Fixing some doc / samples

2026-06-08 14:31:45 +00:00 · 2018-03-27 21:24:56 +02:00
parent b88ce36acb
commit 83f4b0c48b
33 changed files with 9441 additions and 4548 deletions
@@ -34,7 +34,7 @@ TODO:
    - winobject\exception.py
        - large part could be rewritten with ctypes-generation extended-def

-    - add wonobject/window.py + wonobject/kernobj.py to System()
+    - add winobject/window.py + winobject/kernobj.py to System()
        - Some test/doc on both


@@ -44,6 +44,12 @@ TODO:
    - COM:
        - test https://msdn.microsoft.com/en-us/library/vs/alm/hh846255(v=vs.85).aspx

+    - Hook
+        - Probleme with enabled hook + gc
+            - Prevent GC of enabled hook ?
+            - Raise on deletion of enabled hook ?
+                - if I implem __del__ -> we have a __del__ cycle -> no gc (gc.garbage instead..)
+

 Documentation
    * verif samples
@@ -38,6 +38,7 @@
  <h1>All modules for which code is available</h1>
 <ul><li><a href="ctypes.html">ctypes</a></li>
 <li><a href="windows/alpc.html">windows.alpc</a></li>
+<li><a href="windows/com.html">windows.com</a></li>
 <li><a href="windows/crypto/certificate.html">windows.crypto.certificate</a></li>
 <li><a href="windows/crypto/cryptmsg.html">windows.crypto.cryptmsg</a></li>
 <li><a href="windows/crypto/encrypt_decrypt.html">windows.crypto.encrypt_decrypt</a></li>
@@ -0,0 +1,335 @@
+
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
+  "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+
+<html xmlns="http://www.w3.org/1999/xhtml">
+  <head>
+    <meta http-equiv="X-UA-Compatible" content="IE=Edge" />
+    <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
+    <title>windows.com &#8212; PythonForWindows 0.3 documentation</title>
+    <link rel="stylesheet" href="../../_static/classic.css" type="text/css" />
+    <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
+    <link rel="stylesheet" href="../../_static/css/mbasic.css" type="text/css" />
+    <script type="text/javascript" src="../../_static/documentation_options.js"></script>
+    <script type="text/javascript" src="../../_static/jquery.js"></script>
+    <script type="text/javascript" src="../../_static/underscore.js"></script>
+    <script type="text/javascript" src="../../_static/doctools.js"></script>
+    <link rel="index" title="Index" href="../../genindex.html" />
+    <link rel="search" title="Search" href="../../search.html" /> 
+  </head><body>
+    <div class="related" role="navigation" aria-label="related navigation">
+      <h3>Navigation</h3>
+      <ul>
+        <li class="right" style="margin-right: 10px">
+          <a href="../../genindex.html" title="General Index"
+             accesskey="I">index</a></li>
+        <li class="right" >
+          <a href="../../py-modindex.html" title="Python Module Index"
+             >modules</a> |</li>
+        <li class="nav-item nav-item-0"><a href="../../index.html">PythonForWindows 0.3 documentation</a> &#187;</li>
+          <li class="nav-item nav-item-1"><a href="../index.html" accesskey="U">Module code</a> &#187;</li> 
+      </ul>
+    </div>  
+
+    <div class="document">
+      <div class="documentwrapper">
+        <div class="bodywrapper">
+          <div class="body" role="main">
+            
+  <h1>Source code for windows.com</h1><div class="highlight"><pre>
+<span></span><span class="kn">import</span> <span class="nn">struct</span>
+<span class="kn">import</span> <span class="nn">ctypes</span>
+<span class="kn">import</span> <span class="nn">functools</span>
+<span class="kn">from</span> <span class="nn">ctypes.wintypes</span> <span class="k">import</span> <span class="n">HRESULT</span><span class="p">,</span> <span class="n">byref</span><span class="p">,</span> <span class="n">pointer</span><span class="p">,</span> <span class="n">cast</span>
+
+<span class="kn">import</span> <span class="nn">windows</span>
+<span class="kn">from</span> <span class="nn">windows</span> <span class="k">import</span> <span class="n">winproxy</span>
+<span class="kn">from</span> <span class="nn">windows.generated_def.winstructs</span> <span class="k">import</span> <span class="o">*</span>
+
+<span class="kn">from</span> <span class="nn">windows.generated_def</span> <span class="k">import</span> <span class="n">RPC_C_IMP_LEVEL_IMPERSONATE</span><span class="p">,</span> <span class="n">CLSCTX_INPROC_SERVER</span>
+<span class="kn">from</span> <span class="nn">windows.generated_def</span> <span class="k">import</span> <span class="n">interfaces</span>
+<span class="kn">from</span> <span class="nn">windows.generated_def.interfaces</span> <span class="k">import</span> <span class="n">generate_IID</span><span class="p">,</span> <span class="n">IID</span>
+
+
+<span class="c1"># Simple raw -&gt; UUID</span>
+<span class="c1"># &quot;-&quot;.join(&quot;{:02X}&quot;.format(c) for c in struct.unpack(&quot;&lt;IHHHBBBBBB&quot;, x))</span>
+
+<div class="viewcode-block" id="init"><a class="viewcode-back" href="../../com.html#windows.com.init">[docs]</a><span class="k">def</span> <span class="nf">init</span><span class="p">():</span>
+    <span class="sd">&quot;&quot;&quot;Init COM with some default parameters&quot;&quot;&quot;</span>
+    <span class="k">try</span><span class="p">:</span>
+        <span class="n">t</span> <span class="o">=</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">CoInitializeEx</span><span class="p">()</span>
+    <span class="k">except</span> <span class="ne">WindowsError</span> <span class="k">as</span> <span class="n">e</span><span class="p">:</span>
+        <span class="n">t</span> <span class="o">=</span> <span class="n">e</span><span class="o">.</span><span class="n">winerror</span>
+    <span class="k">if</span> <span class="n">t</span><span class="p">:</span>
+        <span class="k">return</span> <span class="n">t</span></div>
+    <span class="k">return</span> <span class="n">initsecurity</span><span class="p">()</span>
+
+<span class="k">def</span> <span class="nf">initsecurity</span><span class="p">():</span> <span class="c1"># Should take some parameters..</span>
+    <span class="k">return</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">CoInitializeSecurity</span><span class="p">(</span><span class="mi">0</span><span class="p">,</span> <span class="o">-</span><span class="mi">1</span><span class="p">,</span> <span class="kc">None</span><span class="p">,</span> <span class="mi">0</span><span class="p">,</span> <span class="mi">0</span><span class="p">,</span> <span class="n">RPC_C_IMP_LEVEL_IMPERSONATE</span><span class="p">,</span> <span class="mi">0</span><span class="p">,</span><span class="mi">0</span><span class="p">,</span><span class="mi">0</span><span class="p">)</span>
+
+
+<div class="viewcode-block" id="create_instance"><a class="viewcode-back" href="../../com.html#windows.com.create_instance">[docs]</a><span class="k">def</span> <span class="nf">create_instance</span><span class="p">(</span><span class="n">clsiid</span><span class="p">,</span> <span class="n">targetinterface</span><span class="p">,</span> <span class="n">custom_iid</span><span class="o">=</span><span class="kc">None</span><span class="p">,</span> <span class="n">context</span><span class="o">=</span><span class="n">CLSCTX_INPROC_SERVER</span> <span class="o">|</span> <span class="n">CLSCTX_LOCAL_SERVER</span><span class="p">):</span>
+    <span class="sd">&quot;&quot;&quot;A simple wrapper around ``CoCreateInstance &lt;https://msdn.microsoft.com/en-us/library/windows/desktop/ms686615(v=vs.85).aspx&gt;``&quot;&quot;&quot;</span>
+    <span class="k">if</span> <span class="n">custom_iid</span> <span class="ow">is</span> <span class="kc">None</span><span class="p">:</span>
+        <span class="n">custom_iid</span> <span class="o">=</span> <span class="n">targetinterface</span><span class="o">.</span><span class="n">IID</span></div>
+    <span class="k">return</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">CoCreateInstance</span><span class="p">(</span><span class="n">byref</span><span class="p">(</span><span class="n">clsiid</span><span class="p">),</span> <span class="kc">None</span><span class="p">,</span> <span class="n">context</span><span class="p">,</span> <span class="n">byref</span><span class="p">(</span><span class="n">custom_iid</span><span class="p">),</span> <span class="n">byref</span><span class="p">(</span><span class="n">targetinterface</span><span class="p">))</span>
+
+<span class="c1"># Improved COM object</span>
+<span class="c1"># Todo: ctypes_genertation extended struct ?</span>
+<span class="k">class</span> <span class="nc">ImprovedSAFEARRAY</span><span class="p">(</span><span class="n">SAFEARRAY</span><span class="p">):</span>
+        <span class="nd">@classmethod</span>
+        <span class="k">def</span> <span class="nf">of_type</span><span class="p">(</span><span class="bp">cls</span><span class="p">,</span> <span class="n">addr</span><span class="p">,</span> <span class="n">t</span><span class="p">):</span>
+            <span class="bp">self</span> <span class="o">=</span> <span class="bp">cls</span><span class="o">.</span><span class="n">from_address</span><span class="p">(</span><span class="n">addr</span><span class="p">)</span>
+            <span class="bp">self</span><span class="o">.</span><span class="n">elt_type</span> <span class="o">=</span> <span class="n">t</span>
+            <span class="k">return</span> <span class="bp">self</span>
+
+        <span class="nd">@classmethod</span>
+        <span class="k">def</span> <span class="nf">from_PSAFEARRAY</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">psafearray</span><span class="p">):</span>
+            <span class="n">res</span> <span class="o">=</span> <span class="n">cast</span><span class="p">(</span><span class="n">psafearray</span><span class="p">,</span> <span class="n">POINTER</span><span class="p">(</span><span class="n">ImprovedSAFEARRAY</span><span class="p">))[</span><span class="mi">0</span><span class="p">]</span>
+            <span class="k">return</span> <span class="n">res</span>
+
+        <span class="k">def</span> <span class="nf">to_list</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">t</span><span class="o">=</span><span class="kc">None</span><span class="p">):</span>
+            <span class="k">if</span> <span class="n">t</span> <span class="ow">is</span> <span class="kc">None</span><span class="p">:</span>
+                <span class="k">if</span> <span class="nb">hasattr</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="s2">&quot;elt_type&quot;</span><span class="p">):</span>
+                    <span class="n">t</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">elt_type</span>
+                <span class="k">else</span><span class="p">:</span>
+                    <span class="k">raise</span> <span class="ne">ValueError</span><span class="p">(</span><span class="s2">&quot;Missing type of the array&quot;</span><span class="p">)</span>
+            <span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">cDims</span> <span class="o">!=</span>  <span class="mi">1</span><span class="p">:</span>
+                <span class="k">raise</span> <span class="ne">NotImplementedError</span><span class="p">(</span><span class="s2">&quot;tagSAFEARRAY if dims != 1&quot;</span><span class="p">)</span>
+
+            <span class="n">nb_element</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">rgsabound</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span><span class="o">.</span><span class="n">cElements</span>
+            <span class="n">llbound</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">rgsabound</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span><span class="o">.</span><span class="n">lLbound</span>
+            <span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">cbElements</span> <span class="o">!=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">t</span><span class="p">):</span>
+                <span class="k">raise</span> <span class="ne">ValueError</span><span class="p">(</span><span class="s2">&quot;Size of elements != sizeof(type)&quot;</span><span class="p">)</span>
+            <span class="n">data</span> <span class="o">=</span> <span class="p">[</span><span class="n">t</span><span class="o">.</span><span class="n">from_address</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">pvData</span> <span class="o">+</span> <span class="p">(</span><span class="n">i</span> <span class="o">+</span> <span class="n">llbound</span><span class="p">)</span> <span class="o">*</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">t</span><span class="p">))</span><span class="o">.</span><span class="n">value</span> <span class="k">for</span> <span class="n">i</span> <span class="ow">in</span> <span class="nb">range</span><span class="p">(</span><span class="n">nb_element</span><span class="p">)]</span>
+            <span class="k">return</span> <span class="n">data</span>
+
+<span class="c1">#VT_VALUE_TO_TYPE = {</span>
+<span class="c1">#VT_I2 : SHORT,</span>
+<span class="c1">#VT_I4 : LONG,</span>
+<span class="c1">#VT_BSTR : BSTR,</span>
+<span class="c1">#VT_VARIANT : VARIANT,</span>
+<span class="c1">#VT_UI1 : UCHAR,</span>
+<span class="c1">#VT_UI2 : USHORT,</span>
+<span class="c1">#VT_UI4 : DWORD,</span>
+<span class="c1">#VT_I8 : LONGLONG,</span>
+<span class="c1">#VT_UI8 : ULONG64,</span>
+<span class="c1">#VT_INT : INT,</span>
+<span class="c1">#VT_UINT : UINT,</span>
+<span class="c1">#VT_HRESULT : HRESULT,</span>
+<span class="c1">#VT_PTR : PVOID,</span>
+<span class="c1">#VT_LPSTR : LPCSTR,</span>
+<span class="c1">#VT_LPWSTR : LPWSTR,</span>
+<span class="c1">#}</span>
+
+<span class="k">class</span> <span class="nc">ImprovedVariant</span><span class="p">(</span><span class="n">VARIANT</span><span class="p">):</span>
+    <span class="nd">@property</span>
+    <span class="k">def</span> <span class="nf">asbstr</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
+        <span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">vt</span> <span class="o">!=</span> <span class="n">VT_BSTR</span><span class="p">:</span>
+            <span class="k">raise</span> <span class="ne">ValueError</span><span class="p">(</span><span class="s2">&quot;asbstr on non-bstr variant&quot;</span><span class="p">)</span>
+        <span class="c1">#import pdb;pdb.set_trace()</span>
+        <span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">_VARIANT_NAME_3</span><span class="o">.</span><span class="n">bstrVal</span>
+
+    <span class="nd">@property</span>
+    <span class="k">def</span> <span class="nf">aslong</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
+        <span class="k">if</span> <span class="ow">not</span> <span class="bp">self</span><span class="o">.</span><span class="n">vt</span> <span class="ow">in</span> <span class="p">[</span><span class="n">VT_I4</span><span class="p">]:</span>
+            <span class="k">raise</span> <span class="ne">ValueError</span><span class="p">(</span><span class="s2">&quot;aslong on non-long variant&quot;</span><span class="p">)</span>
+        <span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">_VARIANT_NAME_3</span><span class="o">.</span><span class="n">lVal</span>
+
+    <span class="nd">@property</span>
+    <span class="k">def</span> <span class="nf">asbool</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
+        <span class="k">if</span> <span class="ow">not</span> <span class="bp">self</span><span class="o">.</span><span class="n">vt</span> <span class="ow">in</span> <span class="p">[</span><span class="n">VT_BOOL</span><span class="p">]:</span>
+            <span class="k">raise</span> <span class="ne">ValueError</span><span class="p">(</span><span class="s2">&quot;get_bstr on non-bool variant&quot;</span><span class="p">)</span>
+        <span class="k">return</span> <span class="nb">bool</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">_VARIANT_NAME_3</span><span class="o">.</span><span class="n">boolVal</span><span class="p">)</span>
+
+    <span class="nd">@property</span>
+    <span class="k">def</span> <span class="nf">asdispatch</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
+        <span class="k">if</span> <span class="ow">not</span> <span class="bp">self</span><span class="o">.</span><span class="n">vt</span> <span class="ow">in</span> <span class="p">[</span><span class="n">VT_DISPATCH</span><span class="p">]:</span>
+            <span class="k">raise</span> <span class="ne">ValueError</span><span class="p">(</span><span class="s2">&quot;asdispatch on non-VT_DISPATCH variant&quot;</span><span class="p">)</span>
+        <span class="k">return</span> <span class="n">interfaces</span><span class="o">.</span><span class="n">IDispatch</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">_VARIANT_NAME_3</span><span class="o">.</span><span class="n">pdispVal</span><span class="p">)</span>
+
+    <span class="nd">@property</span>
+    <span class="k">def</span> <span class="nf">asshort</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
+        <span class="k">if</span> <span class="ow">not</span> <span class="bp">self</span><span class="o">.</span><span class="n">vt</span> <span class="ow">in</span> <span class="p">[</span><span class="n">VT_I2</span><span class="p">]:</span>
+            <span class="k">raise</span> <span class="ne">ValueError</span><span class="p">(</span><span class="s2">&quot;asshort on non-VT_I2 variant&quot;</span><span class="p">)</span>
+        <span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">_VARIANT_NAME_3</span><span class="o">.</span><span class="n">iVal</span>
+
+    <span class="nd">@property</span>
+    <span class="k">def</span> <span class="nf">asbyte</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
+        <span class="k">if</span> <span class="ow">not</span> <span class="bp">self</span><span class="o">.</span><span class="n">vt</span> <span class="ow">in</span> <span class="p">[</span><span class="n">VT_UI1</span><span class="p">]:</span>
+            <span class="k">raise</span> <span class="ne">ValueError</span><span class="p">(</span><span class="s2">&quot;asbyte on non-VT_UI1 variant&quot;</span><span class="p">)</span>
+        <span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">_VARIANT_NAME_3</span><span class="o">.</span><span class="n">bVal</span>
+
+    <span class="nd">@property</span>
+    <span class="k">def</span> <span class="nf">asunknown</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
+        <span class="k">if</span> <span class="ow">not</span> <span class="bp">self</span><span class="o">.</span><span class="n">vt</span> <span class="ow">in</span> <span class="p">[</span><span class="n">VT_UNKNOWN</span><span class="p">]:</span>
+            <span class="k">raise</span> <span class="ne">ValueError</span><span class="p">(</span><span class="s2">&quot;asunknown on non-VT_UNKNOWN variant&quot;</span><span class="p">)</span>
+        <span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">_VARIANT_NAME_3</span><span class="o">.</span><span class="n">punkVal</span>
+
+    <span class="nd">@property</span>
+    <span class="k">def</span> <span class="nf">asarray</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
+        <span class="k">if</span> <span class="ow">not</span> <span class="bp">self</span><span class="o">.</span><span class="n">vt</span> <span class="o">&amp;</span> <span class="n">VT_ARRAY</span><span class="p">:</span>
+            <span class="k">raise</span> <span class="ne">ValueError</span><span class="p">(</span><span class="s2">&quot;asarray on non-VT_ARRAY variant&quot;</span><span class="p">)</span>
+        <span class="c1"># TODO: auto extract VT_TYPE for the array ?</span>
+        <span class="c1">#type = VT_VALUE_TO_TYPE[self.vt &amp; VT_TYPEMASK]</span>
+        <span class="k">return</span> <span class="n">ImprovedSAFEARRAY</span><span class="o">.</span><span class="n">from_PSAFEARRAY</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">_VARIANT_NAME_3</span><span class="o">.</span><span class="n">parray</span><span class="p">)</span>
+
+
+    <span class="nd">@property</span>
+    <span class="k">def</span> <span class="nf">aslong_array</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
+        <span class="k">if</span> <span class="ow">not</span> <span class="bp">self</span><span class="o">.</span><span class="n">vt</span> <span class="o">&amp;</span> <span class="n">VT_I4</span><span class="p">:</span>
+            <span class="k">raise</span> <span class="ne">ValueError</span><span class="p">(</span><span class="s2">&quot;as_bstr_array on non-VT_BSTR variant&quot;</span><span class="p">)</span>
+        <span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">asarray</span><span class="o">.</span><span class="n">to_list</span><span class="p">(</span><span class="n">LONG</span><span class="p">)</span>
