISTRATION_RECORD` + + + .. attribute:: StackBase + + :class:`PVOID` + + + .. attribute:: StackLimit + + :class:`PVOID` + + + .. attribute:: SubSystemTib + + :class:`PVOID` + + + .. attribute:: anon_01 + + :class:`_ANON__NT_TIB_SUB_UNION_1` + + + .. attribute:: ArbitraryUserPointer + + :class:`PVOID` + + + .. attribute:: Self + + :class:`_NT_TIB` + +_TEB +'''' +.. class:: TEB + + Alias for :class:`_TEB` + +.. class:: _TEB + + .. attribute:: NtTib + + :class:`_NT_TIB` + + + .. attribute:: EnvironmentPointer + + :class:`PVOID` + + + .. attribute:: ClientId + + :class:`_CLIENT_ID` + + + .. attribute:: ActiveRpcHandle + + :class:`PVOID` + + + .. attribute:: ThreadLocalStoragePointer + + :class:`PVOID` + + + .. attribute:: ProcessEnvironmentBlock + + :class:`_PEB` + + + .. attribute:: LastErrorValue + + :class:`ULONG` + + + .. attribute:: CountOfOwnedCriticalSections + + :class:`ULONG` + + + .. attribute:: CsrClientThread + + :class:`PVOID` + + + .. attribute:: Win32ThreadInfo + + :class:`PVOID` + + + .. attribute:: User32Reserved + + :class:`ULONG` ``[26]`` + + + .. attribute:: UserReserved + + :class:`ULONG` ``[5]`` + + + .. attribute:: WOW32Reserved + + :class:`PVOID` + + + .. attribute:: CurrentLocale + + :class:`ULONG` + + + .. attribute:: FpSoftwareStatusRegister + + :class:`ULONG` + +_ARM64_NT_NEON128 +''''''''''''''''' +.. class:: ARM64_NT_NEON128 + + Alias for :class:`_ARM64_NT_NEON128` + +.. class:: PARM64_NT_NEON128 + + Pointer to :class:`_ARM64_NT_NEON128` + +.. class:: _ARM64_NT_NEON128 + + .. attribute:: DUMMYSTRUCTNAME + + :class:`_ANON__ARM64_NT_NEON128_SUB_STRUCTURE_1` + + + .. attribute:: D + + :class:`DOUBLE` ``[2]`` + + + .. attribute:: S + + :class:`FLOAT` ``[4]`` + + + .. attribute:: H + + :class:`WORD` ``[8]`` + + + .. attribute:: B + + :class:`BYTE` ``[16]`` + +_ARM64_NT_CONTEXT +''''''''''''''''' +.. class:: ARM64_NT_CONTEXT + + Alias for :class:`_ARM64_NT_CONTEXT` + +.. class:: PARM64_NT_CONTEXT + + Pointer to :class:`_ARM64_NT_CONTEXT` + +.. class:: _ARM64_NT_CONTEXT + + .. attribute:: ContextFlags + + :class:`DWORD` + + + .. attribute:: Cpsr + + :class:`DWORD` + + + .. attribute:: DUMMYUNIONNAME + + :class:`_ANON__ARM64_NT_CONTEXT_SUB_UNION_1` + + + .. attribute:: Sp + + :class:`DWORD64` + + + .. attribute:: Pc + + :class:`DWORD64` + + + .. attribute:: V + + :class:`ARM64_NT_NEON128` ``[32]`` + + + .. attribute:: Fpcr + + :class:`DWORD` + + + .. attribute:: Fpsr + + :class:`DWORD` + + + .. attribute:: Bcr + + :class:`DWORD` ``[ARM64_MAX_BREAKPOINTS]`` + + + .. attribute:: Bvr + + :class:`DWORD64` ``[ARM64_MAX_BREAKPOINTS]`` + + + .. attribute:: Wcr + + :class:`DWORD` ``[ARM64_MAX_WATCHPOINTS]`` + + + .. attribute:: Wvr + + :class:`DWORD64` ``[ARM64_MAX_WATCHPOINTS]`` + +_FLOATING_SAVE_AREA +''''''''''''''''''' +.. class:: FLOATING_SAVE_AREA + + Alias for :class:`_FLOATING_SAVE_AREA` + +.. class:: _FLOATING_SAVE_AREA + + .. attribute:: ControlWord + + :class:`DWORD` + + + .. attribute:: StatusWord + + :class:`DWORD` + + + .. attribute:: TagWord + + :class:`DWORD` + + + .. attribute:: ErrorOffset + + :class:`DWORD` + + + .. attribute:: ErrorSelector + + :class:`DWORD` + + + .. attribute:: DataOffset + + :class:`DWORD` + + + .. attribute:: DataSelector + + :class:`DWORD` + + + .. attribute:: RegisterArea + + :class:`BYTE` ``[80]`` + + + .. attribute:: Cr0NpxState + + :class:`DWORD` + +_CONTEXT32 +'''''''''' +.. class:: CONTEXT32 + + Alias for :class:`_CONTEXT32` + +.. class:: LPCONTEXT32 + + Pointer to :class:`_CONTEXT32` + +.. class:: PCONTEXT32 + + Pointer to :class:`_CONTEXT32` + +.. class:: _CONTEXT32 + + .. attribute:: ContextFlags + + :class:`DWORD` + + + .. attribute:: Dr0 + + :class:`DWORD` + + + .. attribute:: Dr1 + + :class:`DWORD` + + + .. attribute:: Dr2 + + :class:`DWORD` + + + .. attribute:: Dr3 + + :class:`DWORD` + + + .. attribute:: Dr6 + + :class:`DWORD` + + + .. attribute:: Dr7 + + :class:`DWORD` + + + .. attribute:: FloatSave + + :class:`FLOATING_SAVE_AREA` + + + .. attribute:: SegGs + + :class:`DWORD` + + + .. attribute:: SegFs + + :class:`DWORD` + + + .. attribute:: SegEs + + :class:`DWORD` + + + .. attribute:: SegDs + + :class:`DWORD` + + + .. attribute:: Edi + + :class:`DWORD` + + + .. attribute:: Esi + + :class:`DWORD` + + + .. attribute:: Ebx + + :class:`DWORD` + + + .. attribute:: Edx + + :class:`DWORD` + + + .. attribute:: Ecx + + :class:`DWORD` + + + .. attribute:: Eax + + :class:`DWORD` + + + .. attribute:: Ebp + + :class:`DWORD` + + + .. attribute:: Eip + + :class:`DWORD` + + + .. attribute:: SegCs + + :class:`DWORD` + + + .. attribute:: EFlags + + :class:`DWORD` + + + .. attribute:: Esp + + :class:`DWORD` + + + .. attribute:: SegSs + + :class:`DWORD` + + + .. attribute:: ExtendedRegisters + + :class:`BYTE` ``[512]`` + +_WOW64_FLOATING_SAVE_AREA +''''''''''''''''''''''''' +.. class:: WOW64_FLOATING_SAVE_AREA + + Alias for :class:`_WOW64_FLOATING_SAVE_AREA` + +.. class:: _WOW64_FLOATING_SAVE_AREA + + .. attribute:: ControlWord + + :class:`DWORD` + + + .. attribute:: StatusWord + + :class:`DWORD` + + + .. attribute:: TagWord + + :class:`DWORD` + + + .. attribute:: ErrorOffset + + :class:`DWORD` + + + .. attribute:: ErrorSelector + + :class:`DWORD` + + + .. attribute:: DataOffset + + :class:`DWORD` + + + .. attribute:: DataSelector + + :class:`DWORD` + + + .. attribute:: RegisterArea + + :class:`BYTE` ``[WOW64_SIZE_OF_80387_REGISTERS]`` + + + .. attribute:: Cr0NpxState + + :class:`DWORD` + +_WOW64_CONTEXT +'''''''''''''' +.. class:: PWOW64_CONTEXT + + Pointer to :class:`_WOW64_CONTEXT` + +.. class:: WOW64_CONTEXT + + Alias for :class:`_WOW64_CONTEXT` + +.. class:: _WOW64_CONTEXT + + .. attribute:: ContextFlags + + :class:`DWORD` + + + .. attribute:: Dr0 + + :class:`DWORD` + + + .. attribute:: Dr1 + + :class:`DWORD` + + + .. attribute:: Dr2 + + :class:`DWORD` + + + .. attribute:: Dr3 + + :class:`DWORD` + + + .. attribute:: Dr6 + + :class:`DWORD` + + + .. attribute:: Dr7 + + :class:`DWORD` + + + .. attribute:: FloatSave + + :class:`WOW64_FLOATING_SAVE_AREA` + + + .. attribute:: SegGs + + :class:`DWORD` + + + .. attribute:: SegFs + + :class:`DWORD` + + + .. attribute:: SegEs + + :class:`DWORD` + + + .. attribute:: SegDs + + :class:`DWORD` + + + .. attribute:: Edi + + :class:`DWORD` + + + .. attribute:: Esi + + :class:`DWORD` + + + .. attribute:: Ebx + + :class:`DWORD` + + + .. attribute:: Edx + + :class:`DWORD` + + + .. attribute:: Ecx + + :class:`DWORD` + + + .. attribute:: Eax + + :class:`DWORD` + + + .. attribute:: Ebp + + :class:`DWORD` + + + .. attribute:: Eip + + :class:`DWORD` + + + .. attribute:: SegCs + + :class:`DWORD` + + + .. attribute:: EFlags + + :class:`DWORD` + + + .. attribute:: Esp + + :class:`DWORD` + + + .. attribute:: SegSs + + :class:`DWORD` + + + .. attribute:: ExtendedRegisters + + :class:`BYTE` ``[WOW64_MAXIMUM_SUPPORTED_EXTENSION]`` + +_M128A +'''''' +.. class:: M128A + + Alias for :class:`_M128A` + +.. class:: PM128A + + Pointer to :class:`_M128A` + +.. class:: _M128A + + .. attribute:: Low + + :class:`ULONGLONG` + + + .. attribute:: High + + :class:`LONGLONG` + +_XSAVE_FORMAT_64 +'''''''''''''''' +.. class:: PXSAVE_FORMAT_64 + + Pointer to :class:`_XSAVE_FORMAT_64` + +.. class:: XSAVE_FORMAT_64 + + Alias for :class:`_XSAVE_FORMAT_64` + +.. class:: _XSAVE_FORMAT_64 + + .. attribute:: ControlWord + + :class:`WORD` + + + .. attribute:: StatusWord + + :class:`WORD` + + + .. attribute:: TagWord + + :class:`BYTE` + + + .. attribute:: Reserved1 + + :class:`BYTE` + + + .. attribute:: ErrorOpcode + + :class:`WORD` + + + .. attribute:: ErrorOffset + + :class:`DWORD` + + + .. attribute:: ErrorSelector + + :class:`WORD` + + + .. attribute:: Reserved2 + + :class:`WORD` + + + .. attribute:: DataOffset + + :class:`DWORD` + + + .. attribute:: DataSelector + + :class:`WORD` + + + .. attribute:: Reserved3 + + :class:`WORD` + + + .. attribute:: MxCsr + + :class:`DWORD` + + + .. attribute:: MxCsr_Mask + + :class:`DWORD` + + + .. attribute:: FloatRegisters + + :class:`M128A` ``[8]`` + + + .. attribute:: XmmRegisters + + :class:`M128A` ``[16]`` + + + .. attribute:: Reserved4 + + :class:`BYTE` ``[96]`` + +_XSAVE_FORMAT_32 +'''''''''''''''' +.. class:: PXSAVE_FORMAT_32 + + Pointer to :class:`_XSAVE_FORMAT_32` + +.. class:: XSAVE_FORMAT_32 + + Alias for :class:`_XSAVE_FORMAT_32` + +.. class:: _XSAVE_FORMAT_32 + + .. attribute:: ControlWord + + :class:`WORD` + + + .. attribute:: StatusWord + + :class:`WORD` + + + .. attribute:: TagWord + + :class:`BYTE` + + + .. attribute:: Reserved1 + + :class:`BYTE` + + + .. attribute:: ErrorOpcode + + :class:`WORD` + + + .. attribute:: ErrorOffset + + :class:`DWORD` + + + .. attribute:: ErrorSelector + + :class:`WORD` + + + .. attribute:: Reserved2 + + :class:`WORD` + + + .. attribute:: DataOffset + + :class:`DWORD` + + + .. attribute:: DataSelector + + :class:`WORD` + + + .. attribute:: Reserved3 + + :class:`WORD` + + + .. attribute:: MxCsr + + :class:`DWORD` + + + .. attribute:: MxCsr_Mask + + :class:`DWORD` + + + .. attribute:: FloatRegisters + + :class:`M128A` ``[8]`` + + + .. attribute:: XmmRegisters + + :class:`M128A` ``[8]`` + + + .. attribute:: Reserved4 + + :class:`BYTE` ``[192]`` + + + .. attribute:: StackControl + + :class:`DWORD` ``[7]`` + + + .. attribute:: Cr0NpxState + + :class:`DWORD` + +_CONTEXT64 +'''''''''' +.. class:: CONTEXT64 + + Alias for :class:`_CONTEXT64` + +.. class:: LPCONTEXT64 + + Pointer to :class:`_CONTEXT64` + +.. class:: PCONTEXT64 + + Pointer to :class:`_CONTEXT64` + +.. class:: _CONTEXT64 + + .. attribute:: P1Home + + :class:`DWORD64` + + + .. attribute:: P2Home + + :class:`DWORD64` + + + .. attribute:: P3Home + + :class:`DWORD64` + + + .. attribute:: P4Home + + :class:`DWORD64` + + + .. attribute:: P5Home + + :class:`DWORD64` + + + .. attribute:: P6Home + + :class:`DWORD64` + + + .. attribute:: ContextFlags + + :class:`DWORD` + + + .. attribute:: MxCsr + + :class:`DWORD` + + + .. attribute:: SegCs + + :class:`WORD` + + + .. attribute:: SegDs + + :class:`WORD` + + + .. attribute:: SegEs + + :class:`WORD` + + + .. attribute:: SegFs + + :class:`WORD` + + + .. attribute:: SegGs + + :class:`WORD` + + + .. attribute:: SegSs + + :class:`WORD` + + + .. attribute:: EFlags + + :class:`DWORD` + + + .. attribute:: Dr0 + + :class:`DWORD64` + + + .. attribute:: Dr1 + + :class:`DWORD64` + + + .. attribute:: Dr2 + + :class:`DWORD64` + + + .. attribute:: Dr3 + + :class:`DWORD64` + + + .. attribute:: Dr6 + + :class:`DWORD64` + + + .. attribute:: Dr7 + + :class:`DWORD64` + + + .. attribute:: Rax + + :class:`DWORD64` + + + .. attribute:: Rcx + + :class:`DWORD64` + + + .. attribute:: Rdx + + :class:`DWORD64` + + + .. attribute:: Rbx + + :class:`DWORD64` + + + .. attribute:: Rsp + + :class:`DWORD64` + + + .. attribute:: Rbp + + :class:`DWORD64` + + + .. attribute:: Rsi + + :class:`DWORD64` + + + .. attribute:: Rdi + + :class:`DWORD64` + + + .. attribute:: R8 + + :class:`DWORD64` + + + .. attribute:: R9 + + :class:`DWORD64` + + + .. attribute:: R10 + + :class:`DWORD64` + + + .. attribute:: R11 + + :class:`DWORD64` + + + .. attribute:: R12 + + :class:`DWORD64` + + + .. attribute:: R13 + + :class:`DWORD64` + + + .. attribute:: R14 + + :class:`DWORD64` + + + .. attribute:: R15 + + :class:`DWORD64` + + + .. attribute:: Rip + + :class:`DWORD64` + + + .. attribute:: DUMMYUNIONNAME + + :class:`_ANON__CONTEXT64_SUB_UNION_1` + + + .. attribute:: VectorRegister + + :class:`M128A` ``[26]`` + + + .. attribute:: VectorControl + + :class:`DWORD64` + + + .. attribute:: DebugControl + + :class:`DWORD64` + + + .. attribute:: LastBranchToRip + + :class:`DWORD64` + + + .. attribute:: LastBranchFromRip + + :class:`DWORD64` + + + .. attribute:: LastExceptionToRip + + :class:`DWORD64` + + + .. attribute:: LastExceptionFromRip + + :class:`DWORD64` + _TRACE_PROVIDER_INFO '''''''''''''''''''' .. class:: TRACE_PROVIDER_INFO @@ -9976,728 +12753,6 @@ tagWNDCLASSEXW :class:`HICON` -_LIST_ENTRY -''''''''''' -.. class:: LIST_ENTRY - - Alias for :class:`_LIST_ENTRY` - -.. class:: PLIST_ENTRY - - Pointer to :class:`_LIST_ENTRY` - -.. class:: PRLIST_ENTRY - - Pointer to :class:`_LIST_ENTRY` - -.. class:: _LIST_ENTRY - - .. attribute:: Flink - - :class:`_LIST_ENTRY` - - - .. attribute:: Blink - - :class:`_LIST_ENTRY` - -_PEB_LDR_DATA -''''''''''''' -.. class:: PEB_LDR_DATA - - Alias for :class:`_PEB_LDR_DATA` - -.. class:: PPEB_LDR_DATA - - Pointer to :class:`_PEB_LDR_DATA` - -.. class:: _PEB_LDR_DATA - - .. attribute:: Reserved1 - - :class:`BYTE` ``[8]`` - - - .. attribute:: Reserved2 - - :class:`PVOID` ``[3]`` - - - .. attribute:: InMemoryOrderModuleList - - :class:`LIST_ENTRY` - -_LSA_UNICODE_STRING -''''''''''''''''''' -.. class:: LSA_UNICODE_STRING - - Alias for :class:`_LSA_UNICODE_STRING` - -.. class:: PLSA_UNICODE_STRING - - Pointer to :class:`_LSA_UNICODE_STRING` - -.. class:: PUNICODE_STRING - - Pointer to :class:`_LSA_UNICODE_STRING` - -.. class:: UNICODE_STRING - - Alias for :class:`_LSA_UNICODE_STRING` - -.. class:: _LSA_UNICODE_STRING - - .. attribute:: Length - - :class:`USHORT` - - - .. attribute:: MaximumLength - - :class:`USHORT` - - - .. attribute:: Buffer - - :class:`PVOID` - -_CURDIR -''''''' -.. class:: CURDIR - - Alias for :class:`_CURDIR` - -.. class:: PCURDIR - - Pointer to :class:`_CURDIR` - -.. class:: _CURDIR - - .. attribute:: DosPath - - :class:`UNICODE_STRING` - - - .. attribute:: Handle - - :class:`PVOID` - -_RTL_DRIVE_LETTER_CURDIR -'''''''''''''''''''''''' -.. class:: PRTL_DRIVE_LETTER_CURDIR - - Pointer to :class:`_RTL_DRIVE_LETTER_CURDIR` - -.. class:: RTL_DRIVE_LETTER_CURDIR - - Alias for :class:`_RTL_DRIVE_LETTER_CURDIR` - -.. class:: _RTL_DRIVE_LETTER_CURDIR - - .. attribute:: Flags - - :class:`WORD` - - - .. attribute:: Length - - :class:`WORD` - - - .. attribute:: TimeStamp - - :class:`ULONG` - - - .. attribute:: DosPath - - :class:`UNICODE_STRING` - -_RTL_USER_PROCESS_PARAMETERS -'''''''''''''''''''''''''''' -.. class:: PRTL_USER_PROCESS_PARAMETERS - - Pointer to :class:`_RTL_USER_PROCESS_PARAMETERS` - -.. class:: RTL_USER_PROCESS_PARAMETERS - - Alias for :class:`_RTL_USER_PROCESS_PARAMETERS` - -.. class:: _RTL_USER_PROCESS_PARAMETERS - - .. attribute:: MaximumLength - - :class:`ULONG` - - - .. attribute:: Length - - :class:`ULONG` - - - .. attribute:: Flags - - :class:`ULONG` - - - .. attribute:: DebugFlags - - :class:`ULONG` - - - .. attribute:: ConsoleHandle - - :class:`PVOID` - - - .. attribute:: ConsoleFlags - - :class:`ULONG` - - - .. attribute:: StandardInput - - :class:`PVOID` - - - .. attribute:: StandardOutput - - :class:`PVOID` - - - .. attribute:: StandardError - - :class:`PVOID` - - - .. attribute:: CurrentDirectory - - :class:`CURDIR` - - - .. attribute:: DllPath - - :class:`UNICODE_STRING` - - - .. attribute:: ImagePathName - - :class:`UNICODE_STRING` - - - .. attribute:: CommandLine - - :class:`UNICODE_STRING` - - - .. attribute:: Environment - - :class:`PVOID` - - - .. attribute:: StartingX - - :class:`ULONG` - - - .. attribute:: StartingY - - :class:`ULONG` - - - .. attribute:: CountX - - :class:`ULONG` - - - .. attribute:: CountY - - :class:`ULONG` - - - .. attribute:: CountCharsX - - :class:`ULONG` - - - .. attribute:: CountCharsY - - :class:`ULONG` - - - .. attribute:: FillAttribute - - :class:`ULONG` - - - .. attribute:: WindowFlags - - :class:`ULONG` - - - .. attribute:: ShowWindowFlags - - :class:`ULONG` - - - .. attribute:: WindowTitle - - :class:`UNICODE_STRING` - - - .. attribute:: DesktopInfo - - :class:`UNICODE_STRING` - - - .. attribute:: ShellInfo - - :class:`UNICODE_STRING` - - - .. attribute:: RuntimeData - - :class:`UNICODE_STRING` - - - .. attribute:: CurrentDirectores - - :class:`RTL_DRIVE_LETTER_CURDIR` ``[32]`` - -_ANON_PEB_SYSTEM_DEPENDENT_02 -''''''''''''''''''''''''''''' -.. class:: _ANON_PEB_SYSTEM_DEPENDENT_02 - - .. attribute:: FastPebLockRoutine - - :class:`PVOID` - - - .. attribute:: SparePtr1 - - :class:`PVOID` - - - .. attribute:: AtlThunkSListPtr - - :class:`PVOID` - -_ANON_PEB_SYSTEM_DEPENDENT_03 -''''''''''''''''''''''''''''' -.. class:: _ANON_PEB_SYSTEM_DEPENDENT_03 - - .. attribute:: FastPebUnlockRoutine - - :class:`PVOID` - - - .. attribute:: SparePtr2 - - :class:`PVOID` - - - .. attribute:: IFEOKey - - :class:`PVOID` - -_ANON_PEB_SYSTEM_DEPENDENT_06 -''''''''''''''''''''''''''''' -.. class:: _ANON_PEB_SYSTEM_DEPENDENT_06 - - .. attribute:: FreeList - - :class:`PVOID` - - - .. attribute:: SparePebPtr0 - - :class:`PVOID` - - - .. attribute:: ApiSetMap - - :class:`PVOID` - -_ANON_PEB_SYSTEM_DEPENDENT_07 -''''''''''''''''''''''''''''' -.. class:: _ANON_PEB_SYSTEM_DEPENDENT_07 - - .. attribute:: ReadOnlySharedMemoryHeap - - :class:`PVOID` - - - .. attribute:: HotpatchInformation - - :class:`PVOID` - - - .. attribute:: SparePvoid0 - - :class:`PVOID` - -_ANON_PEB_UNION_1 -''''''''''''''''' -.. class:: _ANON_PEB_UNION_1 - - .. attribute:: KernelCallbackTable - - :class:`PVOID` - - - .. attribute:: UserSharedInfoPtr - - :class:`PVOID` - -_ANON_PEB_UNION_2 -''''''''''''''''' -.. class:: _ANON_PEB_UNION_2 - - .. attribute:: ImageProcessAffinityMask - - :class:`PVOID` - - - .. attribute:: ActiveProcessAffinityMask - - :class:`PVOID` - -_PEB -'''' -.. class:: PEB - - Alias for :class:`_PEB` - -.. class:: PPEB - - Pointer to :class:`_PEB` - -.. class:: _PEB - - .. attribute:: Reserved1 - - :class:`BYTE` ``[2]`` - - - .. attribute:: BeingDebugged - - :class:`BYTE` - - - .. attribute:: Reserved2 - - :class:`BYTE` - - - .. attribute:: Mutant - - :class:`PVOID` - - - .. attribute:: ImageBaseAddress - - :class:`PVOID` - - - .. attribute:: Ldr - - :class:`PPEB_LDR_DATA` - - - .. attribute:: ProcessParameters - - :class:`PRTL_USER_PROCESS_PARAMETERS` - - - .. attribute:: SubSystemData - - :class:`PVOID` - - - .. attribute:: ProcessHeap - - :class:`PVOID` - - - .. attribute:: FastPebLock - - :class:`PVOID` - - - .. attribute:: _SYSTEM_DEPENDENT_02 - - :class:`_ANON_PEB_SYSTEM_DEPENDENT_02` - - - .. attribute:: _SYSTEM_DEPENDENT_03 - - :class:`_ANON_PEB_SYSTEM_DEPENDENT_03` - - - .. attribute:: _SYSTEM_DEPENDENT_04 - - :class:`PVOID` - - - .. attribute:: anon_01 - - :class:`_ANON__PEB_SUB_UNION_1` - - - .. attribute:: SystemReserved - - :class:`DWORD` - - - .. attribute:: _SYSTEM_DEPENDENT_05 - - :class:`DWORD` - - - .. attribute:: _SYSTEM_DEPENDENT_06 - - :class:`_ANON_PEB_SYSTEM_DEPENDENT_06` - - - .. attribute:: TlsExpansionCounter - - :class:`PVOID` - - - .. attribute:: TlsBitmap - - :class:`PVOID` - - - .. attribute:: TlsBitmapBits - - :class:`DWORD` ``[2]`` - - - .. attribute:: ReadOnlySharedMemoryBase - - :class:`PVOID` - - - .. attribute:: _SYSTEM_DEPENDENT_07 - - :class:`_ANON_PEB_SYSTEM_DEPENDENT_07` - - - .. attribute:: ReadOnlyStaticServerData - - :class:`PVOID` - - - .. attribute:: AnsiCodePageData - - :class:`PVOID` - - - .. attribute:: OemCodePageData - - :class:`PVOID` - - - .. attribute:: UnicodeCaseTableData - - :class:`PVOID` - - - .. attribute:: NumberOfProcessors - - :class:`DWORD` - - - .. attribute:: NtGlobalFlag - - :class:`DWORD` - - - .. attribute:: CriticalSectionTimeout - - :class:`LARGE_INTEGER` - - - .. attribute:: HeapSegmentReserve - - :class:`PVOID` - - - .. attribute:: HeapSegmentCommit - - :class:`PVOID` - - - .. attribute:: HeapDeCommitTotalFreeThreshold - - :class:`PVOID` - - - .. attribute:: HeapDeCommitFreeBlockThreshold - - :class:`PVOID` - - - .. attribute:: NumberOfHeaps - - :class:`DWORD` - - - .. attribute:: MaximumNumberOfHeaps - - :class:`DWORD` - - - .. attribute:: ProcessHeaps - - :class:`PVOID` - - - .. attribute:: GdiSharedHandleTable - - :class:`PVOID` - - - .. attribute:: ProcessStarterHelper - - :class:`PVOID` - - - .. attribute:: GdiDCAttributeList - - :class:`PVOID` - - - .. attribute:: LoaderLock - - :class:`PVOID` - - - .. attribute:: OSMajorVersion - - :class:`DWORD` - - - .. attribute:: OSMinorVersion - - :class:`DWORD` - - - .. attribute:: OSBuildNumber - - :class:`WORD` - - - .. attribute:: OSCSDVersion - - :class:`WORD` - - - .. attribute:: OSPlatformId - - :class:`DWORD` - - - .. attribute:: ImageSubsystem - - :class:`DWORD` - - - .. attribute:: ImageSubsystemMajorVersion - - :class:`DWORD` - - - .. attribute:: ImageSubsystemMinorVersion - - :class:`PVOID` - - - .. attribute:: anon_02 - - :class:`_ANON__PEB_SUB_UNION_2` - - - .. attribute:: GdiHandleBuffer - - :class:`PVOID` ``[26]`` - - - .. attribute:: GdiHandleBuffer2 - - :class:`BYTE` ``[32]`` - - - .. attribute:: PostProcessInitRoutine - - :class:`PVOID` - - - .. attribute:: TlsExpansionBitmap - - :class:`PVOID` - - - .. attribute:: TlsExpansionBitmapBits - - :class:`DWORD` ``[32]`` - - - .. attribute:: SessionId - - :class:`PVOID` - - - .. attribute:: AppCompatFlags - - :class:`ULARGE_INTEGER` - - - .. attribute:: AppCompatFlagsUser - - :class:`ULARGE_INTEGER` - - - .. attribute:: pShimData - - :class:`PVOID` - - - .. attribute:: AppCompatInfo - - :class:`PVOID` - - - .. attribute:: CSDVersion - - :class:`UNICODE_STRING` - - - .. attribute:: ActivationContextData - - :class:`PVOID` - - - .. attribute:: ProcessAssemblyStorageMap - - :class:`PVOID` - - - .. attribute:: SystemDefaultActivationContextData - - :class:`PVOID` - - - .. attribute:: SystemAssemblyStorageMap - - :class:`PVOID` - - - .. attribute:: MinimumStackCommit - - :class:`PVOID` - _SECURITY_ATTRIBUTES '''''''''''''''''''' .. class:: LPSECURITY_ATTRIBUTES @@ -10885,135 +12940,6 @@ _SYSTEM_PROCESS_ID_INFORMATION :class:`UNICODE_STRING` -_CLIENT_ID -'''''''''' -.. class:: CLIENT_ID - - Alias for :class:`_CLIENT_ID` - -.. class:: PCLIENT_ID - - Pointer to :class:`_CLIENT_ID` - -.. class:: _CLIENT_ID - - .. attribute:: UniqueProcess - - :class:`HANDLE` - - - .. attribute:: UniqueThread - - :class:`HANDLE` - -_CLIENT_ID64 -'''''''''''' -.. class:: CLIENT_ID64 - - Alias for :class:`_CLIENT_ID64` - -.. class:: PCLIENT_ID64 - - Pointer to :class:`_CLIENT_ID64` - -.. class:: _CLIENT_ID64 - - .. attribute:: UniqueProcess - - :class:`ULONG64` - - - .. attribute:: UniqueThread - - :class:`ULONG64` - -_CLIENT_ID32 -'''''''''''' -.. class:: CLIENT_ID32 - - Alias for :class:`_CLIENT_ID32` - -.. class:: PCLIENT_ID32 - - Pointer to :class:`_CLIENT_ID32` - -.. class:: _CLIENT_ID32 - - .. attribute:: UniqueProcess - - :class:`ULONG` - - - .. attribute:: UniqueThread - - :class:`ULONG` - -_LDR_DATA_TABLE_ENTRY -''''''''''''''''''''' -.. class:: LDR_DATA_TABLE_ENTRY - - Alias for :class:`_LDR_DATA_TABLE_ENTRY` - -.. class:: PLDR_DATA_TABLE_ENTRY - - Pointer to :class:`_LDR_DATA_TABLE_ENTRY` - -.. class:: _LDR_DATA_TABLE_ENTRY - - .. attribute:: Reserved1 - - :class:`PVOID` ``[2]`` - - - .. attribute:: InMemoryOrderLinks - - :class:`LIST_ENTRY` - - - .. attribute:: Reserved2 - - :class:`PVOID` ``[2]`` - - - .. attribute:: DllBase - - :class:`PVOID` - - - .. attribute:: EntryPoint - - :class:`PVOID` - - - .. attribute:: SizeOfImage - - :class:`PVOID` - - - .. attribute:: FullDllName - - :class:`UNICODE_STRING` - - - .. attribute:: BaseDllName - - :class:`UNICODE_STRING` - - - .. attribute:: Reserved5 - - :class:`PVOID` ``[3]`` - - - .. attribute:: CheckSum - - :class:`ULONG` - - - .. attribute:: TimeDateStamp - - :class:`ULONG` - _MEMORY_BASIC_INFORMATION ''''''''''''''''''''''''' .. class:: MEMORY_BASIC_INFORMATION @@ -11704,958 +13630,6 @@ _PROCESS_INFORMATION :class:`DWORD` -_FLOATING_SAVE_AREA -''''''''''''''''''' -.. class:: FLOATING_SAVE_AREA - - Alias for :class:`_FLOATING_SAVE_AREA` - -.. class:: _FLOATING_SAVE_AREA - - .. attribute:: ControlWord - - :class:`DWORD` - - - .. attribute:: StatusWord - - :class:`DWORD` - - - .. attribute:: TagWord - - :class:`DWORD` - - - .. attribute:: ErrorOffset - - :class:`DWORD` - - - .. attribute:: ErrorSelector - - :class:`DWORD` - - - .. attribute:: DataOffset - - :class:`DWORD` - - - .. attribute:: DataSelector - - :class:`DWORD` - - - .. attribute:: RegisterArea - - :class:`BYTE` ``[80]`` - - - .. attribute:: Cr0NpxState - - :class:`DWORD` - -_CONTEXT32 -'''''''''' -.. class:: CONTEXT32 - - Alias for :class:`_CONTEXT32` - -.. class:: LPCONTEXT32 - - Pointer to :class:`_CONTEXT32` - -.. class:: PCONTEXT32 - - Pointer to :class:`_CONTEXT32` - -.. class:: _CONTEXT32 - - .. attribute:: ContextFlags - - :class:`DWORD` - - - .. attribute:: Dr0 - - :class:`DWORD` - - - .. attribute:: Dr1 - - :class:`DWORD` - - - .. attribute:: Dr2 - - :class:`DWORD` - - - .. attribute:: Dr3 - - :class:`DWORD` - - - .. attribute:: Dr6 - - :class:`DWORD` - - - .. attribute:: Dr7 - - :class:`DWORD` - - - .. attribute:: FloatSave - - :class:`FLOATING_SAVE_AREA` - - - .. attribute:: SegGs - - :class:`DWORD` - - - .. attribute:: SegFs - - :class:`DWORD` - - - .. attribute:: SegEs - - :class:`DWORD` - - - .. attribute:: SegDs - - :class:`DWORD` - - - .. attribute:: Edi - - :class:`DWORD` - - - .. attribute:: Esi - - :class:`DWORD` - - - .. attribute:: Ebx - - :class:`DWORD` - - - .. attribute:: Edx - - :class:`DWORD` - - - .. attribute:: Ecx - - :class:`DWORD` - - - .. attribute:: Eax - - :class:`DWORD` - - - .. attribute:: Ebp - - :class:`DWORD` - - - .. attribute:: Eip - - :class:`DWORD` - - - .. attribute:: SegCs - - :class:`DWORD` - - - .. attribute:: EFlags - - :class:`DWORD` - - - .. attribute:: Esp - - :class:`DWORD` - - - .. attribute:: SegSs - - :class:`DWORD` - - - .. attribute:: ExtendedRegisters - - :class:`BYTE` ``[512]`` - -_WOW64_FLOATING_SAVE_AREA -''''''''''''''''''''''''' -.. class:: WOW64_FLOATING_SAVE_AREA - - Alias for :class:`_WOW64_FLOATING_SAVE_AREA` - -.. class:: _WOW64_FLOATING_SAVE_AREA - - .. attribute:: ControlWord - - :class:`DWORD` - - - .. attribute:: StatusWord - - :class:`DWORD` - - - .. attribute:: TagWord - - :class:`DWORD` - - - .. attribute:: ErrorOffset - - :class:`DWORD` - - - .. attribute:: ErrorSelector - - :class:`DWORD` - - - .. attribute:: DataOffset - - :class:`DWORD` - - - .. attribute:: DataSelector - - :class:`DWORD` - - - .. attribute:: RegisterArea - - :class:`BYTE` ``[WOW64_SIZE_OF_80387_REGISTERS]`` - - - .. attribute:: Cr0NpxState - - :class:`DWORD` - -_WOW64_CONTEXT -'''''''''''''' -.. class:: PWOW64_CONTEXT - - Pointer to :class:`_WOW64_CONTEXT` - -.. class:: WOW64_CONTEXT - - Alias for :class:`_WOW64_CONTEXT` - -.. class:: _WOW64_CONTEXT - - .. attribute:: ContextFlags - - :class:`DWORD` - - - .. attribute:: Dr0 - - :class:`DWORD` - - - .. attribute:: Dr1 - - :class:`DWORD` - - - .. attribute:: Dr2 - - :class:`DWORD` - - - .. attribute:: Dr3 - - :class:`DWORD` - - - .. attribute:: Dr6 - - :class:`DWORD` - - - .. attribute:: Dr7 - - :class:`DWORD` - - - .. attribute:: FloatSave - - :class:`WOW64_FLOATING_SAVE_AREA` - - - .. attribute:: SegGs - - :class:`DWORD` - - - .. attribute:: SegFs - - :class:`DWORD` - - - .. attribute:: SegEs - - :class:`DWORD` - - - .. attribute:: SegDs - - :class:`DWORD` - - - .. attribute:: Edi - - :class:`DWORD` - - - .. attribute:: Esi - - :class:`DWORD` - - - .. attribute:: Ebx - - :class:`DWORD` - - - .. attribute:: Edx - - :class:`DWORD` - - - .. attribute:: Ecx - - :class:`DWORD` - - - .. attribute:: Eax - - :class:`DWORD` - - - .. attribute:: Ebp - - :class:`DWORD` - - - .. attribute:: Eip - - :class:`DWORD` - - - .. attribute:: SegCs - - :class:`DWORD` - - - .. attribute:: EFlags - - :class:`DWORD` - - - .. attribute:: Esp - - :class:`DWORD` - - - .. attribute:: SegSs - - :class:`DWORD` - - - .. attribute:: ExtendedRegisters - - :class:`BYTE` ``[WOW64_MAXIMUM_SUPPORTED_EXTENSION]`` - -_M128A -'''''' -.. class:: M128A - - Alias for :class:`_M128A` - -.. class:: PM128A - - Pointer to :class:`_M128A` - -.. class:: _M128A - - .. attribute:: Low - - :class:`ULONGLONG` - - - .. attribute:: High - - :class:`LONGLONG` - -_XSAVE_FORMAT_64 -'''''''''''''''' -.. class:: PXSAVE_FORMAT_64 - - Pointer to :class:`_XSAVE_FORMAT_64` - -.. class:: XSAVE_FORMAT_64 - - Alias for :class:`_XSAVE_FORMAT_64` - -.. class:: _XSAVE_FORMAT_64 - - .. attribute:: ControlWord - - :class:`WORD` - - - .. attribute:: StatusWord - - :class:`WORD` - - - .. attribute:: TagWord - - :class:`BYTE` - - - .. attribute:: Reserved1 - - :class:`BYTE` - - - .. attribute:: ErrorOpcode - - :class:`WORD` - - - .. attribute:: ErrorOffset - - :class:`DWORD` - - - .. attribute:: ErrorSelector - - :class:`WORD` - - - .. attribute:: Reserved2 - - :class:`WORD` - - - .. attribute:: DataOffset - - :class:`DWORD` - - - .. attribute:: DataSelector - - :class:`WORD` - - - .. attribute:: Reserved3 - - :class:`WORD` - - - .. attribute:: MxCsr - - :class:`DWORD` - - - .. attribute:: MxCsr_Mask - - :class:`DWORD` - - - .. attribute:: FloatRegisters - - :class:`M128A` ``[8]`` - - - .. attribute:: XmmRegisters - - :class:`M128A` ``[16]`` - - - .. attribute:: Reserved4 - - :class:`BYTE` ``[96]`` - -_XSAVE_FORMAT_32 -'''''''''''''''' -.. class:: PXSAVE_FORMAT_32 - - Pointer to :class:`_XSAVE_FORMAT_32` - -.. class:: XSAVE_FORMAT_32 - - Alias for :class:`_XSAVE_FORMAT_32` - -.. class:: _XSAVE_FORMAT_32 - - .. attribute:: ControlWord - - :class:`WORD` - - - .. attribute:: StatusWord - - :class:`WORD` - - - .. attribute:: TagWord - - :class:`BYTE` - - - .. attribute:: Reserved1 - - :class:`BYTE` - - - .. attribute:: ErrorOpcode - - :class:`WORD` - - - .. attribute:: ErrorOffset - - :class:`DWORD` - - - .. attribute:: ErrorSelector - - :class:`WORD` - - - .. attribute:: Reserved2 - - :class:`WORD` - - - .. attribute:: DataOffset - - :class:`DWORD` - - - .. attribute:: DataSelector - - :class:`WORD` - - - .. attribute:: Reserved3 - - :class:`WORD` - - - .. attribute:: MxCsr - - :class:`DWORD` - - - .. attribute:: MxCsr_Mask - - :class:`DWORD` - - - .. attribute:: FloatRegisters - - :class:`M128A` ``[8]`` - - - .. attribute:: XmmRegisters - - :class:`M128A` ``[8]`` - - - .. attribute:: Reserved4 - - :class:`BYTE` ``[192]`` - - - .. attribute:: StackControl - - :class:`DWORD` ``[7]`` - - - .. attribute:: Cr0NpxState - - :class:`DWORD` - -_TMP_DUMMYSTRUCTNAME -'''''''''''''''''''' -.. class:: TMP_DUMMYSTRUCTNAME - - Alias for :class:`_TMP_DUMMYSTRUCTNAME` - -.. class:: _TMP_DUMMYSTRUCTNAME - - .. attribute:: Header - - :class:`M128A` ``[2]`` - - - .. attribute:: Legacy - - :class:`M128A` ``[8]`` - - - .. attribute:: Xmm0 - - :class:`M128A` - - - .. attribute:: Xmm1 - - :class:`M128A` - - - .. attribute:: Xmm2 - - :class:`M128A` - - - .. attribute:: Xmm3 - - :class:`M128A` - - - .. attribute:: Xmm4 - - :class:`M128A` - - - .. attribute:: Xmm5 - - :class:`M128A` - - - .. attribute:: Xmm6 - - :class:`M128A` - - - .. attribute:: Xmm7 - - :class:`M128A` - - - .. attribute:: Xmm8 - - :class:`M128A` - - - .. attribute:: Xmm9 - - :class:`M128A` - - - .. attribute:: Xmm10 - - :class:`M128A` - - - .. attribute:: Xmm11 - - :class:`M128A` - - - .. attribute:: Xmm12 - - :class:`M128A` - - - .. attribute:: Xmm13 - - :class:`M128A` - - - .. attribute:: Xmm14 - - :class:`M128A` - - - .. attribute:: Xmm15 - - :class:`M128A` - -_TMP_CONTEXT64_SUBUNION -''''''''''''''''''''''' -.. class:: TMP_CONTEXT64_SUBUNION - - Alias for :class:`_TMP_CONTEXT64_SUBUNION` - -.. class:: _TMP_CONTEXT64_SUBUNION - - .. attribute:: FltSave - - :class:`XSAVE_FORMAT_64` - - - .. attribute:: DUMMYSTRUCTNAME - - :class:`TMP_DUMMYSTRUCTNAME` - -_CONTEXT64 -'''''''''' -.. class:: CONTEXT64 - - Alias for :class:`_CONTEXT64` - -.. class:: LPCONTEXT64 - - Pointer to :class:`_CONTEXT64` - -.. class:: PCONTEXT64 - - Pointer to :class:`_CONTEXT64` - -.. class:: _CONTEXT64 - - .. attribute:: P1Home - - :class:`DWORD64` - - - .. attribute:: P2Home - - :class:`DWORD64` - - - .. attribute:: P3Home - - :class:`DWORD64` - - - .. attribute:: P4Home - - :class:`DWORD64` - - - .. attribute:: P5Home - - :class:`DWORD64` - - - .. attribute:: P6Home - - :class:`DWORD64` - - - .. attribute:: ContextFlags - - :class:`DWORD` - - - .. attribute:: MxCsr - - :class:`DWORD` - - - .. attribute:: SegCs - - :class:`WORD` - - - .. attribute:: SegDs - - :class:`WORD` - - - .. attribute:: SegEs - - :class:`WORD` - - - .. attribute:: SegFs - - :class:`WORD` - - - .. attribute:: SegGs - - :class:`WORD` - - - .. attribute:: SegSs - - :class:`WORD` - - - .. attribute:: EFlags - - :class:`DWORD` - - - .. attribute:: Dr0 - - :class:`DWORD64` - - - .. attribute:: Dr1 - - :class:`DWORD64` - - - .. attribute:: Dr2 - - :class:`DWORD64` - - - .. attribute:: Dr3 - - :class:`DWORD64` - - - .. attribute:: Dr6 - - :class:`DWORD64` - - - .. attribute:: Dr7 - - :class:`DWORD64` - - - .. attribute:: Rax - - :class:`DWORD64` - - - .. attribute:: Rcx - - :class:`DWORD64` - - - .. attribute:: Rdx - - :class:`DWORD64` - - - .. attribute:: Rbx - - :class:`DWORD64` - - - .. attribute:: Rsp - - :class:`DWORD64` - - - .. attribute:: Rbp - - :class:`DWORD64` - - - .. attribute:: Rsi - - :class:`DWORD64` - - - .. attribute:: Rdi - - :class:`DWORD64` - - - .. attribute:: R8 - - :class:`DWORD64` - - - .. attribute:: R9 - - :class:`DWORD64` - - - .. attribute:: R10 - - :class:`DWORD64` - - - .. attribute:: R11 - - :class:`DWORD64` - - - .. attribute:: R12 - - :class:`DWORD64` - - - .. attribute:: R13 - - :class:`DWORD64` - - - .. attribute:: R14 - - :class:`DWORD64` - - - .. attribute:: R15 - - :class:`DWORD64` - - - .. attribute:: Rip - - :class:`DWORD64` - - - .. attribute:: DUMMYUNIONNAME - - :class:`TMP_CONTEXT64_SUBUNION` - - - .. attribute:: VectorRegister - - :class:`M128A` ``[26]`` - - - .. attribute:: VectorControl - - :class:`DWORD64` - - - .. attribute:: DebugControl - - :class:`DWORD64` - - - .. attribute:: LastBranchToRip - - :class:`DWORD64` - - - .. attribute:: LastBranchFromRip - - :class:`DWORD64` - - - .. attribute:: LastExceptionToRip - - :class:`DWORD64` - - - .. attribute:: LastExceptionFromRip - - :class:`DWORD64` - tagPROCESSENTRY32W '''''''''''''''''' .. class:: LPPROCESSENTRY32W @@ -20143,6 +21117,42 @@ _STRUCT_PLAINTEXTKEYBLOB :class:`BYTE` ``[0]`` +_CERT_REQUEST_INFO +'''''''''''''''''' +.. class:: CERT_REQUEST_INFO + + Alias for :class:`_CERT_REQUEST_INFO` + +.. class:: PCERT_REQUEST_INFO + + Pointer to :class:`_CERT_REQUEST_INFO` + +.. class:: _CERT_REQUEST_INFO + + .. attribute:: dwVersion + + :class:`DWORD` + + + .. attribute:: Subject + + :class:`CERT_NAME_BLOB` + + + .. attribute:: SubjectPublicKeyInfo + + :class:`CERT_PUBLIC_KEY_INFO` + + + .. attribute:: cAttribute + + :class:`DWORD` + + + .. attribute:: rgAttribute + + :class:`PCRYPT_ATTRIBUTE` + _EXCEPTION_DEBUG_INFO ''''''''''''''''''''' .. class:: EXCEPTION_DEBUG_INFO @@ -24875,235 +25885,6 @@ _EXPLICIT_ACCESS_W :class:`TRUSTEE_W` -_SYSTEM_PROCESS_INFORMATION -''''''''''''''''''''''''''' -.. class:: PSYSTEM_PROCESS_INFORMATION - - Pointer to :class:`_SYSTEM_PROCESS_INFORMATION` - -.. class:: SYSTEM_PROCESS_INFORMATION - - Alias for :class:`_SYSTEM_PROCESS_INFORMATION` - -.. class:: _SYSTEM_PROCESS_INFORMATION - - .. attribute:: NextEntryOffset - - :class:`ULONG` - - - .. attribute:: NumberOfThreads - - :class:`ULONG` - - - .. attribute:: Reserved1 - - :class:`BYTE` ``[24]`` - - - .. attribute:: CreateTime - - :class:`LARGE_INTEGER` - - - .. attribute:: UserTime - - :class:`LARGE_INTEGER` - - - .. attribute:: KernelTime - - :class:`LARGE_INTEGER` - - - .. attribute:: ImageName - - :class:`UNICODE_STRING` - - - .. attribute:: BasePriority - - :class:`LONG` - - - .. attribute:: UniqueProcessId - - :class:`HANDLE` - - - .. attribute:: InheritedFromUniqueProcessId - - :class:`PVOID` - - - .. attribute:: HandleCount - - :class:`ULONG` - - - .. attribute:: Reserved4 - - :class:`BYTE` ``[4]`` - - - .. attribute:: Reserved5 - - :class:`PVOID` - - - .. attribute:: PeakVirtualSize - - :class:`PVOID` - - - .. attribute:: VirtualSize - - :class:`PVOID` - - - .. attribute:: PageFaultCount - - :class:`PVOID` - - - .. attribute:: PeakWorkingSetSize - - :class:`PVOID` - - - .. attribute:: WorkingSetSize - - :class:`PVOID` - - - .. attribute:: QuotaPeakPagedPoolUsage - - :class:`PVOID` - - - .. attribute:: QuotaPagedPoolUsage - - :class:`PVOID` - - - .. attribute:: QuotaPeakNonPagedPoolUsage - - :class:`PVOID` - - - .. attribute:: QuotaNonPagedPoolUsage - - :class:`PVOID` - - - .. attribute:: PagefileUsage - - :class:`PVOID` - - - .. attribute:: PeakPagefileUsage - - :class:`SIZE_T` - - - .. attribute:: PrivatePageCount - - :class:`SIZE_T` - - - .. attribute:: Reserved6 - - :class:`LARGE_INTEGER` ``[6]`` - -_SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION -''''''''''''''''''''''''''''''''''''''''' -.. class:: PSYSTEM_PROCESSOR_PERFORMANCE_INFORMATION - - Pointer to :class:`_SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION` - -.. class:: SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION - - Alias for :class:`_SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION` - -.. class:: _SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION - - .. attribute:: IdleTime - - :class:`LARGE_INTEGER` - - - .. attribute:: KernelTime - - :class:`LARGE_INTEGER` - - - .. attribute:: UserTime - - :class:`LARGE_INTEGER` - - - .. attribute:: Reserved1 - - :class:`LARGE_INTEGER` ``[2]`` - - - .. attribute:: Reserved2 - - :class:`ULONG` - -_SYSTEM_REGISTRY_QUOTA_INFORMATION -'''''''''''''''''''''''''''''''''' -.. class:: PSYSTEM_REGISTRY_QUOTA_INFORMATION - - Pointer to :class:`_SYSTEM_REGISTRY_QUOTA_INFORMATION` - -.. class:: SYSTEM_REGISTRY_QUOTA_INFORMATION - - Alias for :class:`_SYSTEM_REGISTRY_QUOTA_INFORMATION` - -.. class:: _SYSTEM_REGISTRY_QUOTA_INFORMATION - - .. attribute:: RegistryQuotaAllowed - - :class:`ULONG` - - - .. attribute:: RegistryQuotaUsed - - :class:`ULONG` - - - .. attribute:: Reserved1 - - :class:`PVOID` - -_SYSTEM_BASIC_INFORMATION -''''''''''''''''''''''''' -.. class:: PSYSTEM_BASIC_INFORMATION - - Pointer to :class:`_SYSTEM_BASIC_INFORMATION` - -.. class:: SYSTEM_BASIC_INFORMATION - - Alias for :class:`_SYSTEM_BASIC_INFORMATION` - -.. class:: _SYSTEM_BASIC_INFORMATION - - .. attribute:: Reserved1 - - :class:`BYTE` ``[24]`` - - - .. attribute:: Reserved2 - - :class:`PVOID` ``[4]`` - - - .. attribute:: NumberOfProcessors - - :class:`CHAR` - _TIME_ZONE_INFORMATION '''''''''''''''''''''' .. class:: LPTIME_ZONE_INFORMATION @@ -28690,6 +29471,473 @@ _KEY_INFORMATION_CLASS .. attribute:: MaxKeyInfoClass(10) +_PROC_THREAD_ATTRIBUTE_NUM +'''''''''''''''''''''''''' +.. class:: PROC_THREAD_ATTRIBUTE_NUM + + Alias for :class:`_PROC_THREAD_ATTRIBUTE_NUM` + + +.. class:: _PROC_THREAD_ATTRIBUTE_NUM + + + .. attribute:: ProcThreadAttributeParentProcess(0) + + + .. attribute:: ProcThreadAttributeHandleList(2) + + + .. attribute:: ProcThreadAttributeGroupAffinity(3) + + + .. attribute:: ProcThreadAttributePreferredNode(4) + + + .. attribute:: ProcThreadAttributeIdealProcessor(5) + + + .. attribute:: ProcThreadAttributeUmsThread(6) + + + .. attribute:: ProcThreadAttributeMitigationPolicy(7) + + + .. attribute:: ProcThreadAttributeSecurityCapabilities(9) + + + .. attribute:: ProcThreadAttributeProtectionLevel(11) + + + .. attribute:: ProcThreadAttributeJobList(13) + + + .. attribute:: ProcThreadAttributeChildProcessPolicy(14) + + + .. attribute:: ProcThreadAttributeAllApplicationPackagesPolicy(15) + + + .. attribute:: ProcThreadAttributeWin32kFilter(16) + + + .. attribute:: ProcThreadAttributeSafeOpenPromptOriginClaim(17) + + + .. attribute:: ProcThreadAttributeDesktopAppPolicy(18) + + + .. attribute:: ProcThreadAttributePseudoConsole(22) + + + .. attribute:: ProcThreadAttributeMitigationAuditPolicy(24) + + + .. attribute:: ProcThreadAttributeMachineType(25) + + + .. attribute:: ProcThreadAttributeComponentFilter(26) + + + .. attribute:: ProcThreadAttributeEnableOptionalXStateFeatures(27) + + + .. attribute:: ProcThreadAttributeTrustedApp(29) + + + .. attribute:: ProcThreadAttributeSveVectorLength(30) + +_MEMORY_INFORMATION_CLASS +''''''''''''''''''''''''' +.. class:: MEMORY_INFORMATION_CLASS + + Alias for :class:`_MEMORY_INFORMATION_CLASS` + + +.. class:: _MEMORY_INFORMATION_CLASS + + + .. attribute:: MemoryBasicInformation(0) + + + .. attribute:: MemoryWorkingSetList(1) + + + .. attribute:: MemorySectionName(2) + + + .. attribute:: MemoryBasicVlmInformation(3) + + + .. attribute:: MemoryWorkingSetListEx(4) + +_THREAD_INFORMATION_CLASS +''''''''''''''''''''''''' +.. class:: PTHREAD_INFORMATION_CLASS + + Pointer to :class:`_THREAD_INFORMATION_CLASS` + + +.. class:: THREAD_INFORMATION_CLASS + + Alias for :class:`_THREAD_INFORMATION_CLASS` + + +.. class:: _THREAD_INFORMATION_CLASS + + + .. attribute:: ThreadBasicInformation(0) + + + .. attribute:: ThreadTimes(1) + + + .. attribute:: ThreadPriority(2) + + + .. attribute:: ThreadBasePriority(3) + + + .. attribute:: ThreadAffinityMask(4) + + + .. attribute:: ThreadImpersonationToken(5) + + + .. attribute:: ThreadDescriptorTableEntry(6) + + + .. attribute:: ThreadEnableAlignmentFaultFixup(7) + + + .. attribute:: ThreadEventPair(8) + + + .. attribute:: ThreadQuerySetWin32StartAddress(9) + + + .. attribute:: ThreadZeroTlsCell(10) + + + .. attribute:: ThreadPerformanceCount(11) + + + .. attribute:: ThreadAmILastThread(12) + + + .. attribute:: ThreadIdealProcessor(13) + + + .. attribute:: ThreadPriorityBoost(14) + + + .. attribute:: ThreadSetTlsArrayAddress(15) + + + .. attribute:: ThreadIsIoPending(16) + + + .. attribute:: ThreadHideFromDebugger(17) + +_PROCESSINFOCLASS +''''''''''''''''' +.. class:: PROCESSINFOCLASS + + Alias for :class:`_PROCESSINFOCLASS` + + +.. class:: _PROCESSINFOCLASS + + + .. attribute:: ProcessBasicInformation(0) + + + .. attribute:: ProcessQuotaLimits(1) + + + .. attribute:: ProcessIoCounters(2) + + + .. attribute:: ProcessVmCounters(3) + + + .. attribute:: ProcessTimes(4) + + + .. attribute:: ProcessBasePriority(5) + + + .. attribute:: ProcessRaisePriority(6) + + + .. attribute:: ProcessDebugPort(7) + + + .. attribute:: ProcessExceptionPort(8) + + + .. attribute:: ProcessAccessToken(9) + + + .. attribute:: ProcessLdtInformation(10) + + + .. attribute:: ProcessLdtSize(11) + + + .. attribute:: ProcessDefaultHardErrorMode(12) + + + .. attribute:: ProcessIoPortHandlers(13) + + + .. attribute:: ProcessPooledUsageAndLimits(14) + + + .. attribute:: ProcessWorkingSetWatch(15) + + + .. attribute:: ProcessUserModeIOPL(16) + + + .. attribute:: ProcessEnableAlignmentFaultFixup(17) + + + .. attribute:: ProcessPriorityClass(18) + + + .. attribute:: ProcessWx86Information(19) + + + .. attribute:: ProcessHandleCount(20) + + + .. attribute:: ProcessAffinityMask(21) + + + .. attribute:: ProcessPriorityBoost(22) + + + .. attribute:: ProcessDeviceMap(23) + + + .. attribute:: ProcessSessionInformation(24) + + + .. attribute:: ProcessForegroundInformation(25) + + + .. attribute:: ProcessWow64Information(26) + + + .. attribute:: ProcessImageFileName(27) + + + .. attribute:: ProcessLUIDDeviceMapsEnabled(28) + + + .. attribute:: ProcessBreakOnTermination(29) + + + .. attribute:: ProcessDebugObjectHandle(30) + + + .. attribute:: ProcessDebugFlags(31) + + + .. attribute:: ProcessHandleTracing(32) + + + .. attribute:: ProcessIoPriority(33) + + + .. attribute:: ProcessExecuteFlags(34) + + + .. attribute:: ProcessTlsInformation(35) + + + .. attribute:: ProcessCookie(36) + + + .. attribute:: ProcessImageInformation(37) + + + .. attribute:: ProcessCycleTime(38) + + + .. attribute:: ProcessPagePriority(39) + + + .. attribute:: ProcessInstrumentationCallback(40) + + + .. attribute:: ProcessThreadStackAllocation(41) + + + .. attribute:: ProcessWorkingSetWatchEx(42) + + + .. attribute:: ProcessImageFileNameWin32(43) + + + .. attribute:: ProcessImageFileMapping(44) + + + .. attribute:: ProcessAffinityUpdateMode(45) + + + .. attribute:: ProcessMemoryAllocationMode(46) + + + .. attribute:: ProcessGroupInformation(47) + + + .. attribute:: ProcessTokenVirtualizationEnabled(48) + + + .. attribute:: ProcessOwnerInformation(49) + + + .. attribute:: ProcessWindowInformation(50) + + + .. attribute:: ProcessHandleInformation(51) + + + .. attribute:: ProcessMitigationPolicy(52) + + + .. attribute:: ProcessDynamicFunctionTableInformation(53) + + + .. attribute:: ProcessHandleCheckingMode(54) + + + .. attribute:: ProcessKeepAliveCount(55) + + + .. attribute:: ProcessRevokeFileHandles(56) + + + .. attribute:: ProcessWorkingSetControl(57) + + + .. attribute:: ProcessHandleTable(58) + + + .. attribute:: ProcessCheckStackExtentsMode(59) + + + .. attribute:: ProcessCommandLineInformation(60) + + + .. attribute:: ProcessProtectionInformation(61) + + + .. attribute:: ProcessMemoryExhaustion(62) + + + .. attribute:: ProcessFaultInformation(63) + + + .. attribute:: ProcessTelemetryIdInformation(64) + + + .. attribute:: ProcessCommitReleaseInformation(65) + + + .. attribute:: ProcessReserved1Information(66) + + + .. attribute:: ProcessReserved2Information(67) + + + .. attribute:: ProcessSubsystemProcess(68) + + + .. attribute:: ProcessInPrivate(70) + + + .. attribute:: ProcessRaiseUMExceptionOnInvalidHandleClose(71) + + + .. attribute:: ProcessSubsystemInformation(75) + + + .. attribute:: ProcessWin32kSyscallFilterInformation(79) + + + .. attribute:: ProcessEnergyTrackingState(82) + + + .. attribute:: MaxProcessInfoClass(83) + +_PROCESS_INFORMATION_CLASS +'''''''''''''''''''''''''' +.. class:: PROCESS_INFORMATION_CLASS + + Alias for :class:`_PROCESS_INFORMATION_CLASS` + + +.. class:: _PROCESS_INFORMATION_CLASS + + + .. attribute:: ProcessMemoryPriority(0) + + + .. attribute:: ProcessMemoryExhaustionInfo(1) + + + .. attribute:: ProcessAppMemoryInfo(2) + + + .. attribute:: ProcessInPrivateInfo(3) + + + .. attribute:: ProcessPowerThrottling(4) + + + .. attribute:: ProcessReservedValue1(5) + + + .. attribute:: ProcessTelemetryCoverageInfo(6) + + + .. attribute:: ProcessProtectionLevelInfo(7) + + + .. attribute:: ProcessLeapSecondInfo(8) + + + .. attribute:: ProcessMachineTypeInfo(9) + + + .. attribute:: ProcessOverrideSubsequentPrefetchParameter(10) + + + .. attribute:: ProcessMaxOverridePrefetchParameter(11) + + + .. attribute:: ProcessInformationClassMax(12) + +_MACHINE_ATTRIBUTES +''''''''''''''''''' +.. class:: MACHINE_ATTRIBUTES + + Alias for :class:`_MACHINE_ATTRIBUTES` + + +.. class:: _MACHINE_ATTRIBUTES + + + .. attribute:: UserEnabled(1) + + + .. attribute:: KernelEnabled(2) + + + .. attribute:: Wow64Container(4) + MEM_EXTENDED_PARAMETER_TYPE ''''''''''''''''''''''''''' .. class:: PMEM_EXTENDED_PARAMETER_TYPE @@ -29195,6 +30443,42 @@ ADDRESS_MODE .. attribute:: AddrModeFlat(3) +_COMPUTER_NAME_FORMAT +''''''''''''''''''''' +.. class:: COMPUTER_NAME_FORMAT + + Alias for :class:`_COMPUTER_NAME_FORMAT` + + +.. class:: _COMPUTER_NAME_FORMAT + + + .. attribute:: ComputerNameNetBIOS(0) + + + .. attribute:: ComputerNameDnsHostname(1) + + + .. attribute:: ComputerNameDnsDomain(2) + + + .. attribute:: ComputerNameDnsFullyQualified(3) + + + .. attribute:: ComputerNamePhysicalNetBIOS(4) + + + .. attribute:: ComputerNamePhysicalDnsHostname(5) + + + .. attribute:: ComputerNamePhysicalDnsDomain(6) + + + .. attribute:: ComputerNamePhysicalDnsFullyQualified(7) + + + .. attribute:: ComputerNameMax(8) + _TASK_ACTION_TYPE ''''''''''''''''' .. class:: TASK_ACTION_TYPE @@ -30429,332 +31713,6 @@ _SECTION_INHERIT .. attribute:: ViewUnmap(2) -_PROCESSINFOCLASS -''''''''''''''''' -.. class:: PROCESSINFOCLASS - - Alias for :class:`_PROCESSINFOCLASS` - - -.. class:: _PROCESSINFOCLASS - - - .. attribute:: ProcessBasicInformation(0) - - - .. attribute:: ProcessQuotaLimits(1) - - - .. attribute:: ProcessIoCounters(2) - - - .. attribute:: ProcessVmCounters(3) - - - .. attribute:: ProcessTimes(4) - - - .. attribute:: ProcessBasePriority(5) - - - .. attribute:: ProcessRaisePriority(6) - - - .. attribute:: ProcessDebugPort(7) - - - .. attribute:: ProcessExceptionPort(8) - - - .. attribute:: ProcessAccessToken(9) - - - .. attribute:: ProcessLdtInformation(10) - - - .. attribute:: ProcessLdtSize(11) - - - .. attribute:: ProcessDefaultHardErrorMode(12) - - - .. attribute:: ProcessIoPortHandlers(13) - - - .. attribute:: ProcessPooledUsageAndLimits(14) - - - .. attribute:: ProcessWorkingSetWatch(15) - - - .. attribute:: ProcessUserModeIOPL(16) - - - .. attribute:: ProcessEnableAlignmentFaultFixup(17) - - - .. attribute:: ProcessPriorityClass(18) - - - .. attribute:: ProcessWx86Information(19) - - - .. attribute:: ProcessHandleCount(20) - - - .. attribute:: ProcessAffinityMask(21) - - - .. attribute:: ProcessPriorityBoost(22) - - - .. attribute:: ProcessDeviceMap(23) - - - .. attribute:: ProcessSessionInformation(24) - - - .. attribute:: ProcessForegroundInformation(25) - - - .. attribute:: ProcessWow64Information(26) - - - .. attribute:: ProcessImageFileName(27) - - - .. attribute:: ProcessLUIDDeviceMapsEnabled(28) - - - .. attribute:: ProcessBreakOnTermination(29) - - - .. attribute:: ProcessDebugObjectHandle(30) - - - .. attribute:: ProcessDebugFlags(31) - - - .. attribute:: ProcessHandleTracing(32) - - - .. attribute:: ProcessIoPriority(33) - - - .. attribute:: ProcessExecuteFlags(34) - - - .. attribute:: ProcessTlsInformation(35) - - - .. attribute:: ProcessCookie(36) - - - .. attribute:: ProcessImageInformation(37) - - - .. attribute:: ProcessCycleTime(38) - - - .. attribute:: ProcessPagePriority(39) - - - .. attribute:: ProcessInstrumentationCallback(40) - - - .. attribute:: ProcessThreadStackAllocation(41) - - - .. attribute:: ProcessWorkingSetWatchEx(42) - - - .. attribute:: ProcessImageFileNameWin32(43) - - - .. attribute:: ProcessImageFileMapping(44) - - - .. attribute:: ProcessAffinityUpdateMode(45) - - - .. attribute:: ProcessMemoryAllocationMode(46) - - - .. attribute:: ProcessGroupInformation(47) - - - .. attribute:: ProcessTokenVirtualizationEnabled(48) - - - .. attribute:: ProcessOwnerInformation(49) - - - .. attribute:: ProcessWindowInformation(50) - - - .. attribute:: ProcessHandleInformation(51) - - - .. attribute:: ProcessMitigationPolicy(52) - - - .. attribute:: ProcessDynamicFunctionTableInformation(53) - - - .. attribute:: ProcessHandleCheckingMode(54) - - - .. attribute:: ProcessKeepAliveCount(55) - - - .. attribute:: ProcessRevokeFileHandles(56) - - - .. attribute:: ProcessWorkingSetControl(57) - - - .. attribute:: ProcessHandleTable(58) - - - .. attribute:: ProcessCheckStackExtentsMode(59) - - - .. attribute:: ProcessCommandLineInformation(60) - - - .. attribute:: ProcessProtectionInformation(61) - - - .. attribute:: ProcessMemoryExhaustion(62) - - - .. attribute:: ProcessFaultInformation(63) - - - .. attribute:: ProcessTelemetryIdInformation(64) - - - .. attribute:: ProcessCommitReleaseInformation(65) - - - .. attribute:: ProcessReserved1Information(66) - - - .. attribute:: ProcessReserved2Information(67) - - - .. attribute:: ProcessSubsystemProcess(68) - - - .. attribute:: ProcessInPrivate(70) - - - .. attribute:: ProcessRaiseUMExceptionOnInvalidHandleClose(71) - - - .. attribute:: ProcessSubsystemInformation(75) - - - .. attribute:: ProcessWin32kSyscallFilterInformation(79) - - - .. attribute:: ProcessEnergyTrackingState(82) - - - .. attribute:: MaxProcessInfoClass(83) - -_MEMORY_INFORMATION_CLASS -''''''''''''''''''''''''' -.. class:: MEMORY_INFORMATION_CLASS - - Alias for :class:`_MEMORY_INFORMATION_CLASS` - - -.. class:: _MEMORY_INFORMATION_CLASS - - - .. attribute:: MemoryBasicInformation(0) - - - .. attribute:: MemoryWorkingSetList(1) - - - .. attribute:: MemorySectionName(2) - - - .. attribute:: MemoryBasicVlmInformation(3) - - - .. attribute:: MemoryWorkingSetListEx(4) - -_THREAD_INFORMATION_CLASS -''''''''''''''''''''''''' -.. class:: PTHREAD_INFORMATION_CLASS - - Pointer to :class:`_THREAD_INFORMATION_CLASS` - - -.. class:: THREAD_INFORMATION_CLASS - - Alias for :class:`_THREAD_INFORMATION_CLASS` - - -.. class:: _THREAD_INFORMATION_CLASS - - - .. attribute:: ThreadBasicInformation(0) - - - .. attribute:: ThreadTimes(1) - - - .. attribute:: ThreadPriority(2) - - - .. attribute:: ThreadBasePriority(3) - - - .. attribute:: ThreadAffinityMask(4) - - - .. attribute:: ThreadImpersonationToken(5) - - - .. attribute:: ThreadDescriptorTableEntry(6) - - - .. attribute:: ThreadEnableAlignmentFaultFixup(7) - - - .. attribute:: ThreadEventPair(8) - - - .. attribute:: ThreadQuerySetWin32StartAddress(9) - - - .. attribute:: ThreadZeroTlsCell(10) - - - .. attribute:: ThreadPerformanceCount(11) - - - .. attribute:: ThreadAmILastThread(12) - - - .. attribute:: ThreadIdealProcessor(13) - - - .. attribute:: ThreadPriorityBoost(14) - - - .. attribute:: ThreadSetTlsArrayAddress(15) - - - .. attribute:: ThreadIsIoPending(16) - - - .. attribute:: ThreadHideFromDebugger(17) - _VARENUM '''''''' .. class:: VARENUM @@ -32995,42 +33953,6 @@ _ACCESS_MODE .. attribute:: SET_AUDIT_FAILURE(6) -_COMPUTER_NAME_FORMAT -''''''''''''''''''''' -.. class:: COMPUTER_NAME_FORMAT - - Alias for :class:`_COMPUTER_NAME_FORMAT` - - -.. class:: _COMPUTER_NAME_FORMAT - - - .. attribute:: ComputerNameNetBIOS(0) - - - .. attribute:: ComputerNameDnsHostname(1) - - - .. attribute:: ComputerNameDnsDomain(2) - - - .. attribute:: ComputerNameDnsFullyQualified(3) - - - .. attribute:: ComputerNamePhysicalNetBIOS(4) - - - .. attribute:: ComputerNamePhysicalDnsHostname(5) - - - .. attribute:: ComputerNamePhysicalDnsDomain(6) - - - .. attribute:: ComputerNamePhysicalDnsFullyQualified(7) - - - .. attribute:: ComputerNameMax(8) - TRACE_INFO_CLASS '''''''''''''''' .. class:: TRACE_QUERY_INFO_CLASS diff --git a/docs/build/html/crypto.html b/docs/build/html/crypto.html index 8b45229..614555c 100644 --- a/docs/build/html/crypto.html +++ b/docs/build/html/crypto.html @@ -375,6 +375,13 @@ See System Store Locations)

    +
    +
    +classmethod from_user_store(store_name, user=True)[source]
    +

    Create a new CertificateStore from system store store_name +(see System Store Locations)

    +
    +
    classmethod new_in_memory()[source]
    @@ -665,6 +672,7 @@ See from_file()
  • from_param()
  • from_system_store()
    • +
  • from_user_store()
  • new_in_memory()
  • value
    • diff --git a/docs/build/html/debug.html b/docs/build/html/debug.html index 9f23111..8a63be1 100644 --- a/docs/build/html/debug.html +++ b/docs/build/html/debug.html @@ -1050,7 +1050,7 @@ This can be completly virtual (particularly in the case of 
    >>> sh = windows.debug.symbols.VirtualSymbolHandler()
 >>> mod = sh.load_file(r"c:\windows\system32\kernelbase.dll")
 >>> mod.pdb
-'d:\symbols\wkernelbase.pdb\017FA9C5278235B7E6BFBA74A9A5AAD91\wkernelbase.pdb'
+'d:\\symbols\\wkernelbase.pdb\\017FA9C5278235B7E6BFBA74A9A5AAD91\\wkernelbase.pdb'
    diff --git a/docs/build/html/genindex.html b/docs/build/html/genindex.html index f4a6b87..24c2f80 100644 --- a/docs/build/html/genindex.html +++ b/docs/build/html/genindex.html @@ -141,6 +141,22 @@
  • __MIDL_IBackgroundCopyJob2_0003 (class in windows.generated_def.winstructs)
  • __MIDL_IBackgroundCopyJob2_0004 (class in windows.generated_def.winstructs) +
    • +
  • __MIDL_ILocalObjectExporter_0006 (class in windows.generated_def.winstructs) +
    • +
  • __MIDL_XmitDefs_0001_NT_1607 (class in windows.generated_def.winstructs) +
    • +
  • __MIDL_XmitDefs_0001_NT_63 (class in windows.generated_def.winstructs) +
    • +
  • __MIDL_XmitDefs_0002_NT_1607 (class in windows.generated_def.winstructs) +
    • +
  • __MIDL_XmitDefs_0005 (class in windows.generated_def.winstructs) +
    • +
  • __MIDL_XmitDefs_0007 (class in windows.generated_def.winstructs) +
    • +
  • __MIDL_XmitDefs_0008 (class in windows.generated_def.winstructs) +
    • +
  • __MIDL_XmitDefs_0010 (class in windows.generated_def.winstructs)
  • __PUBLIC_OBJECT_TYPE_INFORMATION (class in windows.generated_def.winstructs)
    • @@ -275,6 +291,10 @@
  • _API_SET_VALUE_ENTRY (class in windows.generated_def.winstructs)
  • _API_SET_VALUE_ENTRY_V2 (class in windows.generated_def.winstructs) +
    • +
  • _ARM64_NT_CONTEXT (class in windows.generated_def.winstructs) +
    • +
  • _ARM64_NT_NEON128 (class in windows.generated_def.winstructs)
  • _ATTACH_VIRTUAL_DISK_FLAG (class in windows.generated_def.winstructs)
    • @@ -339,6 +359,8 @@
  • _CERT_KEY_CONTEXT (class in windows.generated_def.winstructs)
  • _CERT_PUBLIC_KEY_INFO (class in windows.generated_def.winstructs) +
    • +
  • _CERT_REQUEST_INFO (class in windows.generated_def.winstructs)
  • _CERT_REVOCATION_CRL_INFO (class in windows.generated_def.winstructs)
    • @@ -623,6 +645,8 @@
  • _EXCEPTION_RECORD32 (class in windows.generated_def.winstructs)
  • _EXCEPTION_RECORD64 (class in windows.generated_def.winstructs) +
    • +
  • _EXCEPTION_REGISTRATION_RECORD (class in windows.generated_def.winstructs)
  • _EXIT_PROCESS_DEBUG_INFO (class in windows.generated_def.winstructs)
    • @@ -756,12 +780,12 @@
  • _IMAGEHLP_CBA_EVENT (class in windows.generated_def.winstructs)
    • + + - - +