+
+    <span class="k">def</span> <span class="nf">generate_asarray_property</span><span class="p">(</span><span class="n">vttype</span><span class="p">):</span>
+        <span class="nd">@property</span>
+        <span class="k">def</span> <span class="nf">as_array_generated</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
+            <span class="c1"># TODO: vt check like the others ?</span>
+            <span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">asarray</span><span class="o">.</span><span class="n">to_list</span><span class="p">(</span><span class="n">vttype</span><span class="p">)</span>
+        <span class="k">return</span> <span class="n">as_array_generated</span>
+
+    <span class="n">asbstr_array</span> <span class="o">=</span> <span class="n">generate_asarray_property</span><span class="p">(</span><span class="n">BSTR</span><span class="p">)</span>
+    <span class="n">aslong_array</span> <span class="o">=</span> <span class="n">generate_asarray_property</span><span class="p">(</span><span class="n">LONG</span><span class="p">)</span>
+    <span class="n">asbyte_array</span> <span class="o">=</span> <span class="n">generate_asarray_property</span><span class="p">(</span><span class="n">BYTE</span><span class="p">)</span>
+    <span class="n">asbool_array</span> <span class="o">=</span> <span class="n">generate_asarray_property</span><span class="p">(</span><span class="n">VARIANT_BOOL</span><span class="p">)</span>
+
+    <span class="k">def</span> <span class="nf">to_pyobject</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
+        <span class="c1"># if self.vt &amp; VT_ARRAY:</span>
+            <span class="c1"># # Something better TODO i guess</span>
+            <span class="c1"># if self.vt &amp; VT_TYPEMASK == VT_BSTR:</span>
+                <span class="c1"># import pdb;pdb.set_trace()</span>
+                <span class="c1"># print(&quot;VT_TYPEMASK ARRAY&quot;)</span>
+                <span class="c1"># return self.asarray.to_list(BSTR)</span>
+            <span class="c1"># if self.vt &amp; VT_TYPEMASK == VT_I4:</span>
+                <span class="c1"># import pdb;pdb.set_trace()</span>
+                <span class="c1"># print(&quot;VT_TYPEMASK ARRAY&quot;)</span>
+                <span class="c1"># return self.asarray.to_list(LONG)</span>
+            <span class="c1"># raise NotImplementedError(&quot;Variant of type {0:#x}&quot;.format(self.vt))</span>
+        <span class="c1"># use the ImprovedVariant.MAPPER that dispatch by self.vt</span>
+        <span class="k">try</span><span class="p">:</span>
+            <span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">MAPPER</span><span class="p">[</span><span class="bp">self</span><span class="o">.</span><span class="n">vt</span><span class="p">](</span><span class="bp">self</span><span class="p">)</span>
+        <span class="k">except</span> <span class="ne">KeyError</span><span class="p">:</span>
+            <span class="k">raise</span> <span class="ne">NotImplementedError</span><span class="p">(</span><span class="s2">&quot;Variant of type </span><span class="si">{0:#x}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">vt</span><span class="p">))</span>
+
+
+<span class="n">ImprovedVariant</span><span class="o">.</span><span class="n">MAPPER</span> <span class="o">=</span> <span class="p">{</span>
+    <span class="n">VT_UI1</span><span class="p">:</span> <span class="n">ImprovedVariant</span><span class="o">.</span><span class="n">asbyte</span><span class="o">.</span><span class="n">fget</span><span class="p">,</span>
+    <span class="n">VT_I2</span><span class="p">:</span> <span class="n">ImprovedVariant</span><span class="o">.</span><span class="n">asshort</span><span class="o">.</span><span class="n">fget</span><span class="p">,</span>
+    <span class="n">VT_DISPATCH</span><span class="p">:</span> <span class="n">ImprovedVariant</span><span class="o">.</span><span class="n">asdispatch</span><span class="o">.</span><span class="n">fget</span><span class="p">,</span>
+    <span class="n">VT_BOOL</span><span class="p">:</span> <span class="n">ImprovedVariant</span><span class="o">.</span><span class="n">asbool</span><span class="o">.</span><span class="n">fget</span><span class="p">,</span>
+    <span class="n">VT_I4</span><span class="p">:</span> <span class="n">ImprovedVariant</span><span class="o">.</span><span class="n">aslong</span><span class="o">.</span><span class="n">fget</span><span class="p">,</span>
+    <span class="n">VT_BSTR</span><span class="p">:</span> <span class="n">ImprovedVariant</span><span class="o">.</span><span class="n">asbstr</span><span class="o">.</span><span class="n">fget</span><span class="p">,</span>
+    <span class="n">VT_EMPTY</span><span class="p">:</span> <span class="p">(</span><span class="k">lambda</span> <span class="n">x</span><span class="p">:</span> <span class="kc">None</span><span class="p">),</span>
+    <span class="n">VT_NULL</span><span class="p">:</span> <span class="p">(</span><span class="k">lambda</span> <span class="n">x</span><span class="p">:</span> <span class="kc">None</span><span class="p">),</span>
+    <span class="n">VT_UNKNOWN</span><span class="p">:</span> <span class="n">ImprovedVariant</span><span class="o">.</span><span class="n">asunknown</span><span class="o">.</span><span class="n">fget</span><span class="p">,</span>
+    <span class="p">(</span><span class="n">VT_ARRAY</span> <span class="o">|</span> <span class="n">VT_BSTR</span><span class="p">):</span> <span class="n">ImprovedVariant</span><span class="o">.</span><span class="n">asbstr_array</span><span class="o">.</span><span class="n">fget</span><span class="p">,</span>
+    <span class="p">(</span><span class="n">VT_ARRAY</span> <span class="o">|</span> <span class="n">VT_I4</span><span class="p">):</span> <span class="n">ImprovedVariant</span><span class="o">.</span><span class="n">aslong_array</span><span class="o">.</span><span class="n">fget</span><span class="p">,</span>
+    <span class="p">(</span><span class="n">VT_ARRAY</span> <span class="o">|</span> <span class="n">VT_UI1</span><span class="p">):</span> <span class="n">ImprovedVariant</span><span class="o">.</span><span class="n">asbyte_array</span><span class="o">.</span><span class="n">fget</span><span class="p">,</span>
+    <span class="p">(</span><span class="n">VT_ARRAY</span> <span class="o">|</span> <span class="n">VT_BOOL</span><span class="p">):</span> <span class="n">ImprovedVariant</span><span class="o">.</span><span class="n">asbool_array</span><span class="o">.</span><span class="n">fget</span>
+<span class="p">}</span>
+
+
+
+<div class="viewcode-block" id="COMImplementation"><a class="viewcode-back" href="../../com.html#windows.com.COMImplementation">[docs]</a><span class="k">class</span> <span class="nc">COMImplementation</span><span class="p">(</span><span class="nb">object</span><span class="p">):</span>
+    <span class="sd">&quot;&quot;&quot;The base class to implements COM object respecting a given interface&quot;&quot;&quot;</span>
+    <span class="n">IMPLEMENT</span> <span class="o">=</span> <span class="kc">None</span>
+
+    <span class="k">def</span> <span class="nf">get_index_of_method</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">method</span><span class="p">):</span>
+        <span class="c1"># This code is horrible but not totally my fault</span>
+        <span class="c1"># the PyCFuncPtrObject-&gt;index is not exposed to Python..</span>
+        <span class="c1"># repr is: &#39;&lt;COM method offset 2: WinFunctionType at 0x035DDBE8&gt;&#39;</span>
+        <span class="n">rpr</span> <span class="o">=</span> <span class="nb">repr</span><span class="p">(</span><span class="n">method</span><span class="p">)</span>
+        <span class="k">if</span> <span class="ow">not</span> <span class="n">rpr</span><span class="o">.</span><span class="n">startswith</span><span class="p">(</span><span class="s2">&quot;&lt;COM method offset &quot;</span><span class="p">)</span> <span class="ow">or</span> <span class="s2">&quot;:&quot;</span> <span class="ow">not</span> <span class="ow">in</span> <span class="n">rpr</span><span class="p">:</span>
+            <span class="k">raise</span> <span class="ne">ValueError</span><span class="p">(</span><span class="s2">&quot;Could not extract offset of </span><span class="si">{0}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">rpr</span><span class="p">))</span>
+        <span class="k">return</span> <span class="nb">int</span><span class="p">(</span><span class="n">rpr</span><span class="p">[</span><span class="nb">len</span><span class="p">(</span><span class="s2">&quot;&lt;COM method offset &quot;</span><span class="p">):</span> <span class="n">rpr</span><span class="o">.</span><span class="n">index</span><span class="p">(</span><span class="s2">&quot;:&quot;</span><span class="p">)])</span>
+
+    <span class="k">def</span> <span class="nf">extract_methods_order</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">interface</span><span class="p">):</span>
+        <span class="n">index_and_method</span> <span class="o">=</span> <span class="nb">sorted</span><span class="p">((</span><span class="bp">self</span><span class="o">.</span><span class="n">get_index_of_method</span><span class="p">(</span><span class="n">m</span><span class="p">),</span><span class="n">name</span><span class="p">,</span> <span class="n">m</span><span class="p">)</span> <span class="k">for</span> <span class="n">name</span><span class="p">,</span> <span class="n">m</span> <span class="ow">in</span> <span class="n">interface</span><span class="o">.</span><span class="n">_functions_</span><span class="o">.</span><span class="n">items</span><span class="p">())</span>
+        <span class="k">return</span> <span class="n">index_and_method</span>
+
+    <span class="k">def</span> <span class="nf">verify_implem</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">interface</span><span class="p">):</span>
+        <span class="k">for</span> <span class="n">func_name</span> <span class="ow">in</span> <span class="n">interface</span><span class="o">.</span><span class="n">_functions_</span><span class="p">:</span>
+            <span class="n">implem</span> <span class="o">=</span> <span class="nb">getattr</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">func_name</span><span class="p">,</span> <span class="kc">None</span><span class="p">)</span>
+            <span class="k">if</span> <span class="n">implem</span> <span class="ow">is</span> <span class="kc">None</span><span class="p">:</span>
+                <span class="k">raise</span> <span class="ne">ValueError</span><span class="p">(</span><span class="s2">&quot;&lt;</span><span class="si">{0}</span><span class="s2">&gt; implementing &lt;</span><span class="si">{1}</span><span class="s2">&gt; has no method &lt;</span><span class="si">{2}</span><span class="s2">&gt;&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="nb">type</span><span class="p">(</span><span class="bp">self</span><span class="p">)</span><span class="o">.</span><span class="vm">__name__</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">IMPLEMENT</span><span class="o">.</span><span class="vm">__name__</span><span class="p">,</span> <span class="n">func_name</span><span class="p">))</span>
+            <span class="k">if</span> <span class="ow">not</span> <span class="n">callable</span><span class="p">(</span><span class="n">implem</span><span class="p">):</span>
+                <span class="k">raise</span> <span class="ne">ValueError</span><span class="p">(</span><span class="s2">&quot;</span><span class="si">{0}</span><span class="s2"> implementing &lt;</span><span class="si">{1}</span><span class="s2">&gt;: &lt;</span><span class="si">{2}</span><span class="s2">&gt; is not callable&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="nb">type</span><span class="p">(</span><span class="bp">self</span><span class="p">)</span><span class="o">.</span><span class="vm">__name__</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">IMPLEMENT</span><span class="o">.</span><span class="vm">__name__</span><span class="p">,</span> <span class="n">func_name</span><span class="p">))</span>
+        <span class="k">return</span> <span class="kc">True</span>
+
+    <span class="k">def</span> <span class="nf">_create_vtable</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">interface</span><span class="p">):</span>
+        <span class="n">implems</span> <span class="o">=</span> <span class="p">[]</span>
+        <span class="n">names</span> <span class="o">=</span> <span class="p">[]</span>
+        <span class="k">for</span> <span class="n">index</span><span class="p">,</span> <span class="n">name</span><span class="p">,</span> <span class="n">method</span> <span class="ow">in</span> <span class="bp">self</span><span class="o">.</span><span class="n">extract_methods_order</span><span class="p">(</span><span class="n">interface</span><span class="p">):</span>
+            <span class="n">func_implem</span> <span class="o">=</span> <span class="nb">getattr</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">name</span><span class="p">)</span>
+            <span class="c1">#&#39;this&#39; is a COM-interface of the type we are implementing</span>
+            <span class="n">types</span> <span class="o">=</span> <span class="p">[</span><span class="n">method</span><span class="o">.</span><span class="n">restype</span><span class="p">,</span> <span class="n">interface</span><span class="p">]</span> <span class="o">+</span> <span class="nb">list</span><span class="p">(</span><span class="n">method</span><span class="o">.</span><span class="n">argtypes</span><span class="p">)</span>
+            <span class="n">implems</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">ctypes</span><span class="o">.</span><span class="n">WINFUNCTYPE</span><span class="p">(</span><span class="o">*</span><span class="n">types</span><span class="p">)(</span><span class="n">func_implem</span><span class="p">))</span>
+            <span class="n">names</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">name</span><span class="p">)</span>
+        <span class="k">class</span> <span class="nc">Vtable</span><span class="p">(</span><span class="n">ctypes</span><span class="o">.</span><span class="n">Structure</span><span class="p">):</span>
+            <span class="n">_fields_</span> <span class="o">=</span> <span class="p">[(</span><span class="n">name</span><span class="p">,</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">c_void_p</span><span class="p">)</span> <span class="k">for</span> <span class="n">name</span> <span class="ow">in</span> <span class="n">names</span><span class="p">]</span>
+        <span class="k">return</span> <span class="n">Vtable</span><span class="p">(</span><span class="o">*</span><span class="p">[</span><span class="n">ctypes</span><span class="o">.</span><span class="n">cast</span><span class="p">(</span><span class="n">x</span><span class="p">,</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">c_void_p</span><span class="p">)</span> <span class="k">for</span> <span class="n">x</span> <span class="ow">in</span> <span class="n">implems</span><span class="p">]),</span> <span class="n">implems</span>
+
+    <span class="k">def</span> <span class="nf">__init__</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
+        <span class="bp">self</span><span class="o">.</span><span class="n">verify_implem</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">IMPLEMENT</span><span class="p">)</span>
+        <span class="n">vtable</span><span class="p">,</span> <span class="n">implems</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">_create_vtable</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">IMPLEMENT</span><span class="p">)</span>
+        <span class="bp">self</span><span class="o">.</span><span class="n">vtable</span> <span class="o">=</span> <span class="n">vtable</span>
+        <span class="bp">self</span><span class="o">.</span><span class="n">implems</span> <span class="o">=</span> <span class="n">implems</span>
+        <span class="bp">self</span><span class="o">.</span><span class="n">vtable_pointer</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">pointer</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">vtable</span><span class="p">)</span>
+        <span class="bp">self</span><span class="o">.</span><span class="n">_as_parameter_</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">addressof</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">vtable_pointer</span><span class="p">)</span>
+
+<div class="viewcode-block" id="COMImplementation.QueryInterface"><a class="viewcode-back" href="../../com.html#windows.com.COMImplementation.QueryInterface">[docs]</a>    <span class="k">def</span> <span class="nf">QueryInterface</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">this</span><span class="p">,</span> <span class="n">piid</span><span class="p">,</span> <span class="n">result</span><span class="p">):</span>
+        <span class="sd">&quot;&quot;&quot;Default ``QueryInterface`` implementation that returns ``self`` if piid is the implemented interface&quot;&quot;&quot;</span>
+        <span class="k">if</span> <span class="n">piid</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span> <span class="ow">in</span> <span class="p">(</span><span class="n">IUnknown</span><span class="o">.</span><span class="n">IID</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">IMPLEMENT</span><span class="o">.</span><span class="n">IID</span><span class="p">):</span>
+            <span class="n">result</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span> <span class="o">=</span> <span class="n">this</span>
+            <span class="k">return</span> <span class="mi">1</span></div>
+        <span class="k">return</span> <span class="n">E_NOINTERFACE</span>
+
+<div class="viewcode-block" id="COMImplementation.AddRef"><a class="viewcode-back" href="../../com.html#windows.com.COMImplementation.AddRef">[docs]</a>    <span class="k">def</span> <span class="nf">AddRef</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="o">*</span><span class="n">args</span><span class="p">):</span>
+        <span class="sd">&quot;&quot;&quot;Default ``AddRef`` implementation that returns ``1``&quot;&quot;&quot;</span></div>
+        <span class="k">return</span> <span class="mi">1</span>
+
+<div class="viewcode-block" id="COMImplementation.Release"><a class="viewcode-back" href="../../com.html#windows.com.COMImplementation.Release">[docs]</a>    <span class="k">def</span> <span class="nf">Release</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="o">*</span><span class="n">args</span><span class="p">):</span>
+        <span class="sd">&quot;&quot;&quot;Default ``Release`` implementation that returns ``1``&quot;&quot;&quot;</span></div></div>
+        <span class="k">return</span> <span class="mi">0</span>
+</pre></div>
+
+          </div>
+        </div>
+      </div>
+      <div class="sphinxsidebar" role="navigation" aria-label="main navigation">
+        <div class="sphinxsidebarwrapper">
+<div id="searchbox" style="display: none" role="search">
+  <h3>Quick search</h3>
+    <div class="searchformwrapper">
+    <form class="search" action="../../search.html" method="get">
+      <input type="text" name="q" />
+      <input type="submit" value="Go" />
+      <input type="hidden" name="check_keywords" value="yes" />
+      <input type="hidden" name="area" value="default" />
+    </form>
+    </div>
+</div>
+<script type="text/javascript">$('#searchbox').show(0);</script>
+        </div>
+      </div>
+      <div class="clearer"></div>
+    </div>
+    <div class="related" role="navigation" aria-label="related navigation">
+      <h3>Navigation</h3>
+      <ul>
+        <li class="right" style="margin-right: 10px">
+          <a href="../../genindex.html" title="General Index"
+             >index</a></li>
+        <li class="right" >
+          <a href="../../py-modindex.html" title="Python Module Index"
+             >modules</a> |</li>
+        <li class="nav-item nav-item-0"><a href="../../index.html">PythonForWindows 0.3 documentation</a> &#187;</li>
+          <li class="nav-item nav-item-1"><a href="../index.html" >Module code</a> &#187;</li> 
+      </ul>
+    </div>
+    <div class="footer" role="contentinfo">
+        &#169; Copyright 2015, Clement Rouault.
+      Created using <a href="http://sphinx-doc.org/">Sphinx</a> 1.7.1.
+    </div>
+  </body>
+</html>
@@ -232,7 +232,7 @@
        <span class="bp">self</span><span class="o">.</span><span class="n">current_thread</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">threads</span><span class="p">[</span><span class="n">debug_event</span><span class="o">.</span><span class="n">dwThreadId</span><span class="p">]</span>

    <span class="k">def</span> <span class="nf">_dispatch_debug_event</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">debug_event</span><span class="p">):</span>
-        <span class="c1">#print(&quot;DISPATCH {0}&quot;.format(DEBUG_EVENT.KNOWN_EVENT_CODE.get(debug_event.dwDebugEventCode)))</span>
+        <span class="nb">print</span><span class="p">(</span><span class="s2">&quot;DISPATCH </span><span class="si">{0}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">DEBUG_EVENT</span><span class="o">.</span><span class="n">KNOWN_EVENT_CODE</span><span class="o">.</span><span class="n">get</span><span class="p">(</span><span class="n">debug_event</span><span class="o">.</span><span class="n">dwDebugEventCode</span><span class="p">)))</span>
        <span class="n">handler</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">_DebugEventCode_dispatch</span><span class="o">.</span><span class="n">get</span><span class="p">(</span><span class="n">debug_event</span><span class="o">.</span><span class="n">dwDebugEventCode</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">_handle_unknown_debug_event</span><span class="p">)</span>
        <span class="k">return</span> <span class="n">handler</span><span class="p">(</span><span class="n">debug_event</span><span class="p">)</span>

@@ -536,6 +536,11 @@

    <span class="k">def</span> <span class="nf">_handle_exception_breakpoint</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">exception</span><span class="p">,</span> <span class="n">excp_addr</span><span class="p">):</span>
        <span class="n">excp_bitness</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">get_exception_bitness</span><span class="p">(</span><span class="n">exception</span><span class="p">)</span>
+        <span class="n">YOLO</span> <span class="o">=</span> <span class="kc">False</span>
+        <span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">current_thread</span><span class="o">.</span><span class="n">context</span><span class="o">.</span><span class="n">EEFlags</span><span class="o">.</span><span class="n">TF</span><span class="p">:</span>
+            <span class="n">dbgprint</span><span class="p">(</span><span class="s2">&quot;Single step as begin of _handle_exception_breakpoint&quot;</span><span class="p">,</span> <span class="s2">&quot;DBG&quot;</span><span class="p">)</span>
+            <span class="c1"># import pdb;pdb.set_trace()</span>
+            <span class="n">YOLO</span> <span class="o">=</span> <span class="kc">True</span>
        <span class="k">if</span> <span class="n">excp_addr</span> <span class="ow">in</span> <span class="bp">self</span><span class="o">.</span><span class="n">breakpoints</span><span class="p">[</span><span class="bp">self</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">pid</span><span class="p">]:</span>
            <span class="n">thread</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">current_thread</span>
            <span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">32</span> <span class="ow">and</span> <span class="n">excp_bitness</span> <span class="o">==</span> <span class="mi">64</span><span class="p">:</span>
@@ -551,7 +556,9 @@
            <span class="n">continue_flag</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">_dispatch_breakpoint</span><span class="p">(</span><span class="n">exception</span><span class="p">,</span> <span class="n">excp_addr</span><span class="p">)</span>
            <span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">_killed_in_action</span><span class="p">():</span>
                <span class="k">return</span> <span class="n">continue_flag</span>
-            <span class="bp">self</span><span class="o">.</span><span class="n">_explicit_single_step</span><span class="p">[</span><span class="bp">self</span><span class="o">.</span><span class="n">current_thread</span><span class="o">.</span><span class="n">tid</span><span class="p">]</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">current_thread</span><span class="o">.</span><span class="n">context</span><span class="o">.</span><span class="n">EEFlags</span><span class="o">.</span><span class="n">TF</span>
+            <span class="bp">self</span><span class="o">.</span><span class="n">_explicit_single_step</span><span class="p">[</span><span class="bp">self</span><span class="o">.</span><span class="n">current_thread</span><span class="o">.</span><span class="n">tid</span><span class="p">]</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">current_thread</span><span class="o">.</span><span class="n">context</span><span class="o">.</span><span class="n">EEFlags</span><span class="o">.</span><span class="n">TF</span> <span class="ow">and</span> <span class="ow">not</span> <span class="n">YOLO</span>
+            <span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">_explicit_single_step</span><span class="p">[</span><span class="bp">self</span><span class="o">.</span><span class="n">current_thread</span><span class="o">.</span><span class="n">tid</span><span class="p">]:</span>
+                <span class="n">dbgprint</span><span class="p">(</span><span class="s2">&quot;Someone ask for an explicit Single step&quot;</span><span class="p">,</span> <span class="s2">&quot;DBG&quot;</span><span class="p">)</span>
            <span class="k">if</span> <span class="n">excp_addr</span> <span class="ow">in</span> <span class="bp">self</span><span class="o">.</span><span class="n">breakpoints</span><span class="p">[</span><span class="bp">self</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">pid</span><span class="p">]:</span>
                <span class="c1"># Setup BP if not suppressed</span>
                <span class="bp">self</span><span class="o">.</span><span class="n">_pass_breakpoint</span><span class="p">(</span><span class="n">excp_addr</span><span class="p">)</span>
@@ -567,6 +574,8 @@
                    <span class="bp">self</span><span class="o">.</span><span class="n">on_single_step</span><span class="p">(</span><span class="n">exception</span><span class="p">)</span>
            <span class="k">if</span> <span class="ow">not</span> <span class="bp">self</span><span class="o">.</span><span class="n">_killed_in_action</span><span class="p">():</span>
                <span class="bp">self</span><span class="o">.</span><span class="n">_explicit_single_step</span><span class="p">[</span><span class="bp">self</span><span class="o">.</span><span class="n">current_thread</span><span class="o">.</span><span class="n">tid</span><span class="p">]</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">current_thread</span><span class="o">.</span><span class="n">context</span><span class="o">.</span><span class="n">EEFlags</span><span class="o">.</span><span class="n">TF</span>
+                <span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">_explicit_single_step</span><span class="p">[</span><span class="bp">self</span><span class="o">.</span><span class="n">current_thread</span><span class="o">.</span><span class="n">tid</span><span class="p">]:</span>
+                    <span class="n">dbgprint</span><span class="p">(</span><span class="s2">&quot;Someone ask for an explicit Single step - 7&quot;</span><span class="p">,</span> <span class="s2">&quot;DBG&quot;</span><span class="p">)</span>
            <span class="k">return</span> <span class="n">DBG_CONTINUE</span>
        <span class="k">elif</span> <span class="n">excp_addr</span> <span class="ow">in</span> <span class="bp">self</span><span class="o">.</span><span class="n">breakpoints</span><span class="p">[</span><span class="bp">self</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">pid</span><span class="p">]:</span>
            <span class="c1"># Verif that&#39;s not a standard BP ?</span>
@@ -577,6 +586,8 @@
                <span class="k">return</span> <span class="n">DBG_CONTINUE</span>
            <span class="n">ctx</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">current_thread</span><span class="o">.</span><span class="n">context</span>
            <span class="bp">self</span><span class="o">.</span><span class="n">_explicit_single_step</span><span class="p">[</span><span class="bp">self</span><span class="o">.</span><span class="n">current_thread</span><span class="o">.</span><span class="n">tid</span><span class="p">]</span> <span class="o">=</span> <span class="n">ctx</span><span class="o">.</span><span class="n">EEFlags</span><span class="o">.</span><span class="n">TF</span>
+            <span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">_explicit_single_step</span><span class="p">[</span><span class="bp">self</span><span class="o">.</span><span class="n">current_thread</span><span class="o">.</span><span class="n">tid</span><span class="p">]:</span>
+                <span class="n">dbgprint</span><span class="p">(</span><span class="s2">&quot;Someone ask for an explicit Single step - 2&quot;</span><span class="p">,</span> <span class="s2">&quot;DBG&quot;</span><span class="p">)</span>
            <span class="k">if</span> <span class="n">excp_addr</span> <span class="ow">in</span> <span class="bp">self</span><span class="o">.</span><span class="n">breakpoints</span><span class="p">[</span><span class="bp">self</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">pid</span><span class="p">]:</span>
                <span class="n">ctx</span><span class="o">.</span><span class="n">EEFlags</span><span class="o">.</span><span class="n">RF</span> <span class="o">=</span> <span class="mi">1</span>
                <span class="bp">self</span><span class="o">.</span><span class="n">current_thread</span><span class="o">.</span><span class="n">set_context</span><span class="p">(</span><span class="n">ctx</span><span class="p">)</span>
@@ -589,6 +600,8 @@
            <span class="c1"># Does not handle case where EEFlags.TF was by the debugge before trigering the exception</span>
            <span class="c1"># Should set the flag explicitly in single_step ? and not just use EEFlags.TF ?</span>
            <span class="bp">self</span><span class="o">.</span><span class="n">_explicit_single_step</span><span class="p">[</span><span class="bp">self</span><span class="o">.</span><span class="n">current_thread</span><span class="o">.</span><span class="n">tid</span><span class="p">]</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">current_thread</span><span class="o">.</span><span class="n">context</span><span class="o">.</span><span class="n">EEFlags</span><span class="o">.</span><span class="n">TF</span>
+            <span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">_explicit_single_step</span><span class="p">[</span><span class="bp">self</span><span class="o">.</span><span class="n">current_thread</span><span class="o">.</span><span class="n">tid</span><span class="p">]:</span>
+                <span class="n">dbgprint</span><span class="p">(</span><span class="s2">&quot;Someone ask for an explicit Single step - 3&quot;</span><span class="p">,</span> <span class="s2">&quot;DBG&quot;</span><span class="p">)</span>
            <span class="k">return</span> <span class="n">continue_flag</span>
        <span class="k">else</span><span class="p">:</span>
            <span class="k">with</span> <span class="bp">self</span><span class="o">.</span><span class="n">DisabledMemoryBreakpoint</span><span class="p">():</span>
@@ -598,6 +611,8 @@
            <span class="c1"># Does not handle case where EEFlags.TF was by the debugge before trigering the exception</span>
            <span class="c1"># Should set the flag explicitly in single_step ? and not just use EEFlags.TF ?</span>
            <span class="bp">self</span><span class="o">.</span><span class="n">_explicit_single_step</span><span class="p">[</span><span class="bp">self</span><span class="o">.</span><span class="n">current_thread</span><span class="o">.</span><span class="n">tid</span><span class="p">]</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">current_thread</span><span class="o">.</span><span class="n">context</span><span class="o">.</span><span class="n">EEFlags</span><span class="o">.</span><span class="n">TF</span>
+            <span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">_explicit_single_step</span><span class="p">[</span><span class="bp">self</span><span class="o">.</span><span class="n">current_thread</span><span class="o">.</span><span class="n">tid</span><span class="p">]:</span>
+                <span class="n">dbgprint</span><span class="p">(</span><span class="s2">&quot;Someone ask for an explicit Single step - 4&quot;</span><span class="p">,</span> <span class="s2">&quot;DBG&quot;</span><span class="p">)</span>
            <span class="k">return</span> <span class="n">continue_flag</span>

    <span class="c1">#  === Testing PAGE_NOACCESS(0x1L) ===</span>
@@ -644,6 +659,8 @@
        <span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">_killed_in_action</span><span class="p">():</span>
            <span class="k">return</span> <span class="n">continue_flag</span>
        <span class="bp">self</span><span class="o">.</span><span class="n">_explicit_single_step</span><span class="p">[</span><span class="bp">self</span><span class="o">.</span><span class="n">current_thread</span><span class="o">.</span><span class="n">tid</span><span class="p">]</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">current_thread</span><span class="o">.</span><span class="n">context</span><span class="o">.</span><span class="n">EEFlags</span><span class="o">.</span><span class="n">TF</span>
+        <span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">_explicit_single_step</span><span class="p">[</span><span class="bp">self</span><span class="o">.</span><span class="n">current_thread</span><span class="o">.</span><span class="n">tid</span><span class="p">]:</span>
+            <span class="n">dbgprint</span><span class="p">(</span><span class="s2">&quot;Someone ask for an explicit Single step - 5&quot;</span><span class="p">,</span> <span class="s2">&quot;DBG&quot;</span><span class="p">)</span>
        <span class="c1"># If BP has not been removed in trigger, pas it</span>
        <span class="k">if</span> <span class="n">fault_page</span> <span class="ow">in</span> <span class="n">cp_watch_page</span> <span class="ow">and</span> <span class="n">mem_bp</span> <span class="ow">in</span> <span class="n">cp_watch_page</span><span class="p">[</span><span class="n">fault_page</span><span class="p">]</span><span class="o">.</span><span class="n">bps</span><span class="p">:</span>
            <span class="bp">self</span><span class="o">.</span><span class="n">_pass_memory_breakpoint</span><span class="p">(</span><span class="n">mem_bp</span><span class="p">,</span> <span class="n">original_prot</span><span class="p">,</span> <span class="n">fault_page</span><span class="p">)</span>
@@ -664,17 +681,23 @@
        <span class="n">excp_code</span> <span class="o">=</span> <span class="n">exception</span><span class="o">.</span><span class="n">ExceptionRecord</span><span class="o">.</span><span class="n">ExceptionCode</span>
        <span class="n">excp_addr</span> <span class="o">=</span> <span class="n">exception</span><span class="o">.</span><span class="n">ExceptionRecord</span><span class="o">.</span><span class="n">ExceptionAddress</span>
        <span class="k">if</span> <span class="n">excp_code</span> <span class="ow">in</span> <span class="p">[</span><span class="n">EXCEPTION_BREAKPOINT</span><span class="p">,</span> <span class="n">STATUS_WX86_BREAKPOINT</span><span class="p">]</span> <span class="ow">and</span> <span class="n">excp_addr</span> <span class="ow">in</span> <span class="bp">self</span><span class="o">.</span><span class="n">breakpoints</span><span class="p">[</span><span class="bp">self</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">pid</span><span class="p">]:</span>
+            <span class="n">dbgprint</span><span class="p">(</span><span class="s2">&quot;Handle exception as breakpoint&quot;</span><span class="p">,</span> <span class="s2">&quot;DBG&quot;</span><span class="p">)</span>
            <span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">_handle_exception_breakpoint</span><span class="p">(</span><span class="n">exception</span><span class="p">,</span> <span class="n">excp_addr</span><span class="p">)</span>
        <span class="k">elif</span> <span class="n">excp_code</span> <span class="ow">in</span> <span class="p">[</span><span class="n">EXCEPTION_SINGLE_STEP</span><span class="p">,</span> <span class="n">STATUS_WX86_SINGLE_STEP</span><span class="p">]:</span>
+            <span class="n">dbgprint</span><span class="p">(</span><span class="s2">&quot;Handle exception as single step&quot;</span><span class="p">,</span> <span class="s2">&quot;DBG&quot;</span><span class="p">)</span>
            <span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">_handle_exception_singlestep</span><span class="p">(</span><span class="n">exception</span><span class="p">,</span> <span class="n">excp_addr</span><span class="p">)</span>
        <span class="k">elif</span> <span class="n">excp_code</span> <span class="o">==</span> <span class="n">EXCEPTION_ACCESS_VIOLATION</span><span class="p">:</span>
+            <span class="n">dbgprint</span><span class="p">(</span><span class="s2">&quot;Handle exception as access_violation&quot;</span><span class="p">,</span> <span class="s2">&quot;DBG&quot;</span><span class="p">)</span>
            <span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">_handle_exception_access_violation</span><span class="p">(</span><span class="n">exception</span><span class="p">,</span> <span class="n">excp_addr</span><span class="p">)</span>
        <span class="k">else</span><span class="p">:</span>
            <span class="k">with</span> <span class="bp">self</span><span class="o">.</span><span class="n">DisabledMemoryBreakpoint</span><span class="p">():</span>
+                <span class="n">dbgprint</span><span class="p">(</span><span class="s2">&quot;Handle exception as on_exception&quot;</span><span class="p">,</span> <span class="s2">&quot;DBG&quot;</span><span class="p">)</span>
                <span class="n">continue_flag</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">on_exception</span><span class="p">(</span><span class="n">exception</span><span class="p">)</span>
            <span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">_killed_in_action</span><span class="p">():</span>
                <span class="k">return</span> <span class="n">continue_flag</span>
            <span class="bp">self</span><span class="o">.</span><span class="n">_explicit_single_step</span><span class="p">[</span><span class="bp">self</span><span class="o">.</span><span class="n">current_thread</span><span class="o">.</span><span class="n">tid</span><span class="p">]</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">current_thread</span><span class="o">.</span><span class="n">context</span><span class="o">.</span><span class="n">EEFlags</span><span class="o">.</span><span class="n">TF</span>
+            <span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">_explicit_single_step</span><span class="p">[</span><span class="bp">self</span><span class="o">.</span><span class="n">current_thread</span><span class="o">.</span><span class="n">tid</span><span class="p">]:</span>
+                <span class="n">dbgprint</span><span class="p">(</span><span class="s2">&quot;Someone ask for an explicit Single step - 6&quot;</span><span class="p">,</span> <span class="s2">&quot;DBG&quot;</span><span class="p">)</span>
            <span class="k">return</span> <span class="n">continue_flag</span>


@@ -90,7 +90,7 @@

 <div class="viewcode-block" id="IATHook"><a class="viewcode-back" href="../../iat_hook.html#windows.hooks.IATHook">[docs]</a><span class="k">class</span> <span class="nc">IATHook</span><span class="p">(</span><span class="nb">object</span><span class="p">):</span>
    <span class="sd">&quot;&quot;&quot;Look at my hook &lt;3&quot;&quot;&quot;</span>
-    <span class="n">yolo</span> <span class="o">=</span> <span class="p">[]</span>
+    <span class="c1"># yolo = []</span>

    <span class="k">def</span> <span class="nf">__init__</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">IAT_entry</span><span class="p">,</span> <span class="n">callback</span><span class="p">,</span> <span class="n">types</span><span class="o">=</span><span class="kc">None</span><span class="p">):</span>
        <span class="k">if</span> <span class="n">types</span> <span class="ow">is</span> <span class="kc">None</span><span class="p">:</span>
@@ -101,10 +101,16 @@
        <span class="bp">self</span><span class="o">.</span><span class="n">callback_types</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">transform_arguments</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">original_types</span><span class="p">)</span>
        <span class="bp">self</span><span class="o">.</span><span class="n">entry</span> <span class="o">=</span> <span class="n">IAT_entry</span>
        <span class="bp">self</span><span class="o">.</span><span class="n">callback</span> <span class="o">=</span> <span class="n">callback</span>
+        <span class="c1">## No more circular ref -&gt; but stub is destroyed -&gt; segv :(</span>
        <span class="bp">self</span><span class="o">.</span><span class="n">stub</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">WINFUNCTYPE</span><span class="p">(</span><span class="o">*</span><span class="bp">self</span><span class="o">.</span><span class="n">callback_types</span><span class="p">)(</span><span class="bp">self</span><span class="o">.</span><span class="n">hook_callback</span><span class="p">)</span>
-        <span class="bp">self</span><span class="o">.</span><span class="n">stub_addr</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">cast</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">stub</span><span class="p">,</span> <span class="n">PVOID</span><span class="p">)</span><span class="o">.</span><span class="n">value</span>
+        <span class="c1"># stub = ctypes.WINFUNCTYPE(*self.callback_types)(self.hook_callback)</span>
+        <span class="c1"># self.stub_addr = ctypes.cast(stub, PVOID) # Same problem as keep stub... (GC..)</span>
+        <span class="bp">self</span><span class="o">.</span><span class="n">stub_addr</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">cast</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">stub</span><span class="p">,</span> <span class="n">PVOID</span><span class="p">)</span><span class="o">.</span><span class="n">value</span> <span class="c1"># Same problem as keep stub... (GC..)</span>
+        <span class="c1"># IAT_entry.stub = stub</span>
+        <span class="nb">print</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">stub_addr</span><span class="p">)</span>
        <span class="bp">self</span><span class="o">.</span><span class="n">realfunction</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">WINFUNCTYPE</span><span class="p">(</span><span class="o">*</span><span class="n">types</span><span class="p">)(</span><span class="n">IAT_entry</span><span class="o">.</span><span class="n">nonhookvalue</span><span class="p">)</span>
        <span class="bp">self</span><span class="o">.</span><span class="n">is_enable</span> <span class="o">=</span> <span class="kc">False</span>
+        <span class="c1"># import pdb;pdb.set_trace()</span>
        <span class="c1">#IATHook.yolo.append(self)</span>

    <span class="k">def</span> <span class="nf">transform_arguments</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">types</span><span class="p">):</span>
@@ -119,14 +125,17 @@
 <div class="viewcode-block" id="IATHook.enable"><a class="viewcode-back" href="../../iat_hook.html#windows.hooks.IATHook.enable">[docs]</a>    <span class="k">def</span> <span class="nf">enable</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
        <span class="sd">&quot;&quot;&quot;Enable the IAT hook: you MUST keep a reference to the IATHook while the hook is enabled&quot;&quot;&quot;</span>
        <span class="k">with</span> <span class="n">utils</span><span class="o">.</span><span class="n">VirtualProtected</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">entry</span><span class="o">.</span><span class="n">addr</span><span class="p">,</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">PVOID</span><span class="p">),</span> <span class="n">PAGE_EXECUTE_READWRITE</span><span class="p">):</span>
-            <span class="bp">self</span><span class="o">.</span><span class="n">entry</span><span class="o">.</span><span class="n">value</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">stub_addr</span></div>
-        <span class="bp">self</span><span class="o">.</span><span class="n">is_enable</span> <span class="o">=</span> <span class="kc">True</span>
+            <span class="nb">print</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">stub_addr</span><span class="p">)</span>
+            <span class="bp">self</span><span class="o">.</span><span class="n">entry</span><span class="o">.</span><span class="n">value</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">stub_addr</span>
+        <span class="bp">self</span><span class="o">.</span><span class="n">is_enable</span> <span class="o">=</span> <span class="kc">True</span></div>
+        <span class="bp">self</span><span class="o">.</span><span class="n">entry</span><span class="o">.</span><span class="n">enabled</span> <span class="o">=</span> <span class="kc">True</span>

 <div class="viewcode-block" id="IATHook.disable"><a class="viewcode-back" href="../../iat_hook.html#windows.hooks.IATHook.disable">[docs]</a>    <span class="k">def</span> <span class="nf">disable</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
        <span class="sd">&quot;&quot;&quot;Disable the IAT hook&quot;&quot;&quot;</span>
        <span class="k">with</span> <span class="n">utils</span><span class="o">.</span><span class="n">VirtualProtected</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">entry</span><span class="o">.</span><span class="n">addr</span><span class="p">,</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">PVOID</span><span class="p">),</span> <span class="n">PAGE_EXECUTE_READWRITE</span><span class="p">):</span>
-            <span class="bp">self</span><span class="o">.</span><span class="n">entry</span><span class="o">.</span><span class="n">value</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">entry</span><span class="o">.</span><span class="n">nonhookvalue</span></div>
-        <span class="bp">self</span><span class="o">.</span><span class="n">is_enable</span> <span class="o">=</span> <span class="kc">False</span>
+            <span class="bp">self</span><span class="o">.</span><span class="n">entry</span><span class="o">.</span><span class="n">value</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">entry</span><span class="o">.</span><span class="n">nonhookvalue</span>
+        <span class="bp">self</span><span class="o">.</span><span class="n">is_enable</span> <span class="o">=</span> <span class="kc">False</span></div>
+        <span class="bp">self</span><span class="o">.</span><span class="n">entry</span><span class="o">.</span><span class="n">enabled</span> <span class="o">=</span> <span class="kc">True</span>

    <span class="k">def</span> <span class="nf">hook_callback</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="o">*</span><span class="n">args</span><span class="p">):</span>
        <span class="n">adapted_args</span> <span class="o">=</span> <span class="p">[]</span>
@@ -145,9 +154,10 @@
        <span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">callback</span><span class="p">(</span><span class="o">*</span><span class="n">adapted_args</span><span class="p">,</span> <span class="n">real_function</span><span class="o">=</span><span class="n">real_function</span><span class="p">)</span>

    <span class="c1"># Use this tricks to prevent garbage collection of hook ?</span>
-    <span class="c1">#def __del__(self):</span>
-    <span class="c1">#    pass</span>
-
+    <span class="c1"># That&#39;s dirty..</span>
+    <span class="c1"># def __del__(self):</span>
+        <span class="c1"># print(&quot;HAHAHA {0}&quot;.format(self.is_enable))</span>
+        <span class="c1"># print(&quot;HELLO&quot;)</span>

 <span class="c1">## New simple hook API based on winproxy</span>
 <span class="k">def</span> <span class="nf">setup_hook</span><span class="p">(</span><span class="n">target</span><span class="p">,</span> <span class="n">hook</span><span class="p">,</span> <span class="n">dll_to_hook</span><span class="p">):</span>
@@ -500,6 +500,14 @@
        <span class="k">return</span> <span class="bp">self</span>


+<span class="k">class</span> <span class="nc">IATPtr</span><span class="p">(</span><span class="n">PVOID</span><span class="p">):</span>
+    <span class="nd">@classmethod</span>
+    <span class="k">def</span> <span class="nf">from_iatentry</span><span class="p">(</span><span class="bp">cls</span><span class="p">,</span> <span class="n">iat_entry</span><span class="p">):</span>
+        <span class="bp">self</span> <span class="o">=</span> <span class="bp">cls</span><span class="o">.</span><span class="n">from_address</span><span class="p">(</span><span class="n">iat_entry</span><span class="o">.</span><span class="n">addr</span><span class="p">)</span>
+        <span class="bp">self</span><span class="o">.</span><span class="n">addr</span> <span class="o">=</span> <span class="n">iat_entry</span><span class="o">.</span><span class="n">addr</span>
+        <span class="bp">self</span><span class="o">.</span><span class="n">nonhookvalue</span> <span class="o">=</span> <span class="n">iat_entry</span><span class="o">.</span><span class="n">nonhookvalue</span>
+        <span class="k">return</span> <span class="bp">self</span>
+
 <div class="viewcode-block" id="IATEntry"><a class="viewcode-back" href="../../process.html#windows.pe_parse.IATEntry">[docs]</a><span class="k">class</span> <span class="nc">IATEntry</span><span class="p">(</span><span class="n">ctypes</span><span class="o">.</span><span class="n">Structure</span><span class="p">):</span>
    <span class="sd">&quot;&quot;&quot;Represent an entry in the IAT of a module</span>
 <span class="sd">    Can be used to get resolved value and setup hook</span>
@@ -507,8 +515,6 @@
    <span class="n">_fields_</span> <span class="o">=</span> <span class="p">[</span>
        <span class="p">(</span><span class="s2">&quot;value&quot;</span><span class="p">,</span> <span class="n">PVOID</span><span class="p">)]</span>

-
-
    <span class="nd">@classmethod</span>
    <span class="k">def</span> <span class="nf">create</span><span class="p">(</span><span class="bp">cls</span><span class="p">,</span> <span class="n">addr</span><span class="p">,</span> <span class="nb">ord</span><span class="p">,</span> <span class="n">name</span><span class="p">,</span> <span class="n">target</span><span class="p">,</span> <span class="n">transformers</span><span class="p">):</span>
        <span class="bp">self</span> <span class="o">=</span> <span class="n">transformers</span><span class="o">.</span><span class="n">create_structure_at</span><span class="p">(</span><span class="bp">cls</span><span class="p">,</span> <span class="n">addr</span><span class="p">)</span>
@@ -543,10 +549,18 @@
            <span class="k">raise</span> <span class="ne">NotImplementedError</span><span class="p">(</span><span class="s2">&quot;Setting hook in remote process (use python code injection)&quot;</span><span class="p">)</span>

        <span class="n">hook</span> <span class="o">=</span> <span class="n">hooks</span><span class="o">.</span><span class="n">IATHook</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">callback</span><span class="p">,</span> <span class="n">types</span><span class="p">)</span>
+        <span class="kn">import</span> <span class="nn">weakref</span>
+        <span class="bp">self</span><span class="o">.</span><span class="n">whook</span> <span class="o">=</span> <span class="n">weakref</span><span class="o">.</span><span class="n">ref</span><span class="p">(</span><span class="n">hook</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">on_destroy</span><span class="p">)</span>
        <span class="bp">self</span><span class="o">.</span><span class="n">hook</span> <span class="o">=</span> <span class="n">hook</span>
        <span class="n">hook</span><span class="o">.</span><span class="n">enable</span><span class="p">()</span></div>
        <span class="k">return</span> <span class="n">hook</span>

+    <span class="k">def</span> <span class="nf">on_destroy</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="o">*</span><span class="n">args</span><span class="p">):</span>
+        <span class="c1"># We cannot know if the hook was enabled here..</span>
+        <span class="nb">print</span><span class="p">(</span><span class="s2">&quot;DESTROY: </span><span class="si">{0}</span><span class="s2"> -&gt; &quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">args</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">enabled</span><span class="p">))</span>
+        <span class="c1"># import pdb;pdb.set_trace()</span>
+        <span class="c1"># print(args[0]())</span>
+
 <div class="viewcode-block" id="IATEntry.remove_hook"><a class="viewcode-back" href="../../process.html#windows.pe_parse.IATEntry.remove_hook">[docs]</a>    <span class="k">def</span> <span class="nf">remove_hook</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
        <span class="sd">&quot;&quot;&quot;Remove the hook on the entry&quot;&quot;&quot;</span>
        <span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">hook</span> <span class="ow">is</span> <span class="kc">None</span><span class="p">:</span>
@@ -555,6 +569,11 @@
        <span class="bp">self</span><span class="o">.</span><span class="n">hook</span> <span class="o">=</span> <span class="kc">None</span></div></div>
        <span class="k">return</span> <span class="kc">True</span>

+    <span class="c1"># def __del__(self):</span>
+        <span class="c1"># print(self.hook)</span>
+        <span class="c1"># if self.hook:</span>
+            <span class="c1"># print(&quot;LOL BYE {0}&quot;.format(self.hook))</span>
+

 <span class="k">class</span> <span class="nc">IMAGE_IMPORT_DESCRIPTOR</span><span class="p">(</span><span class="n">IMAGE_IMPORT_DESCRIPTOR</span><span class="p">):</span> <span class="c1"># TODO: use explicite name winstructs.IMAGE_IMPORT_DESCRIPTOR</span>
    <span class="k">def</span> <span class="nf">get_INT</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
@@ -38,9 +38,13 @@
            
  <h1>Source code for windows.utils.pythonutils</h1><div class="highlight"><pre>
 <span></span><span class="sd">&quot;&quot;&quot;utils fonctions non windows-related&quot;&quot;&quot;</span>
+<span class="kn">import</span> <span class="nn">sys</span>
 <span class="kn">import</span> <span class="nn">ctypes</span>
 <span class="kn">import</span> <span class="nn">_ctypes</span>
-<span class="kn">from</span> <span class="nn">windows.generated_def</span> <span class="k">import</span> <span class="n">Flag</span><span class="p">,</span> <span class="n">LPCSTR</span><span class="p">,</span> <span class="n">LPWSTR</span>
+<span class="kn">from</span> <span class="nn">windows.generated_def</span> <span class="k">import</span> <span class="n">Flag</span><span class="p">,</span> <span class="n">LPCSTR</span><span class="p">,</span> <span class="n">LPWSTR</span><span class="p">,</span> <span class="n">INFINITE</span>
+
+<span class="kn">from</span> <span class="nn">windows.dbgprint</span> <span class="k">import</span> <span class="n">dbgprint</span>
+<span class="kn">from</span> <span class="nn">windows</span> <span class="k">import</span> <span class="n">winproxy</span>


 <span class="k">def</span> <span class="nf">buffer</span><span class="p">(</span><span class="n">size</span><span class="p">):</span> <span class="c1"># Test</span>
@@ -63,6 +67,26 @@
    <span class="k">return</span> <span class="n">ImprovedCtypesBufferImpl</span><span class="p">()</span>


+<span class="k">def</span> <span class="nf">wbuffer</span><span class="p">(</span><span class="n">size</span><span class="p">):</span> <span class="c1"># Test</span>
+    <span class="n">buf</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">create_string_buffer</span><span class="p">(</span><span class="n">size</span><span class="p">)</span>
+    <span class="n">buf</span><span class="o">.</span><span class="n">size</span> <span class="o">=</span> <span class="n">size</span>
+    <span class="n">buf</span><span class="o">.</span><span class="n">address</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">addressof</span><span class="p">(</span><span class="n">buf</span><span class="p">)</span>
+
+    <span class="k">class</span> <span class="nc">ImprovedCtypesBufferImpl</span><span class="p">(</span><span class="n">ctypes</span><span class="o">.</span><span class="n">Array</span><span class="p">):</span>
+        <span class="n">_length_</span> <span class="o">=</span> <span class="n">size</span>
+        <span class="n">_type_</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">c_wchar</span>
+        <span class="k">def</span> <span class="nf">lol</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
+            <span class="k">return</span> <span class="s2">&quot;lol&quot;</span>
+
+        <span class="k">def</span> <span class="nf">as_string</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
+            <span class="k">return</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">cast</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">LPCSTR</span><span class="p">)</span><span class="o">.</span><span class="n">value</span>
+
+        <span class="k">def</span> <span class="nf">as_wstring</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
+            <span class="k">return</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">cast</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">LPWSTR</span><span class="p">)</span><span class="o">.</span><span class="n">value</span>
+
+    <span class="k">return</span> <span class="n">ImprovedCtypesBufferImpl</span><span class="p">()</span>
+
+
 <span class="k">def</span> <span class="nf">fixedpropety</span><span class="p">(</span><span class="n">f</span><span class="p">):</span>
    <span class="n">cache_name</span> <span class="o">=</span> <span class="s2">&quot;_&quot;</span> <span class="o">+</span> <span class="n">f</span><span class="o">.</span><span class="vm">__name__</span>

@@ -112,9 +136,43 @@
        <span class="n">print_ctypes_struct</span><span class="p">(</span><span class="n">value</span><span class="p">,</span> <span class="s2">&quot;</span><span class="si">{0}</span><span class="s2">.</span><span class="si">{1}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">name</span><span class="p">,</span> <span class="n">fname</span><span class="p">),</span> <span class="n">hexa</span><span class="o">=</span><span class="n">hexa</span><span class="p">)</span>


-<div class="viewcode-block" id="sprint"><a class="viewcode-back" href="../../../utils.html#windows.utils.sprint">[docs]</a><span class="k">def</span> <span class="nf">sprint</span><span class="p">(</span><span class="n">struct</span><span class="p">,</span> <span class="n">name</span><span class="o">=</span><span class="s2">&quot;struct&quot;</span><span class="p">,</span> <span class="n">hexa</span><span class="o">=</span><span class="kc">True</span><span class="p">):</span>
+<div class="viewcode-block" id="sprint"><a class="viewcode-back" href="../../../utils.html#windows.winobject.process.sprint">[docs]</a><span class="k">def</span> <span class="nf">sprint</span><span class="p">(</span><span class="n">struct</span><span class="p">,</span> <span class="n">name</span><span class="o">=</span><span class="s2">&quot;struct&quot;</span><span class="p">,</span> <span class="n">hexa</span><span class="o">=</span><span class="kc">True</span><span class="p">):</span>
    <span class="sd">&quot;&quot;&quot;Print recursively the content of a :mod:`ctypes` structure&quot;&quot;&quot;</span></div>
    <span class="k">return</span> <span class="n">print_ctypes_struct</span><span class="p">(</span><span class="n">struct</span><span class="p">,</span> <span class="n">name</span><span class="o">=</span><span class="n">name</span><span class="p">,</span> <span class="n">hexa</span><span class="o">=</span><span class="n">hexa</span><span class="p">)</span>
+
+
+<span class="k">class</span> <span class="nc">AutoHandle</span><span class="p">(</span><span class="nb">object</span><span class="p">):</span>
+    <span class="sd">&quot;&quot;&quot;An abstract class that allow easy handle creation/destruction/wait&quot;&quot;&quot;</span>
+     <span class="c1"># Big bypass to prevent missing reference at programm exit..</span>
+    <span class="n">_close_function</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">WinDLL</span><span class="p">(</span><span class="s2">&quot;kernel32&quot;</span><span class="p">)</span><span class="o">.</span><span class="n">CloseHandle</span>
+    <span class="k">def</span> <span class="nf">_get_handle</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
+        <span class="k">raise</span> <span class="ne">NotImplementedError</span><span class="p">(</span><span class="s2">&quot;</span><span class="si">{0}</span><span class="s2"> is abstract&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="nb">type</span><span class="p">(</span><span class="bp">self</span><span class="p">)</span><span class="o">.</span><span class="vm">__name__</span><span class="p">))</span>
+
+    <span class="nd">@property</span>
+    <span class="k">def</span> <span class="nf">handle</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
+        <span class="sd">&quot;&quot;&quot;An handle on the object</span>
+
+<span class="sd">        :type: HANDLE</span>
+
+<span class="sd">           .. note::</span>
+<span class="sd">                The handle is automaticaly closed when the object is destroyed</span>
+<span class="sd">        &quot;&quot;&quot;</span>
+        <span class="k">if</span> <span class="nb">hasattr</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="s2">&quot;_handle&quot;</span><span class="p">):</span>
+            <span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">_handle</span>
+        <span class="bp">self</span><span class="o">.</span><span class="n">_handle</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">_get_handle</span><span class="p">()</span>
+        <span class="n">dbgprint</span><span class="p">(</span><span class="s2">&quot;Open handle </span><span class="si">{0}</span><span class="s2"> for </span><span class="si">{1}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="nb">hex</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">_handle</span><span class="p">),</span> <span class="bp">self</span><span class="p">),</span> <span class="s2">&quot;HANDLE&quot;</span><span class="p">)</span>
+        <span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">_handle</span>
+
+    <span class="k">def</span> <span class="nf">wait</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">timeout</span><span class="o">=</span><span class="n">INFINITE</span><span class="p">):</span>
+        <span class="sd">&quot;&quot;&quot;Wait for the object&quot;&quot;&quot;</span>
+        <span class="k">return</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">WaitForSingleObject</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">timeout</span><span class="p">)</span>
+
+    <span class="k">def</span> <span class="nf">__del__</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
+        <span class="c1"># sys.path is not None -&gt; check if python shutdown</span>
+        <span class="k">if</span> <span class="nb">hasattr</span><span class="p">(</span><span class="n">sys</span><span class="p">,</span> <span class="s2">&quot;path&quot;</span><span class="p">)</span> <span class="ow">and</span> <span class="n">sys</span><span class="o">.</span><span class="n">path</span> <span class="ow">is</span> <span class="ow">not</span> <span class="kc">None</span> <span class="ow">and</span> <span class="nb">hasattr</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="s2">&quot;_handle&quot;</span><span class="p">)</span> <span class="ow">and</span> <span class="bp">self</span><span class="o">.</span><span class="n">_handle</span><span class="p">:</span>
+            <span class="c1"># Prevent some bug where dbgprint might be None when __del__ is called in a closing process</span>
+            <span class="n">dbgprint</span><span class="p">(</span><span class="s2">&quot;Closing Handle </span><span class="si">{0}</span><span class="s2"> for </span><span class="si">{1}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="nb">hex</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">_handle</span><span class="p">),</span> <span class="bp">self</span><span class="p">),</span> <span class="s2">&quot;HANDLE&quot;</span><span class="p">)</span> <span class="k">if</span> <span class="n">dbgprint</span> <span class="ow">is</span> <span class="ow">not</span> <span class="kc">None</span> <span class="k">else</span> <span class="kc">None</span>
+            <span class="bp">self</span><span class="o">.</span><span class="n">_close_function</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">_handle</span><span class="p">)</span>
 </pre></div>

          </div>
@@ -37,7 +37,9 @@
          <div class="body" role="main">
            
  <h1>Source code for windows.winobject.apisetmap</h1><div class="highlight"><pre>
-<span></span><span class="kn">import</span> <span class="nn">windows</span>
+<span></span><span class="kn">import</span> <span class="nn">ctypes</span>
+
+<span class="kn">import</span> <span class="nn">windows</span>
 <span class="kn">import</span> <span class="nn">windows.generated_def</span> <span class="k">as</span> <span class="nn">gdef</span>

 <span class="kn">from</span> <span class="nn">windows</span> <span class="k">import</span> <span class="n">utils</span>
@@ -72,44 +72,7 @@
 <span class="sd">&quot;&quot;&quot;Time information about a process&quot;&quot;&quot;</span>


-<span class="k">class</span> <span class="nc">AutoHandle</span><span class="p">(</span><span class="nb">object</span><span class="p">):</span>
-    <span class="sd">&quot;&quot;&quot;An abstract class that allow easy handle creation/destruction/wait&quot;&quot;&quot;</span>
-     <span class="c1"># Big bypass to prevent missing reference at programm close..</span>
-    <span class="n">_close_function</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">WinDLL</span><span class="p">(</span><span class="s2">&quot;kernel32&quot;</span><span class="p">)</span><span class="o">.</span><span class="n">CloseHandle</span>
-    <span class="k">def</span> <span class="nf">_get_handle</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
-        <span class="k">raise</span> <span class="ne">NotImplementedError</span><span class="p">(</span><span class="s2">&quot;</span><span class="si">{0}</span><span class="s2"> is abstract&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="nb">type</span><span class="p">(</span><span class="bp">self</span><span class="p">)</span><span class="o">.</span><span class="vm">__name__</span><span class="p">))</span>
-
-    <span class="nd">@property</span>
-    <span class="k">def</span> <span class="nf">handle</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
-        <span class="sd">&quot;&quot;&quot;An handle on the object</span>
-
-<span class="sd">        :type: HANDLE</span>
-
-<span class="sd">           .. note::</span>
-<span class="sd">                The handle is automaticaly closed when the object is destroyed</span>
-<span class="sd">        &quot;&quot;&quot;</span>
-        <span class="k">if</span> <span class="nb">hasattr</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="s2">&quot;_handle&quot;</span><span class="p">):</span>
-            <span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">_handle</span>
-        <span class="bp">self</span><span class="o">.</span><span class="n">_handle</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">_get_handle</span><span class="p">()</span>
-        <span class="n">dbgprint</span><span class="p">(</span><span class="s2">&quot;Open handle </span><span class="si">{0}</span><span class="s2"> for </span><span class="si">{1}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="nb">hex</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">_handle</span><span class="p">),</span> <span class="bp">self</span><span class="p">),</span> <span class="s2">&quot;HANDLE&quot;</span><span class="p">)</span>
-        <span class="c1">#if &quot;DEAD&quot; in str(self):</span>
-        <span class="c1">#    print(&quot;OPEN FOR THE DEADS&quot;)</span>
-        <span class="c1">#    import pdb;pdb.set_trace()</span>
-        <span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">_handle</span>
-
-    <span class="k">def</span> <span class="nf">wait</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">timeout</span><span class="o">=</span><span class="n">INFINITE</span><span class="p">):</span>
-        <span class="sd">&quot;&quot;&quot;Wait for the object&quot;&quot;&quot;</span>
-        <span class="k">return</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">WaitForSingleObject</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">timeout</span><span class="p">)</span>
-
-    <span class="k">def</span> <span class="nf">__del__</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
-        <span class="c1"># sys.path is not None -&gt; check if python shutdown</span>
-        <span class="k">if</span> <span class="nb">hasattr</span><span class="p">(</span><span class="n">sys</span><span class="p">,</span> <span class="s2">&quot;path&quot;</span><span class="p">)</span> <span class="ow">and</span> <span class="n">sys</span><span class="o">.</span><span class="n">path</span> <span class="ow">is</span> <span class="ow">not</span> <span class="kc">None</span> <span class="ow">and</span> <span class="nb">hasattr</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="s2">&quot;_handle&quot;</span><span class="p">)</span> <span class="ow">and</span> <span class="bp">self</span><span class="o">.</span><span class="n">_handle</span><span class="p">:</span>
-            <span class="c1"># Prevent some bug where dbgprint might be None when __del__ is called in a closing process</span>
-            <span class="n">dbgprint</span><span class="p">(</span><span class="s2">&quot;Closing Handle </span><span class="si">{0}</span><span class="s2"> for </span><span class="si">{1}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="nb">hex</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">_handle</span><span class="p">),</span> <span class="bp">self</span><span class="p">),</span> <span class="s2">&quot;HANDLE&quot;</span><span class="p">)</span> <span class="k">if</span> <span class="n">dbgprint</span> <span class="ow">is</span> <span class="ow">not</span> <span class="kc">None</span> <span class="k">else</span> <span class="kc">None</span>
-            <span class="bp">self</span><span class="o">.</span><span class="n">_close_function</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">_handle</span><span class="p">)</span>
-
-
-<div class="viewcode-block" id="WinThread"><a class="viewcode-back" href="../../../process.html#windows.winobject.process.WinThread">[docs]</a><span class="k">class</span> <span class="nc">WinThread</span><span class="p">(</span><span class="n">AutoHandle</span><span class="p">):</span>
+<div class="viewcode-block" id="WinThread"><a class="viewcode-back" href="../../../process.html#windows.winobject.process.WinThread">[docs]</a><span class="k">class</span> <span class="nc">WinThread</span><span class="p">(</span><span class="n">utils</span><span class="o">.</span><span class="n">AutoHandle</span><span class="p">):</span>
    <span class="sd">&quot;&quot;&quot;Represent a thread &quot;&quot;&quot;</span>

    <span class="k">def</span> <span class="nf">__init__</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">tid</span><span class="o">=</span><span class="kc">None</span><span class="p">,</span> <span class="n">handle</span><span class="o">=</span><span class="kc">None</span><span class="p">,</span> <span class="n">owner_pid</span><span class="o">=</span><span class="kc">None</span><span class="p">,</span> <span class="n">owner</span><span class="o">=</span><span class="kc">None</span><span class="p">):</span>
@@ -336,7 +299,7 @@
    <span class="c1">#     return Token(token_handle.value)</span>


-<div class="viewcode-block" id="DeadThread"><a class="viewcode-back" href="../../../process.html#windows.winobject.process.DeadThread">[docs]</a><span class="k">class</span> <span class="nc">DeadThread</span><span class="p">(</span><span class="n">AutoHandle</span><span class="p">):</span>
+<div class="viewcode-block" id="DeadThread"><a class="viewcode-back" href="../../../process.html#windows.winobject.process.DeadThread">[docs]</a><span class="k">class</span> <span class="nc">DeadThread</span><span class="p">(</span><span class="n">utils</span><span class="o">.</span><span class="n">AutoHandle</span><span class="p">):</span>
    <span class="sd">&quot;&quot;&quot;An already dead thread (returned only by API returning a new thread if thread die before being returned)&quot;&quot;&quot;</span>
    <span class="k">def</span> <span class="nf">__init__</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">handle</span><span class="p">,</span> <span class="n">tid</span><span class="o">=</span><span class="kc">None</span><span class="p">):</span>
        <span class="k">if</span> <span class="n">tid</span> <span class="ow">is</span> <span class="kc">None</span><span class="p">:</span>
@@ -364,7 +327,7 @@
        <span class="k">return</span> <span class="n">res</span><span class="o">.</span><span class="n">value</span>


-<span class="k">class</span> <span class="nc">Process</span><span class="p">(</span><span class="n">AutoHandle</span><span class="p">):</span>
+<span class="k">class</span> <span class="nc">Process</span><span class="p">(</span><span class="n">utils</span><span class="o">.</span><span class="n">AutoHandle</span><span class="p">):</span>
    <span class="nd">@utils</span><span class="o">.</span><span class="n">fixedpropety</span>
    <span class="k">def</span> <span class="nf">is_wow_64</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
        <span class="sd">&quot;&quot;&quot;``True`` if the process is a SysWow64 process (32bit process on 64bits system).</span>
@@ -705,6 +668,12 @@
        <span class="sd">&quot;&quot;&quot;write a qword at ``addr``&quot;&quot;&quot;</span>
        <span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">write_memory</span><span class="p">(</span><span class="n">addr</span><span class="p">,</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span><span class="s2">&quot;&lt;Q&quot;</span><span class="p">,</span> <span class="n">qword</span><span class="p">))</span>

+    <span class="k">def</span> <span class="nf">write_ptr</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">addr</span><span class="p">,</span> <span class="n">value</span><span class="p">):</span>
+        <span class="sd">&quot;&quot;&quot;Write a ``PTR`` at ``addr``&quot;&quot;&quot;</span>
+        <span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">32</span><span class="p">:</span>
+            <span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">write_dword</span><span class="p">(</span><span class="n">addr</span><span class="p">,</span> <span class="n">value</span><span class="p">)</span>
+        <span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">write_qword</span><span class="p">(</span><span class="n">addr</span><span class="p">,</span> <span class="n">value</span><span class="p">)</span>
+
    <span class="nd">@property</span>
    <span class="k">def</span> <span class="nf">time_info</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
        <span class="sd">&quot;&quot;&quot;The time information of the process (creation, kernel/user time, exit time)</span>
@@ -778,7 +747,7 @@
    <span class="c1">#     winproxy.OpenProcessToken(self.handle, TOKEN_QUERY, byref(token_handle))</span>
    <span class="c1">#     return Token(token_handle.value)</span>

-<div class="viewcode-block" id="CurrentThread"><a class="viewcode-back" href="../../../process.html#windows.winobject.process.CurrentThread">[docs]</a><span class="k">class</span> <span class="nc">CurrentThread</span><span class="p">(</span><span class="n">AutoHandle</span><span class="p">):</span>
+<div class="viewcode-block" id="CurrentThread"><a class="viewcode-back" href="../../../process.html#windows.winobject.process.CurrentThread">[docs]</a><span class="k">class</span> <span class="nc">CurrentThread</span><span class="p">(</span><span class="n">utils</span><span class="o">.</span><span class="n">AutoHandle</span><span class="p">):</span>
    <span class="sd">&quot;&quot;&quot;The current thread&quot;&quot;&quot;</span>
    <span class="nd">@property</span> <span class="c1">#It&#39;s not a fixedpropety because executing thread might change</span>
    <span class="k">def</span> <span class="nf">tid</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
@@ -913,8 +882,12 @@
        <span class="k">return</span> <span class="n">WinThread</span><span class="o">.</span><span class="n">_from_handle</span><span class="p">(</span><span class="n">handle</span><span class="p">)</span>

 <div class="viewcode-block" id="CurrentProcess.load_library"><a class="viewcode-back" href="../../../process.html#windows.winobject.process.CurrentProcess.load_library">[docs]</a>    <span class="k">def</span> <span class="nf">load_library</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">dll_path</span><span class="p">):</span>
-        <span class="sd">&quot;&quot;&quot;Load the library in current process&quot;&quot;&quot;</span></div>
-        <span class="k">return</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">LoadLibraryA</span><span class="p">(</span><span class="n">dll_path</span><span class="p">)</span>
+        <span class="sd">&quot;&quot;&quot;Load the library in current process</span>
+
+<span class="sd">        :rtype: :class:`LoadedModule`</span>
+<span class="sd">        &quot;&quot;&quot;</span>
+        <span class="n">dllbase</span> <span class="o">=</span>  <span class="n">winproxy</span><span class="o">.</span><span class="n">LoadLibraryA</span><span class="p">(</span><span class="n">dll_path</span><span class="p">)</span></div>
+        <span class="k">return</span> <span class="p">[</span><span class="n">m</span> <span class="k">for</span> <span class="n">m</span> <span class="ow">in</span> <span class="bp">self</span><span class="o">.</span><span class="n">peb</span><span class="o">.</span><span class="n">modules</span> <span class="k">if</span> <span class="n">m</span><span class="o">.</span><span class="n">baseaddr</span> <span class="o">==</span> <span class="n">dllbase</span><span class="p">][</span><span class="mi">0</span><span class="p">]</span>

 <div class="viewcode-block" id="CurrentProcess.execute"><a class="viewcode-back" href="../../../process.html#windows.winobject.process.CurrentProcess.execute">[docs]</a>    <span class="k">def</span> <span class="nf">execute</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">code</span><span class="p">,</span> <span class="n">parameter</span><span class="o">=</span><span class="mi">0</span><span class="p">):</span>
        <span class="sd">&quot;&quot;&quot;Execute native code ``code`` in the current thread.</span>
@@ -947,6 +920,8 @@
        <span class="n">winproxy</span><span class="o">.</span><span class="n">OpenProcessToken</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">flags</span><span class="p">,</span> <span class="n">byref</span><span class="p">(</span><span class="n">token_handle</span><span class="p">))</span>
        <span class="k">return</span> <span class="n">Token</span><span class="p">(</span><span class="n">token_handle</span><span class="o">.</span><span class="n">value</span><span class="p">)</span>

+    <span class="c1"># TODO: use ctypes.string_ad / ctypes.wstring_at for read_string / read_wstring ?</span>
+
 </div>
    <span class="n">token</span> <span class="o">=</span> <span class="nb">property</span><span class="p">(</span><span class="n">open_token</span><span class="p">)</span>

@@ -986,7 +961,7 @@
 <span class="sd">        :type: :class:`str`</span>
 <span class="sd">		&quot;&quot;&quot;</span>
        <span class="n">buffer</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">c_buffer</span><span class="p">(</span><span class="mh">0x1024</span><span class="p">)</span>
-        <span class="n">rsize</span> <span class="o">=</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">GetProcessImageFileNameA</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">buffer</span><span class="p">)</span>
+        <span class="n">rsize</span> <span class="o">=</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">GetProcessImageFileNameA</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">limited_handle</span><span class="p">,</span> <span class="n">buffer</span><span class="p">)</span>
        <span class="c1"># GetProcessImageFileNameA returns the fullpath</span>
        <span class="k">return</span> <span class="n">buffer</span><span class="p">[:</span><span class="n">rsize</span><span class="p">]</span><span class="o">.</span><span class="n">decode</span><span class="p">()</span><span class="o">.</span><span class="n">split</span><span class="p">(</span><span class="s2">&quot;</span><span class="se">\\</span><span class="s2">&quot;</span><span class="p">)[</span><span class="o">-</span><span class="mi">1</span><span class="p">]</span>

@@ -1091,8 +1066,12 @@
        <span class="k">return</span> <span class="n">WinThread</span><span class="o">.</span><span class="n">_from_handle</span><span class="p">(</span><span class="n">winproxy</span><span class="o">.</span><span class="n">CreateRemoteThread</span><span class="p">(</span><span class="n">hProcess</span><span class="o">=</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">lpStartAddress</span><span class="o">=</span><span class="n">addr</span><span class="p">,</span> <span class="n">lpParameter</span><span class="o">=</span><span class="n">param</span><span class="p">))</span>

 <div class="viewcode-block" id="WinProcess.load_library"><a class="viewcode-back" href="../../../process.html#windows.winobject.process.WinProcess.load_library">[docs]</a>    <span class="k">def</span> <span class="nf">load_library</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">dll_path</span><span class="p">):</span>
-        <span class="sd">&quot;&quot;&quot;Load the library in remote process&quot;&quot;&quot;</span></div>
-        <span class="k">return</span> <span class="n">windows</span><span class="o">.</span><span class="n">injection</span><span class="o">.</span><span class="n">load_dll_in_remote_process</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">dll_path</span><span class="p">)</span>
+        <span class="sd">&quot;&quot;&quot;Load the library in remote process</span>
+
+<span class="sd">        :rtype: :class:`RemoteLoadedModule`</span>
+<span class="sd">        &quot;&quot;&quot;</span>
+        <span class="n">dllbase</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">injection</span><span class="o">.</span><span class="n">load_dll_in_remote_process</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">dll_path</span><span class="p">)</span></div>
+        <span class="k">return</span> <span class="p">[</span><span class="n">m</span> <span class="k">for</span> <span class="n">m</span> <span class="ow">in</span> <span class="bp">self</span><span class="o">.</span><span class="n">peb</span><span class="o">.</span><span class="n">modules</span> <span class="k">if</span> <span class="n">m</span><span class="o">.</span><span class="n">baseaddr</span> <span class="o">==</span> <span class="n">dllbase</span><span class="p">][</span><span class="mi">0</span><span class="p">]</span>

 <div class="viewcode-block" id="WinProcess.execute_python"><a class="viewcode-back" href="../../../process.html#windows.winobject.process.WinProcess.execute_python">[docs]</a>    <span class="k">def</span> <span class="nf">execute_python</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">pycode</span><span class="p">):</span>
        <span class="sd">&quot;&quot;&quot;Execute Python code into the remote process.</span>
@@ -1200,7 +1179,8 @@
 <span class="n">know_integrity_level_mapper</span> <span class="o">=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">FlagMapper</span><span class="p">(</span><span class="o">*</span><span class="n">KNOW_INTEGRITY_LEVEL</span><span class="p">)</span>

 <span class="c1"># Create ProcessToken and Thread Token objects ?</span>
-<div class="viewcode-block" id="Token"><a class="viewcode-back" href="../../../process.html#windows.winobject.process.Token">[docs]</a><span class="k">class</span> <span class="nc">Token</span><span class="p">(</span><span class="n">AutoHandle</span><span class="p">):</span>
+<span class="c1"># token.py ?</span>
+<div class="viewcode-block" id="Token"><a class="viewcode-back" href="../../../process.html#windows.winobject.process.Token">[docs]</a><span class="k">class</span> <span class="nc">Token</span><span class="p">(</span><span class="n">utils</span><span class="o">.</span><span class="n">AutoHandle</span><span class="p">):</span>
    <span class="sd">&quot;&quot;&quot;The token of a process&quot;&quot;&quot;</span>
    <span class="k">def</span> <span class="nf">__init__</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">handle</span><span class="p">):</span>
        <span class="bp">self</span><span class="o">.</span><span class="n">_handle</span> <span class="o">=</span> <span class="n">handle</span>
@@ -1254,6 +1234,12 @@
        <span class="sd">&quot;&quot;&quot;The username of the token&quot;&quot;&quot;</span>
        <span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">_user_and_computer_name</span><span class="p">()[</span><span class="mi">0</span><span class="p">]</span>

+    <span class="k">def</span> <span class="nf">duplicate</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">access_rigth</span><span class="o">=</span><span class="mi">0</span><span class="p">,</span> <span class="n">attributes</span><span class="o">=</span><span class="kc">None</span><span class="p">,</span> <span class="n">impersonation_level</span><span class="o">=</span><span class="n">gdef</span><span class="o">.</span><span class="n">SecurityImpersonation</span><span class="p">,</span> <span class="n">toktype</span><span class="o">=</span><span class="n">gdef</span><span class="o">.</span><span class="n">TokenPrimary</span><span class="p">):</span>
+        <span class="n">newtoken</span> <span class="o">=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">HANDLE</span><span class="p">()</span>
+        <span class="n">winproxy</span><span class="o">.</span><span class="n">DuplicateTokenEx</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">access_rigth</span><span class="p">,</span> <span class="n">attributes</span><span class="p">,</span> <span class="n">impersonation_level</span><span class="p">,</span> <span class="n">toktype</span><span class="p">,</span> <span class="n">newtoken</span><span class="p">)</span>
+        <span class="k">return</span> <span class="nb">type</span><span class="p">(</span><span class="bp">self</span><span class="p">)(</span><span class="n">newtoken</span><span class="o">.</span><span class="n">value</span><span class="p">)</span>
+
+
    <span class="k">def</span> <span class="nf">_user_and_computer_name</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
        <span class="n">tok_usr</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">token_user</span>
        <span class="n">sid</span> <span class="o">=</span> <span class="n">tok_usr</span><span class="o">.</span><span class="n">User</span><span class="o">.</span><span class="n">Sid</span>
@@ -57,6 +57,7 @@
 <span class="kn">from</span> <span class="nn">windows.winobject</span> <span class="k">import</span> <span class="n">wmi</span>
 <span class="kn">from</span> <span class="nn">windows.winobject</span> <span class="k">import</span> <span class="n">kernobj</span>
 <span class="kn">from</span> <span class="nn">windows.winobject</span> <span class="k">import</span> <span class="n">handle</span>
+<span class="kn">from</span> <span class="nn">windows.winobject</span> <span class="k">import</span> <span class="n">evtlog</span>

 <span class="kn">from</span> <span class="nn">windows.generated_def.winstructs</span> <span class="k">import</span> <span class="o">*</span>
 <span class="kn">from</span> <span class="nn">windows.dbgprint</span> <span class="k">import</span> <span class="n">dbgprint</span>
@@ -126,6 +127,11 @@
 <span class="sd">        :type: :class:`~windows.winobject.wmi.WmiManager`&quot;&quot;&quot;</span>
        <span class="k">return</span> <span class="n">wmi</span><span class="o">.</span><span class="n">WmiManager</span><span class="p">()</span>

+    <span class="nd">@utils</span><span class="o">.</span><span class="n">fixedpropety</span>
+    <span class="k">def</span> <span class="nf">evtlog</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
+        <span class="k">return</span> <span class="n">evtlog</span><span class="o">.</span><span class="n">EvtlogManager</span><span class="p">()</span>
+
+
    <span class="c1">#TODO: use GetComputerNameExA ? and recover other names ?</span>
    <span class="nd">@utils</span><span class="o">.</span><span class="n">fixedpropety</span>
    <span class="k">def</span> <span class="nf">computer_name</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
@@ -253,6 +259,8 @@
        <span class="c1"># This returns the last version where ntdll was updated</span>
        <span class="c1"># Should look at HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion</span>
        <span class="c1"># values:  CurrentBuild + UBR</span>
+        <span class="c1"># windows.system.registry(r&quot;HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion&quot;)[&quot;CurrentBuild&quot;].value</span>
+        <span class="c1"># windows.system.registry(r&quot;HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion&quot;)[&quot;UBR&quot;].value</span>
        <span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">get_file_version</span><span class="p">(</span><span class="s2">&quot;comctl32&quot;</span><span class="p">)</span>

    <span class="nd">@staticmethod</span>
@@ -44,7 +44,7 @@
 <span class="kn">import</span> <span class="nn">windows.generated_def</span> <span class="k">as</span> <span class="nn">gdef</span>
 <span class="kn">from</span> <span class="nn">windows.generated_def.winstructs</span> <span class="k">import</span> <span class="o">*</span>

-<span class="kn">from</span> <span class="nn">.process</span> <span class="k">import</span> <span class="n">AutoHandle</span>
+<span class="kn">from</span> <span class="nn">windows.utils</span> <span class="k">import</span> <span class="n">AutoHandle</span>

 <span class="kn">import</span> <span class="nn">sys</span>

@@ -272,6 +272,11 @@
    <span class="n">APIDLL</span> <span class="o">=</span> <span class="s2">&quot;Ktmw32&quot;</span>
    <span class="n">default_error_check</span> <span class="o">=</span> <span class="nb">staticmethod</span><span class="p">(</span><span class="n">zero_is_fail_error_check</span><span class="p">)</span>

+<span class="k">class</span> <span class="nc">WevtapiProxy</span><span class="p">(</span><span class="n">ApiProxy</span><span class="p">):</span>
+    <span class="n">APIDLL</span> <span class="o">=</span> <span class="s2">&quot;Wevtapi&quot;</span>
+    <span class="n">default_error_check</span> <span class="o">=</span> <span class="nb">staticmethod</span><span class="p">(</span><span class="n">zero_is_fail_error_check</span><span class="p">)</span>
+
+
 <span class="c1">#class OptionalExport(object):</span>
 <span class="c1">#    &quot;&quot;&quot;used &#39;around&#39; a Proxy decorator</span>
 <span class="c1">#       Should be used for export that are not available everywhere (ntdll internals | 32/64 bits stuff)</span>
@@ -564,6 +569,8 @@
 <span class="k">def</span> <span class="nf">OpenEventW</span><span class="p">(</span><span class="n">dwDesiredAccess</span><span class="p">,</span> <span class="n">bInheritHandle</span><span class="p">,</span> <span class="n">lpName</span><span class="p">):</span>
    <span class="k">return</span> <span class="n">OpenEventA</span><span class="o">.</span><span class="n">ctypes_function</span><span class="p">(</span><span class="n">dwDesiredAccess</span><span class="p">,</span> <span class="n">bInheritHandle</span><span class="p">,</span> <span class="n">lpName</span><span class="p">)</span>

+
+
 <span class="c1"># File stuff</span>
 <span class="nd">@Kernel32Proxy</span><span class="p">(</span><span class="s2">&quot;ReadFile&quot;</span><span class="p">)</span>
 <span class="k">def</span> <span class="nf">ReadFile</span><span class="p">(</span><span class="n">hFile</span><span class="p">,</span> <span class="n">lpBuffer</span><span class="p">,</span> <span class="n">nNumberOfBytesToRead</span><span class="o">=</span><span class="kc">None</span><span class="p">,</span> <span class="n">lpNumberOfBytesRead</span><span class="o">=</span><span class="kc">None</span><span class="p">,</span> <span class="n">lpOverlapped</span><span class="o">=</span><span class="kc">None</span><span class="p">):</span>
@@ -853,10 +860,17 @@
 <span class="k">def</span> <span class="nf">NtReadVirtualMemory</span><span class="p">(</span><span class="n">hProcess</span><span class="p">,</span> <span class="n">lpBaseAddress</span><span class="p">,</span> <span class="n">lpBuffer</span><span class="p">,</span> <span class="n">nSize</span><span class="p">,</span> <span class="n">lpNumberOfBytesRead</span><span class="p">):</span>
    <span class="k">return</span> <span class="n">NtReadVirtualMemory</span><span class="o">.</span><span class="n">ctypes_function</span><span class="p">(</span><span class="n">hProcess</span><span class="p">,</span> <span class="n">lpBaseAddress</span><span class="p">,</span> <span class="n">lpBuffer</span><span class="p">,</span> <span class="n">nSize</span><span class="p">,</span> <span class="n">lpNumberOfBytesRead</span><span class="p">)</span>

+
 <span class="nd">@NtdllProxy</span><span class="p">(</span><span class="s1">&#39;NtWow64ReadVirtualMemory64&#39;</span><span class="p">,</span> <span class="n">error_ntstatus</span><span class="p">)</span>
 <span class="k">def</span> <span class="nf">NtWow64ReadVirtualMemory64</span><span class="p">(</span><span class="n">hProcess</span><span class="p">,</span> <span class="n">lpBaseAddress</span><span class="p">,</span> <span class="n">lpBuffer</span><span class="p">,</span> <span class="n">nSize</span><span class="p">,</span> <span class="n">lpNumberOfBytesRead</span><span class="o">=</span><span class="kc">None</span><span class="p">):</span>
    <span class="k">return</span> <span class="n">NtWow64ReadVirtualMemory64</span><span class="o">.</span><span class="n">ctypes_function</span><span class="p">(</span><span class="n">hProcess</span><span class="p">,</span> <span class="n">lpBaseAddress</span><span class="p">,</span> <span class="n">lpBuffer</span><span class="p">,</span> <span class="n">nSize</span><span class="p">,</span> <span class="n">lpNumberOfBytesRead</span><span class="p">)</span>

+
+<span class="nd">@NtdllProxy</span><span class="p">(</span><span class="s1">&#39;NtWriteVirtualMemory&#39;</span><span class="p">,</span> <span class="n">error_ntstatus</span><span class="p">)</span>
+<span class="k">def</span> <span class="nf">NtWriteVirtualMemory</span><span class="p">(</span><span class="n">ProcessHandle</span><span class="p">,</span> <span class="n">BaseAddress</span><span class="p">,</span> <span class="n">Buffer</span><span class="p">,</span> <span class="n">NumberOfBytesToWrite</span><span class="p">,</span> <span class="n">NumberOfBytesWritten</span><span class="p">):</span>
+    <span class="k">return</span> <span class="n">NtWriteVirtualMemory</span><span class="o">.</span><span class="n">ctypes_function</span><span class="p">(</span><span class="n">ProcessHandle</span><span class="p">,</span> <span class="n">BaseAddress</span><span class="p">,</span> <span class="n">Buffer</span><span class="p">,</span> <span class="n">NumberOfBytesToWrite</span><span class="p">,</span> <span class="n">NumberOfBytesWritten</span><span class="p">)</span>
+
+
 <span class="nd">@NtdllProxy</span><span class="p">(</span><span class="s1">&#39;NtWow64WriteVirtualMemory64&#39;</span><span class="p">,</span> <span class="n">error_ntstatus</span><span class="p">)</span>
 <span class="k">def</span> <span class="nf">NtWow64WriteVirtualMemory64</span><span class="p">(</span><span class="n">hProcess</span><span class="p">,</span> <span class="n">lpBaseAddress</span><span class="p">,</span> <span class="n">lpBuffer</span><span class="p">,</span> <span class="n">nSize</span><span class="p">,</span> <span class="n">lpNumberOfBytesWritten</span><span class="o">=</span><span class="kc">None</span><span class="p">):</span>
    <span class="k">return</span> <span class="n">NtWow64WriteVirtualMemory64</span><span class="o">.</span><span class="n">ctypes_function</span><span class="p">(</span><span class="n">hProcess</span><span class="p">,</span> <span class="n">lpBaseAddress</span><span class="p">,</span> <span class="n">lpBuffer</span><span class="p">,</span> <span class="n">nSize</span><span class="p">,</span> <span class="n">lpNumberOfBytesWritten</span><span class="p">)</span>
@@ -915,6 +929,17 @@
    <span class="k">return</span> <span class="n">NtQueryInformationThread</span><span class="o">.</span><span class="n">ctypes_function</span><span class="p">(</span><span class="n">ThreadHandle</span><span class="p">,</span> <span class="n">ThreadInformationClass</span><span class="p">,</span> <span class="n">ThreadInformation</span><span class="p">,</span> <span class="n">ThreadInformationLength</span><span class="p">,</span> <span class="n">ReturnLength</span><span class="p">)</span>


+<span class="nd">@NtdllProxy</span><span class="p">(</span><span class="s1">&#39;NtAllocateVirtualMemory&#39;</span><span class="p">,</span> <span class="n">error_ntstatus</span><span class="p">)</span>
+<span class="k">def</span> <span class="nf">NtAllocateVirtualMemory</span><span class="p">(</span><span class="n">ProcessHandle</span><span class="p">,</span> <span class="n">BaseAddress</span><span class="p">,</span> <span class="n">ZeroBits</span><span class="p">,</span> <span class="n">RegionSize</span><span class="p">,</span> <span class="n">AllocationType</span><span class="p">,</span> <span class="n">Protect</span><span class="p">):</span>
+    <span class="k">return</span> <span class="n">NtAllocateVirtualMemory</span><span class="o">.</span><span class="n">ctypes_function</span><span class="p">(</span><span class="n">ProcessHandle</span><span class="p">,</span> <span class="n">BaseAddress</span><span class="p">,</span> <span class="n">ZeroBits</span><span class="p">,</span> <span class="n">RegionSize</span><span class="p">,</span> <span class="n">AllocationType</span><span class="p">,</span> <span class="n">Protect</span><span class="p">)</span>
+
+
+<span class="nd">@NtdllProxy</span><span class="p">(</span><span class="s1">&#39;NtFreeVirtualMemory&#39;</span><span class="p">,</span> <span class="n">error_ntstatus</span><span class="p">)</span>
+<span class="k">def</span> <span class="nf">NtFreeVirtualMemory</span><span class="p">(</span><span class="n">ProcessHandle</span><span class="p">,</span> <span class="n">BaseAddress</span><span class="p">,</span> <span class="n">RegionSize</span><span class="p">,</span> <span class="n">FreeType</span><span class="p">):</span>
+    <span class="k">return</span> <span class="n">NtFreeVirtualMemory</span><span class="o">.</span><span class="n">ctypes_function</span><span class="p">(</span><span class="n">ProcessHandle</span><span class="p">,</span> <span class="n">BaseAddress</span><span class="p">,</span> <span class="n">RegionSize</span><span class="p">,</span> <span class="n">FreeType</span><span class="p">)</span>
+
+
+
 <span class="nd">@NtdllProxy</span><span class="p">(</span><span class="s1">&#39;NtProtectVirtualMemory&#39;</span><span class="p">,</span> <span class="n">error_ntstatus</span><span class="p">)</span>
 <span class="k">def</span> <span class="nf">NtProtectVirtualMemory</span><span class="p">(</span><span class="n">ProcessHandle</span><span class="p">,</span> <span class="n">BaseAddress</span><span class="p">,</span> <span class="n">NumberOfBytesToProtect</span><span class="p">,</span> <span class="n">NewAccessProtection</span><span class="p">,</span> <span class="n">OldAccessProtection</span><span class="o">=</span><span class="kc">None</span><span class="p">):</span>
    <span class="k">if</span> <span class="n">OldAccessProtection</span> <span class="ow">is</span> <span class="kc">None</span><span class="p">:</span>
@@ -1135,6 +1160,19 @@
 <span class="k">def</span> <span class="nf">OpenThreadToken</span><span class="p">(</span><span class="n">ThreadHandle</span><span class="p">,</span> <span class="n">DesiredAccess</span><span class="p">,</span> <span class="n">OpenAsSelf</span><span class="p">,</span> <span class="n">TokenHandle</span><span class="p">):</span>
    <span class="k">return</span> <span class="n">OpenThreadToken</span><span class="o">.</span><span class="n">ctypes_function</span><span class="p">(</span><span class="n">ThreadHandle</span><span class="p">,</span> <span class="n">DesiredAccess</span><span class="p">,</span> <span class="n">OpenAsSelf</span><span class="p">,</span> <span class="n">TokenHandle</span><span class="p">)</span>

+<span class="nd">@Advapi32Proxy</span><span class="p">(</span><span class="s1">&#39;SetThreadToken&#39;</span><span class="p">)</span>
+<span class="k">def</span> <span class="nf">SetThreadToken</span><span class="p">(</span><span class="n">Thread</span><span class="p">,</span> <span class="n">Token</span><span class="p">):</span>
+    <span class="k">return</span> <span class="n">SetThreadToken</span><span class="o">.</span><span class="n">ctypes_function</span><span class="p">(</span><span class="n">Thread</span><span class="p">,</span> <span class="n">Token</span><span class="p">)</span>
+
+<span class="nd">@Advapi32Proxy</span><span class="p">(</span><span class="s1">&#39;DuplicateToken&#39;</span><span class="p">)</span>
+<span class="k">def</span> <span class="nf">DuplicateToken</span><span class="p">(</span><span class="n">ExistingTokenHandle</span><span class="p">,</span> <span class="n">ImpersonationLevel</span><span class="p">,</span> <span class="n">DuplicateTokenHandle</span><span class="p">):</span>
+    <span class="k">return</span> <span class="n">DuplicateToken</span><span class="o">.</span><span class="n">ctypes_function</span><span class="p">(</span><span class="n">ExistingTokenHandle</span><span class="p">,</span> <span class="n">ImpersonationLevel</span><span class="p">,</span> <span class="n">DuplicateTokenHandle</span><span class="p">)</span>
+
+<span class="nd">@Advapi32Proxy</span><span class="p">(</span><span class="s1">&#39;DuplicateTokenEx&#39;</span><span class="p">)</span>
+<span class="k">def</span> <span class="nf">DuplicateTokenEx</span><span class="p">(</span><span class="n">hExistingToken</span><span class="p">,</span> <span class="n">dwDesiredAccess</span><span class="p">,</span> <span class="n">lpTokenAttributes</span><span class="p">,</span> <span class="n">ImpersonationLevel</span><span class="p">,</span> <span class="n">TokenType</span><span class="p">,</span> <span class="n">phNewToken</span><span class="p">):</span>
+    <span class="k">return</span> <span class="n">DuplicateTokenEx</span><span class="o">.</span><span class="n">ctypes_function</span><span class="p">(</span><span class="n">hExistingToken</span><span class="p">,</span> <span class="n">dwDesiredAccess</span><span class="p">,</span> <span class="n">lpTokenAttributes</span><span class="p">,</span> <span class="n">ImpersonationLevel</span><span class="p">,</span> <span class="n">TokenType</span><span class="p">,</span> <span class="n">phNewToken</span><span class="p">)</span>
+
+
 <span class="nd">@Advapi32Proxy</span><span class="p">(</span><span class="s1">&#39;LookupPrivilegeValueA&#39;</span><span class="p">)</span>
 <span class="k">def</span> <span class="nf">LookupPrivilegeValueA</span><span class="p">(</span><span class="n">lpSystemName</span><span class="o">=</span><span class="kc">None</span><span class="p">,</span> <span class="n">lpName</span><span class="o">=</span><span class="n">NeededParameter</span><span class="p">,</span> <span class="n">lpLuid</span><span class="o">=</span><span class="n">NeededParameter</span><span class="p">):</span>
    <span class="k">return</span> <span class="n">LookupPrivilegeValueA</span><span class="o">.</span><span class="n">ctypes_function</span><span class="p">(</span><span class="n">lpSystemName</span><span class="p">,</span> <span class="n">lpName</span><span class="p">,</span> <span class="n">lpLuid</span><span class="p">)</span>
@@ -1326,6 +1364,15 @@
 <span class="k">def</span> <span class="nf">OpenEventLogW</span><span class="p">(</span><span class="n">lpUNCServerName</span><span class="o">=</span><span class="kc">None</span><span class="p">,</span> <span class="n">lpSourceName</span><span class="o">=</span><span class="n">NeededParameter</span><span class="p">):</span>
    <span class="k">return</span> <span class="n">OpenEventLogW</span><span class="o">.</span><span class="n">ctypes_function</span><span class="p">(</span><span class="n">lpUNCServerName</span><span class="p">,</span> <span class="n">lpSourceName</span><span class="p">)</span>

+<span class="nd">@Advapi32Proxy</span><span class="p">(</span><span class="s1">&#39;OpenBackupEventLogA&#39;</span><span class="p">)</span>
+<span class="k">def</span> <span class="nf">OpenBackupEventLogA</span><span class="p">(</span><span class="n">lpUNCServerName</span><span class="o">=</span><span class="kc">None</span><span class="p">,</span> <span class="n">lpSourceName</span><span class="o">=</span><span class="n">NeededParameter</span><span class="p">):</span>
+    <span class="k">return</span> <span class="n">OpenBackupEventLogA</span><span class="o">.</span><span class="n">ctypes_function</span><span class="p">(</span><span class="n">lpUNCServerName</span><span class="p">,</span> <span class="n">lpSourceName</span><span class="p">)</span>
+
+<span class="nd">@Advapi32Proxy</span><span class="p">(</span><span class="s1">&#39;OpenBackupEventLogW&#39;</span><span class="p">)</span>
+<span class="k">def</span> <span class="nf">OpenBackupEventLogW</span><span class="p">(</span><span class="n">lpUNCServerName</span><span class="o">=</span><span class="kc">None</span><span class="p">,</span> <span class="n">lpSourceName</span><span class="o">=</span><span class="n">NeededParameter</span><span class="p">):</span>
+    <span class="k">return</span> <span class="n">OpenBackupEventLogW</span><span class="o">.</span><span class="n">ctypes_function</span><span class="p">(</span><span class="n">lpUNCServerName</span><span class="p">,</span> <span class="n">lpSourceName</span><span class="p">)</span>
+
+
 <span class="nd">@Advapi32Proxy</span><span class="p">(</span><span class="s1">&#39;ReadEventLogA&#39;</span><span class="p">)</span>
 <span class="k">def</span> <span class="nf">ReadEventLogA</span><span class="p">(</span><span class="n">hEventLog</span><span class="p">,</span> <span class="n">dwReadFlags</span><span class="p">,</span> <span class="n">dwRecordOffset</span><span class="p">,</span> <span class="n">lpBuffer</span><span class="p">,</span> <span class="n">nNumberOfBytesToRead</span><span class="p">,</span> <span class="n">pnBytesRead</span><span class="p">,</span> <span class="n">pnMinNumberOfBytesNeeded</span><span class="p">):</span>
    <span class="k">return</span> <span class="n">ReadEventLogA</span><span class="o">.</span><span class="n">ctypes_function</span><span class="p">(</span><span class="n">hEventLog</span><span class="p">,</span> <span class="n">dwReadFlags</span><span class="p">,</span> <span class="n">dwRecordOffset</span><span class="p">,</span> <span class="n">lpBuffer</span><span class="p">,</span> <span class="n">nNumberOfBytesToRead</span><span class="p">,</span> <span class="n">pnBytesRead</span><span class="p">,</span> <span class="n">pnMinNumberOfBytesNeeded</span><span class="p">)</span>
@@ -1738,6 +1785,15 @@
 <span class="k">def</span> <span class="nf">CoCreateInstance</span><span class="p">(</span><span class="n">rclsid</span><span class="p">,</span> <span class="n">pUnkOuter</span><span class="o">=</span><span class="kc">None</span><span class="p">,</span> <span class="n">dwClsContext</span><span class="o">=</span><span class="n">CLSCTX_INPROC_SERVER</span><span class="p">,</span> <span class="n">riid</span><span class="o">=</span><span class="n">NeededParameter</span><span class="p">,</span> <span class="n">ppv</span><span class="o">=</span><span class="n">NeededParameter</span><span class="p">):</span>
    <span class="k">return</span> <span class="n">CoCreateInstance</span><span class="o">.</span><span class="n">ctypes_function</span><span class="p">(</span><span class="n">rclsid</span><span class="p">,</span> <span class="n">pUnkOuter</span><span class="p">,</span> <span class="n">dwClsContext</span><span class="p">,</span> <span class="n">riid</span><span class="p">,</span> <span class="n">ppv</span><span class="p">)</span>

+<span class="nd">@Ole32Proxy</span><span class="p">(</span><span class="s1">&#39;CoCreateInstanceEx&#39;</span><span class="p">)</span>
+<span class="k">def</span> <span class="nf">CoCreateInstanceEx</span><span class="p">(</span><span class="n">rclsid</span><span class="p">,</span> <span class="n">punkOuter</span><span class="p">,</span> <span class="n">dwClsCtx</span><span class="p">,</span> <span class="n">pServerInfo</span><span class="p">,</span> <span class="n">dwCount</span><span class="p">,</span> <span class="n">pResults</span><span class="p">):</span>
+    <span class="k">return</span> <span class="n">CoCreateInstanceEx</span><span class="o">.</span><span class="n">ctypes_function</span><span class="p">(</span><span class="n">rclsid</span><span class="p">,</span> <span class="n">punkOuter</span><span class="p">,</span> <span class="n">dwClsCtx</span><span class="p">,</span> <span class="n">pServerInfo</span><span class="p">,</span> <span class="n">dwCount</span><span class="p">,</span> <span class="n">pResults</span><span class="p">)</span>
+
+
+<span class="nd">@Ole32Proxy</span><span class="p">(</span><span class="s1">&#39;CoGetInterceptor&#39;</span><span class="p">)</span>
+<span class="k">def</span> <span class="nf">CoGetInterceptor</span><span class="p">(</span><span class="n">iidIntercepted</span><span class="p">,</span> <span class="n">punkOuter</span><span class="p">,</span> <span class="n">iid</span><span class="p">,</span> <span class="n">ppv</span><span class="p">):</span>
+    <span class="k">return</span> <span class="n">CoGetInterceptor</span><span class="o">.</span><span class="n">ctypes_function</span><span class="p">(</span><span class="n">iidIntercepted</span><span class="p">,</span> <span class="n">punkOuter</span><span class="p">,</span> <span class="n">iid</span><span class="p">,</span> <span class="n">ppv</span><span class="p">)</span>
+
 <span class="c1"># ## Shell32 ## #</span>

 <span class="nd">@Shell32Proxy</span><span class="p">(</span><span class="s1">&#39;ShellExecuteA&#39;</span><span class="p">)</span>
@@ -1798,6 +1854,111 @@
 <span class="k">def</span> <span class="nf">SetNamedPipeHandleState</span><span class="p">(</span><span class="n">hNamedPipe</span><span class="p">,</span> <span class="n">lpMode</span><span class="p">,</span> <span class="n">lpMaxCollectionCount</span><span class="p">,</span> <span class="n">lpCollectDataTimeout</span><span class="p">):</span>
    <span class="k">return</span> <span class="n">SetNamedPipeHandleState</span><span class="o">.</span><span class="n">ctypes_function</span><span class="p">(</span><span class="n">hNamedPipe</span><span class="p">,</span> <span class="n">lpMode</span><span class="p">,</span> <span class="n">lpMaxCollectionCount</span><span class="p">,</span> <span class="n">lpCollectDataTimeout</span><span class="p">)</span>

+
+<span class="c1"># Eventlog stuff</span>
+
+<span class="nd">@WevtapiProxy</span><span class="p">(</span><span class="s2">&quot;EvtOpenLog&quot;</span><span class="p">)</span>
+<span class="k">def</span> <span class="nf">EvtOpenLog</span><span class="p">(</span><span class="n">Session</span><span class="p">,</span> <span class="n">Path</span><span class="p">,</span> <span class="n">Flags</span><span class="p">):</span>
+    <span class="k">return</span> <span class="n">EvtOpenLog</span><span class="o">.</span><span class="n">ctypes_function</span><span class="p">(</span><span class="n">Session</span><span class="p">,</span> <span class="n">Path</span><span class="p">,</span> <span class="n">Flags</span><span class="p">)</span>
+
+
+<span class="nd">@WevtapiProxy</span><span class="p">(</span><span class="s2">&quot;EvtClose&quot;</span><span class="p">)</span>
+<span class="k">def</span> <span class="nf">EvtClose</span><span class="p">(</span><span class="n">Object</span><span class="p">):</span>
+    <span class="k">return</span> <span class="n">EvtClose</span><span class="o">.</span><span class="n">ctypes_function</span><span class="p">(</span><span class="n">Object</span><span class="p">)</span>
+
+
+<span class="nd">@WevtapiProxy</span><span class="p">(</span><span class="s2">&quot;EvtQuery&quot;</span><span class="p">)</span>
+<span class="k">def</span> <span class="nf">EvtQuery</span><span class="p">(</span><span class="n">Session</span><span class="p">,</span> <span class="n">Path</span><span class="p">,</span> <span class="n">Query</span><span class="p">,</span> <span class="n">Flags</span><span class="p">):</span>
+    <span class="k">return</span> <span class="n">EvtQuery</span><span class="o">.</span><span class="n">ctypes_function</span><span class="p">(</span><span class="n">Session</span><span class="p">,</span> <span class="n">Path</span><span class="p">,</span> <span class="n">Query</span><span class="p">,</span> <span class="n">Flags</span><span class="p">)</span>
+
+
+<span class="nd">@WevtapiProxy</span><span class="p">(</span><span class="s2">&quot;EvtNext&quot;</span><span class="p">)</span>
+<span class="k">def</span> <span class="nf">EvtNext</span><span class="p">(</span><span class="n">ResultSet</span><span class="p">,</span> <span class="n">EventArraySize</span><span class="p">,</span> <span class="n">EventArray</span><span class="p">,</span> <span class="n">Timeout</span><span class="p">,</span> <span class="n">Flags</span><span class="p">,</span> <span class="n">Returned</span><span class="p">):</span>
+    <span class="k">return</span> <span class="n">EvtNext</span><span class="o">.</span><span class="n">ctypes_function</span><span class="p">(</span><span class="n">ResultSet</span><span class="p">,</span> <span class="n">EventArraySize</span><span class="p">,</span> <span class="n">EventArray</span><span class="p">,</span> <span class="n">Timeout</span><span class="p">,</span> <span class="n">Flags</span><span class="p">,</span> <span class="n">Returned</span><span class="p">)</span>
+
+
+<span class="nd">@WevtapiProxy</span><span class="p">(</span><span class="s2">&quot;EvtCreateRenderContext&quot;</span><span class="p">)</span>
+<span class="k">def</span> <span class="nf">EvtCreateRenderContext</span><span class="p">(</span><span class="n">ValuePathsCount</span><span class="p">,</span> <span class="n">ValuePaths</span><span class="p">,</span> <span class="n">Flags</span><span class="p">):</span>
+    <span class="k">return</span> <span class="n">EvtCreateRenderContext</span><span class="o">.</span><span class="n">ctypes_function</span><span class="p">(</span><span class="n">ValuePathsCount</span><span class="p">,</span> <span class="n">ValuePaths</span><span class="p">,</span> <span class="n">Flags</span><span class="p">)</span>
+
+
+<span class="nd">@WevtapiProxy</span><span class="p">(</span><span class="s2">&quot;EvtRender&quot;</span><span class="p">)</span>
+<span class="k">def</span> <span class="nf">EvtRender</span><span class="p">(</span><span class="n">Context</span><span class="p">,</span> <span class="n">Fragment</span><span class="p">,</span> <span class="n">Flags</span><span class="p">,</span> <span class="n">BufferSize</span><span class="p">,</span> <span class="n">Buffer</span><span class="p">,</span> <span class="n">BufferUsed</span><span class="p">,</span> <span class="n">PropertyCount</span><span class="p">):</span>
+    <span class="k">return</span> <span class="n">EvtRender</span><span class="o">.</span><span class="n">ctypes_function</span><span class="p">(</span><span class="n">Context</span><span class="p">,</span> <span class="n">Fragment</span><span class="p">,</span> <span class="n">Flags</span><span class="p">,</span> <span class="n">BufferSize</span><span class="p">,</span> <span class="n">Buffer</span><span class="p">,</span> <span class="n">BufferUsed</span><span class="p">,</span> <span class="n">PropertyCount</span><span class="p">)</span>
+
+
+<span class="nd">@WevtapiProxy</span><span class="p">(</span><span class="s2">&quot;EvtOpenChannelEnum&quot;</span><span class="p">)</span>
+<span class="k">def</span> <span class="nf">EvtOpenChannelEnum</span><span class="p">(</span><span class="n">Session</span><span class="p">,</span> <span class="n">Flags</span><span class="p">):</span>
+    <span class="k">return</span> <span class="n">EvtOpenChannelEnum</span><span class="o">.</span><span class="n">ctypes_function</span><span class="p">(</span><span class="n">Session</span><span class="p">,</span> <span class="n">Flags</span><span class="p">)</span>
+
+
+<span class="nd">@WevtapiProxy</span><span class="p">(</span><span class="s2">&quot;EvtNextChannelPath&quot;</span><span class="p">)</span>
+<span class="k">def</span> <span class="nf">EvtNextChannelPath</span><span class="p">(</span><span class="n">ChannelEnum</span><span class="p">,</span> <span class="n">ChannelPathBufferSize</span><span class="p">,</span> <span class="n">ChannelPathBuffer</span><span class="p">,</span> <span class="n">ChannelPathBufferUsed</span><span class="p">):</span>
+    <span class="k">return</span> <span class="n">EvtNextChannelPath</span><span class="o">.</span><span class="n">ctypes_function</span><span class="p">(</span><span class="n">ChannelEnum</span><span class="p">,</span> <span class="n">ChannelPathBufferSize</span><span class="p">,</span> <span class="n">ChannelPathBuffer</span><span class="p">,</span> <span class="n">ChannelPathBufferUsed</span><span class="p">)</span>
+
+
+<span class="nd">@WevtapiProxy</span><span class="p">(</span><span class="s2">&quot;EvtOpenPublisherEnum&quot;</span><span class="p">)</span>
+<span class="k">def</span> <span class="nf">EvtOpenPublisherEnum</span><span class="p">(</span><span class="n">Session</span><span class="p">,</span> <span class="n">Flags</span><span class="p">):</span>
+    <span class="k">return</span> <span class="n">EvtOpenPublisherEnum</span><span class="o">.</span><span class="n">ctypes_function</span><span class="p">(</span><span class="n">Session</span><span class="p">,</span> <span class="n">Flags</span><span class="p">)</span>
+
+
+<span class="nd">@WevtapiProxy</span><span class="p">(</span><span class="s2">&quot;EvtNextPublisherId&quot;</span><span class="p">)</span>
+<span class="k">def</span> <span class="nf">EvtNextPublisherId</span><span class="p">(</span><span class="n">PublisherEnum</span><span class="p">,</span> <span class="n">PublisherIdBufferSize</span><span class="p">,</span> <span class="n">PublisherIdBuffer</span><span class="p">,</span> <span class="n">PublisherIdBufferUsed</span><span class="p">):</span>
+    <span class="k">return</span> <span class="n">EvtNextPublisherId</span><span class="o">.</span><span class="n">ctypes_function</span><span class="p">(</span><span class="n">PublisherEnum</span><span class="p">,</span> <span class="n">PublisherIdBufferSize</span><span class="p">,</span> <span class="n">PublisherIdBuffer</span><span class="p">,</span> <span class="n">PublisherIdBufferUsed</span><span class="p">)</span>
+
+
+<span class="nd">@WevtapiProxy</span><span class="p">(</span><span class="s2">&quot;EvtGetLogInfo&quot;</span><span class="p">)</span>
+<span class="k">def</span> <span class="nf">EvtGetLogInfo</span><span class="p">(</span><span class="n">Log</span><span class="p">,</span> <span class="n">PropertyId</span><span class="p">,</span> <span class="n">PropertyValueBufferSize</span><span class="p">,</span> <span class="n">PropertyValueBuffer</span><span class="p">,</span> <span class="n">PropertyValueBufferUsed</span><span class="p">):</span>
+    <span class="k">return</span> <span class="n">EvtGetLogInfo</span><span class="o">.</span><span class="n">ctypes_function</span><span class="p">(</span><span class="n">Log</span><span class="p">,</span> <span class="n">PropertyId</span><span class="p">,</span> <span class="n">PropertyValueBufferSize</span><span class="p">,</span> <span class="n">PropertyValueBuffer</span><span class="p">,</span> <span class="n">PropertyValueBufferUsed</span><span class="p">)</span>
+
+
+<span class="nd">@WevtapiProxy</span><span class="p">(</span><span class="s2">&quot;EvtOpenChannelConfig&quot;</span><span class="p">)</span>
+<span class="k">def</span> <span class="nf">EvtOpenChannelConfig</span><span class="p">(</span><span class="n">Session</span><span class="p">,</span> <span class="n">ChannelPath</span><span class="p">,</span> <span class="n">Flags</span><span class="p">):</span>
+    <span class="k">return</span> <span class="n">EvtOpenChannelConfig</span><span class="o">.</span><span class="n">ctypes_function</span><span class="p">(</span><span class="n">Session</span><span class="p">,</span> <span class="n">ChannelPath</span><span class="p">,</span> <span class="n">Flags</span><span class="p">)</span>
+
+
+<span class="nd">@WevtapiProxy</span><span class="p">(</span><span class="s2">&quot;EvtGetChannelConfigProperty&quot;</span><span class="p">)</span>
+<span class="k">def</span> <span class="nf">EvtGetChannelConfigProperty</span><span class="p">(</span><span class="n">ChannelConfig</span><span class="p">,</span> <span class="n">PropertyId</span><span class="p">,</span> <span class="n">Flags</span><span class="p">,</span> <span class="n">PropertyValueBufferSize</span><span class="p">,</span> <span class="n">PropertyValueBuffer</span><span class="p">,</span> <span class="n">PropertyValueBufferUsed</span><span class="p">):</span>
+    <span class="k">return</span> <span class="n">EvtGetChannelConfigProperty</span><span class="o">.</span><span class="n">ctypes_function</span><span class="p">(</span><span class="n">ChannelConfig</span><span class="p">,</span> <span class="n">PropertyId</span><span class="p">,</span> <span class="n">Flags</span><span class="p">,</span> <span class="n">PropertyValueBufferSize</span><span class="p">,</span> <span class="n">PropertyValueBuffer</span><span class="p">,</span> <span class="n">PropertyValueBufferUsed</span><span class="p">)</span>
+
+
+<span class="nd">@WevtapiProxy</span><span class="p">(</span><span class="s2">&quot;EvtOpenPublisherMetadata&quot;</span><span class="p">)</span>
+<span class="k">def</span> <span class="nf">EvtOpenPublisherMetadata</span><span class="p">(</span><span class="n">Session</span><span class="p">,</span> <span class="n">PublisherIdentity</span><span class="p">,</span> <span class="n">LogFilePath</span><span class="p">,</span> <span class="n">Locale</span><span class="p">,</span> <span class="n">Flags</span><span class="p">):</span>
+    <span class="k">return</span> <span class="n">EvtOpenPublisherMetadata</span><span class="o">.</span><span class="n">ctypes_function</span><span class="p">(</span><span class="n">Session</span><span class="p">,</span> <span class="n">PublisherIdentity</span><span class="p">,</span> <span class="n">LogFilePath</span><span class="p">,</span> <span class="n">Locale</span><span class="p">,</span> <span class="n">Flags</span><span class="p">)</span>
+
+
+<span class="nd">@WevtapiProxy</span><span class="p">(</span><span class="s2">&quot;EvtOpenEventMetadataEnum&quot;</span><span class="p">)</span>
+<span class="k">def</span> <span class="nf">EvtOpenEventMetadataEnum</span><span class="p">(</span><span class="n">PublisherMetadata</span><span class="p">,</span> <span class="n">Flags</span><span class="p">):</span>
+    <span class="k">return</span> <span class="n">EvtOpenEventMetadataEnum</span><span class="o">.</span><span class="n">ctypes_function</span><span class="p">(</span><span class="n">PublisherMetadata</span><span class="p">,</span> <span class="n">Flags</span><span class="p">)</span>
+
+
+<span class="nd">@WevtapiProxy</span><span class="p">(</span><span class="s2">&quot;EvtNextEventMetadata&quot;</span><span class="p">)</span>
+<span class="k">def</span> <span class="nf">EvtNextEventMetadata</span><span class="p">(</span><span class="n">EventMetadataEnum</span><span class="p">,</span> <span class="n">Flags</span><span class="p">):</span>
+    <span class="k">return</span> <span class="n">EvtNextEventMetadata</span><span class="o">.</span><span class="n">ctypes_function</span><span class="p">(</span><span class="n">EventMetadataEnum</span><span class="p">,</span> <span class="n">Flags</span><span class="p">)</span>
+
+
+<span class="nd">@WevtapiProxy</span><span class="p">(</span><span class="s2">&quot;EvtGetEventMetadataProperty&quot;</span><span class="p">)</span>
+<span class="k">def</span> <span class="nf">EvtGetEventMetadataProperty</span><span class="p">(</span><span class="n">EventMetadata</span><span class="p">,</span> <span class="n">PropertyId</span><span class="p">,</span> <span class="n">Flags</span><span class="p">,</span> <span class="n">EventMetadataPropertyBufferSize</span><span class="p">,</span> <span class="n">EventMetadataPropertyBuffer</span><span class="p">,</span> <span class="n">EventMetadataPropertyBufferUsed</span><span class="p">):</span>
+    <span class="k">return</span> <span class="n">EvtGetEventMetadataProperty</span><span class="o">.</span><span class="n">ctypes_function</span><span class="p">(</span><span class="n">EventMetadata</span><span class="p">,</span> <span class="n">PropertyId</span><span class="p">,</span> <span class="n">Flags</span><span class="p">,</span> <span class="n">EventMetadataPropertyBufferSize</span><span class="p">,</span> <span class="n">EventMetadataPropertyBuffer</span><span class="p">,</span> <span class="n">EventMetadataPropertyBufferUsed</span><span class="p">)</span>
+
+
+<span class="nd">@WevtapiProxy</span><span class="p">(</span><span class="s2">&quot;EvtGetPublisherMetadataProperty&quot;</span><span class="p">)</span>
+<span class="k">def</span> <span class="nf">EvtGetPublisherMetadataProperty</span><span class="p">(</span><span class="n">PublisherMetadata</span><span class="p">,</span> <span class="n">PropertyId</span><span class="p">,</span> <span class="n">Flags</span><span class="p">,</span> <span class="n">PublisherMetadataPropertyBufferSize</span><span class="p">,</span> <span class="n">PublisherMetadataPropertyBuffer</span><span class="p">,</span> <span class="n">PublisherMetadataPropertyBufferUsed</span><span class="p">):</span>
+    <span class="k">return</span> <span class="n">EvtGetPublisherMetadataProperty</span><span class="o">.</span><span class="n">ctypes_function</span><span class="p">(</span><span class="n">PublisherMetadata</span><span class="p">,</span> <span class="n">PropertyId</span><span class="p">,</span> <span class="n">Flags</span><span class="p">,</span> <span class="n">PublisherMetadataPropertyBufferSize</span><span class="p">,</span> <span class="n">PublisherMetadataPropertyBuffer</span><span class="p">,</span> <span class="n">PublisherMetadataPropertyBufferUsed</span><span class="p">)</span>
+
+
+<span class="nd">@WevtapiProxy</span><span class="p">(</span><span class="s2">&quot;EvtGetObjectArraySize&quot;</span><span class="p">)</span>
+<span class="k">def</span> <span class="nf">EvtGetObjectArraySize</span><span class="p">(</span><span class="n">ObjectArray</span><span class="p">,</span> <span class="n">ObjectArraySize</span><span class="p">):</span>
+    <span class="k">return</span> <span class="n">EvtGetObjectArraySize</span><span class="o">.</span><span class="n">ctypes_function</span><span class="p">(</span><span class="n">ObjectArray</span><span class="p">,</span> <span class="n">ObjectArraySize</span><span class="p">)</span>
+
+
+<span class="nd">@WevtapiProxy</span><span class="p">(</span><span class="s2">&quot;EvtGetObjectArrayProperty&quot;</span><span class="p">)</span>
+<span class="k">def</span> <span class="nf">EvtGetObjectArrayProperty</span><span class="p">(</span><span class="n">ObjectArray</span><span class="p">,</span> <span class="n">PropertyId</span><span class="p">,</span> <span class="n">ArrayIndex</span><span class="p">,</span> <span class="n">Flags</span><span class="p">,</span> <span class="n">PropertyValueBufferSize</span><span class="p">,</span> <span class="n">PropertyValueBuffer</span><span class="p">,</span> <span class="n">PropertyValueBufferUsed</span><span class="p">):</span>
+    <span class="k">return</span> <span class="n">EvtGetObjectArrayProperty</span><span class="o">.</span><span class="n">ctypes_function</span><span class="p">(</span><span class="n">ObjectArray</span><span class="p">,</span> <span class="n">PropertyId</span><span class="p">,</span> <span class="n">ArrayIndex</span><span class="p">,</span> <span class="n">Flags</span><span class="p">,</span> <span class="n">PropertyValueBufferSize</span><span class="p">,</span> <span class="n">PropertyValueBuffer</span><span class="p">,</span> <span class="n">PropertyValueBufferUsed</span><span class="p">)</span>
+
+<span class="nd">@WevtapiProxy</span><span class="p">(</span><span class="s2">&quot;EvtFormatMessage&quot;</span><span class="p">)</span>
+<span class="k">def</span> <span class="nf">EvtFormatMessage</span><span class="p">(</span><span class="n">PublisherMetadata</span><span class="p">,</span> <span class="n">Event</span><span class="p">,</span> <span class="n">MessageId</span><span class="p">,</span> <span class="n">ValueCount</span><span class="p">,</span> <span class="n">Values</span><span class="p">,</span> <span class="n">Flags</span><span class="p">,</span> <span class="n">BufferSize</span><span class="p">,</span> <span class="n">Buffer</span><span class="p">,</span> <span class="n">BufferUsed</span><span class="p">):</span>
+    <span class="k">return</span> <span class="n">EvtFormatMessage</span><span class="o">.</span><span class="n">ctypes_function</span><span class="p">(</span><span class="n">PublisherMetadata</span><span class="p">,</span> <span class="n">Event</span><span class="p">,</span> <span class="n">MessageId</span><span class="p">,</span> <span class="n">ValueCount</span><span class="p">,</span> <span class="n">Values</span><span class="p">,</span> <span class="n">Flags</span><span class="p">,</span> <span class="n">BufferSize</span><span class="p">,</span> <span class="n">Buffer</span><span class="p">,</span> <span class="n">BufferUsed</span><span class="p">)</span>
 </pre></div>

          </div>
@@ -31,7 +31,7 @@ You can then use the instance to call whatever method you need.

 .. note::

-    see sample :ref:`sample_com_firewall`
+    see samples :ref:`sample_com`

 Implementing a COM interface
 ''''''''''''''''''''''''''''
@@ -41,4 +41,15 @@ To create `COM` object you need to:
    1. Create your ``COMImplementation`` with an ``IMPLEMENT`` attribute  that should be a cominterface `CODE 1 <https://github.com/sogeti-esec-lab/LKD/blob/efabf3cc38b94d4180ebe8d2c554da5d76b2fea1/lkd/dbginterface/base.py#L48>`_
    2. Implements the methods of the interface `CODE 2 <https://github.com/sogeti-esec-lab/LKD/blob/efabf3cc38b94d4180ebe8d2c554da5d76b2fea1/lkd/dbginterface/base.py#L55>`_
    3. Create an instance `CODE3 <https://github.com/sogeti-esec-lab/LKD/blob/efabf3cc38b94d4180ebe8d2c554da5d76b2fea1/lkd/dbginterface/base.py#L59>`_
-    4. Pass it to whatever native function expects it `CODE4 <https://github.com/sogeti-esec-lab/LKD/blob/efabf3cc38b94d4180ebe8d2c554da5d76b2fea1/lkd/dbginterface/base.py#L272>`_
+    4. Pass it to whatever native function expects it `CODE4 <https://github.com/sogeti-esec-lab/LKD/blob/efabf3cc38b94d4180ebe8d2c554da5d76b2fea1/lkd/dbginterface/base.py#L272>`_
+
+.. note::
+
+    see samples :ref:`sample_com_icallinterceptor`
+
+API
+'''
+
+.. autofunction:: init
+.. autofunction:: create_instance
+.. autoclass:: COMImplementation
@@ -287,10 +287,15 @@ Output
 .. literalinclude:: samples_output\wmi_wmi_request.txt


+.. _sample_com:
+
+:mod:`windows.com`
+""""""""""""""""""
+
 .. _sample_com_firewall:

-using COM: ``INetFwPolicy2``
-""""""""""""""""""""""""""""
+``INetFwPolicy2``
+'''''''''''''''''

 .. literalinclude:: ..\..\samples\com\com_inetfwpolicy2.py

@@ -299,6 +304,18 @@ Output
 .. literalinclude:: samples_output\com_com_inetfwpolicy2.txt


+.. _sample_com_icallinterceptor:
+
+``ICallInterceptor``
+''''''''''''''''''''
+
+.. literalinclude:: ..\..\samples\com\icallinterceptor.py
+
+Output
+
+.. literalinclude:: samples_output\com_icallinterceptor.txt
+
+

 :mod:`windows.crypto`
 """""""""""""""""""""
@@ -19,7 +19,3 @@ WmiRequester
 """"""""""""

 .. autoclass:: WmiRequester
-
-
-
-
@@ -68,7 +68,7 @@ Then you need to retrieve the interface by using an API returning an object or <
 You can then use the instance to call whatever method you need.</p>
 <div class="admonition note">
 <p class="first admonition-title">Note</p>
-<p class="last">see sample <a class="reference internal" href="sample.html#sample-com-firewall"><span class="std std-ref">using COM: INetFwPolicy2</span></a></p>
+<p class="last">see samples <a class="reference internal" href="sample.html#sample-com"><span class="std std-ref">windows.com</span></a></p>
 </div>
 </div>
 <div class="section" id="implementing-a-com-interface">
@@ -82,6 +82,49 @@ You can then use the instance to call whatever method you need.</p>
 <li>Pass it to whatever native function expects it <a class="reference external" href="https://github.com/sogeti-esec-lab/LKD/blob/efabf3cc38b94d4180ebe8d2c554da5d76b2fea1/lkd/dbginterface/base.py#L272">CODE4</a></li>
 </ol>
 </div></blockquote>
+<div class="admonition note">
+<p class="first admonition-title">Note</p>
+<p class="last">see samples <a class="reference internal" href="sample.html#sample-com-icallinterceptor"><span class="std std-ref">ICallInterceptor</span></a></p>
+</div>
+</div>
+<div class="section" id="api">
+<h2>9.3. API<a class="headerlink" href="#api" title="Permalink to this headline">¶</a></h2>
+<dl class="function">
+<dt id="windows.com.init">
+<code class="descclassname">windows.com.</code><code class="descname">init</code><span class="sig-paren">(</span><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/com.html#init"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.com.init" title="Permalink to this definition">¶</a></dt>
+<dd><p>Init COM with some default parameters</p>
+</dd></dl>
+
+<dl class="function">
+<dt id="windows.com.create_instance">
+<code class="descclassname">windows.com.</code><code class="descname">create_instance</code><span class="sig-paren">(</span><em>clsiid</em>, <em>targetinterface</em>, <em>custom_iid=None</em>, <em>context=5L</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/com.html#create_instance"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.com.create_instance" title="Permalink to this definition">¶</a></dt>
+<dd><p>A simple wrapper around <code class="docutils literal notranslate"><span class="pre">CoCreateInstance</span> <span class="pre">&lt;https://msdn.microsoft.com/en-us/library/windows/desktop/ms686615(v=vs.85).aspx&gt;</span></code></p>
+</dd></dl>
+
+<dl class="class">
+<dt id="windows.com.COMImplementation">
+<em class="property">class </em><code class="descclassname">windows.com.</code><code class="descname">COMImplementation</code><a class="reference internal" href="_modules/windows/com.html#COMImplementation"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.com.COMImplementation" title="Permalink to this definition">¶</a></dt>
+<dd><p>The base class to implements COM object respecting a given interface</p>
+<dl class="method">
+<dt id="windows.com.COMImplementation.AddRef">
+<code class="descname">AddRef</code><span class="sig-paren">(</span><em>*args</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/com.html#COMImplementation.AddRef"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.com.COMImplementation.AddRef" title="Permalink to this definition">¶</a></dt>
+<dd><p>Default <code class="docutils literal notranslate"><span class="pre">AddRef</span></code> implementation that returns <code class="docutils literal notranslate"><span class="pre">1</span></code></p>
+</dd></dl>
+
+<dl class="method">
+<dt id="windows.com.COMImplementation.QueryInterface">
+<code class="descname">QueryInterface</code><span class="sig-paren">(</span><em>this</em>, <em>piid</em>, <em>result</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/com.html#COMImplementation.QueryInterface"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.com.COMImplementation.QueryInterface" title="Permalink to this definition">¶</a></dt>
+<dd><p>Default <code class="docutils literal notranslate"><span class="pre">QueryInterface</span></code> implementation that returns <code class="docutils literal notranslate"><span class="pre">self</span></code> if piid is the implemented interface</p>
+</dd></dl>
+
+<dl class="method">
+<dt id="windows.com.COMImplementation.Release">
+<code class="descname">Release</code><span class="sig-paren">(</span><em>*args</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/com.html#COMImplementation.Release"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.com.COMImplementation.Release" title="Permalink to this definition">¶</a></dt>
+<dd><p>Default <code class="docutils literal notranslate"><span class="pre">Release</span></code> implementation that returns <code class="docutils literal notranslate"><span class="pre">1</span></code></p>
+</dd></dl>
+
+</dd></dl>
+
 </div>
 </div>

@@ -96,6 +139,7 @@ You can then use the instance to call whatever method you need.</p>
 <li><a class="reference internal" href="#">9. <code class="docutils literal notranslate"><span class="pre">windows.com</span></code> - Component Object Model</a><ul>
 <li><a class="reference internal" href="#using-a-com-interface">9.1. Using a COM interface</a></li>
 <li><a class="reference internal" href="#implementing-a-com-interface">9.2. Implementing a COM interface</a></li>
+<li><a class="reference internal" href="#api">9.3. API</a></li>
 </ul>
 </li>
 </ul>
@@ -17,7 +17,7 @@
    <link rel="index" title="Index" href="genindex.html" />
    <link rel="search" title="Search" href="search.html" />
    <link rel="next" title="13.1. Windef" href="windef_generated.html" />
-    <link rel="prev" title="12. windows.pipe – Inter-Process Communication" href="pipe.html" /> 
+    <link rel="prev" title="12. windows.rpc – ALPC-based Windows RPC" href="rpc.html" /> 
  </head><body>
    <div class="related" role="navigation" aria-label="related navigation">
      <h3>Navigation</h3>
@@ -32,7 +32,7 @@
          <a href="windef_generated.html" title="13.1. Windef"
             accesskey="N">next</a> |</li>
        <li class="right" >
-          <a href="pipe.html" title="12. windows.pipe – Inter-Process Communication"
+          <a href="rpc.html" title="12. windows.rpc – ALPC-based Windows RPC"
             accesskey="P">previous</a> |</li>
        <li class="nav-item nav-item-0"><a href="index.html">PythonForWindows 0.3 documentation</a> &#187;</li> 
      </ul>
@@ -131,8 +131,8 @@
 </ul>

  <h4>Previous topic</h4>
-  <p class="topless"><a href="pipe.html"
-                        title="previous chapter">12. <code class="docutils literal notranslate"><span class="pre">windows.pipe</span></code> – Inter-Process Communication</a></p>
+  <p class="topless"><a href="rpc.html"
+                        title="previous chapter">12. <code class="docutils literal notranslate"><span class="pre">windows.rpc</span></code> – ALPC-based Windows RPC</a></p>
  <h4>Next topic</h4>
  <p class="topless"><a href="windef_generated.html"
                        title="next chapter">13.1. Windef</a></p>
@@ -172,7 +172,7 @@
          <a href="windef_generated.html" title="13.1. Windef"
             >next</a> |</li>
        <li class="right" >
-          <a href="pipe.html" title="12. windows.pipe – Inter-Process Communication"
+          <a href="rpc.html" title="12. windows.rpc – ALPC-based Windows RPC"
             >previous</a> |</li>
        <li class="nav-item nav-item-0"><a href="index.html">PythonForWindows 0.3 documentation</a> &#187;</li> 
      </ul>
@@ -111,6 +111,7 @@ I am always glad to have feedbacks from people using this project.</p>
 <li class="toctree-l1"><a class="reference internal" href="com.html">9. <code class="docutils literal notranslate"><span class="pre">windows.com</span></code> - Component Object Model</a><ul>
 <li class="toctree-l2"><a class="reference internal" href="com.html#using-a-com-interface">9.1. Using a COM interface</a></li>
 <li class="toctree-l2"><a class="reference internal" href="com.html#implementing-a-com-interface">9.2. Implementing a COM interface</a></li>
+<li class="toctree-l2"><a class="reference internal" href="com.html#api">9.3. API</a></li>
 </ul>
 </li>
 <li class="toctree-l1"><a class="reference internal" href="crypto.html">10. <code class="docutils literal notranslate"><span class="pre">windows.crypto</span></code> – CryptoAPI</a><ul>
@@ -160,7 +161,7 @@ I am always glad to have feedbacks from people using this project.</p>
 <li class="toctree-l2"><a class="reference internal" href="sample.html#vectoredexception">17.6. <code class="docutils literal notranslate"><span class="pre">VectoredException()</span></code></a></li>
 <li class="toctree-l2"><a class="reference internal" href="sample.html#debugging">17.7. Debugging</a></li>
 <li class="toctree-l2"><a class="reference internal" href="sample.html#wmi-requests">17.8. WMI requests</a></li>
-<li class="toctree-l2"><a class="reference internal" href="sample.html#using-com-inetfwpolicy2">17.9. using COM: <code class="docutils literal notranslate"><span class="pre">INetFwPolicy2</span></code></a></li>
+<li class="toctree-l2"><a class="reference internal" href="sample.html#windows-com">17.9. <code class="docutils literal notranslate"><span class="pre">windows.com</span></code></a></li>
 <li class="toctree-l2"><a class="reference internal" href="sample.html#windows-crypto">17.10. <code class="docutils literal notranslate"><span class="pre">windows.crypto</span></code></a></li>
 <li class="toctree-l2"><a class="reference internal" href="sample.html#windows-alpc">17.11. <code class="docutils literal notranslate"><span class="pre">windows.alpc</span></code></a></li>
 <li class="toctree-l2"><a class="reference internal" href="sample.html#windows-rpc">17.12. <code class="docutils literal notranslate"><span class="pre">windows.rpc</span></code></a></li>
@@ -198,6 +198,14 @@
 <dt id="windows.winobject.process.CurrentProcess.load_library">
 <code class="descname">load_library</code><span class="sig-paren">(</span><em>dll_path</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/process.html#CurrentProcess.load_library"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.winobject.process.CurrentProcess.load_library" title="Permalink to this definition">¶</a></dt>
 <dd><p>Load the library in current process</p>
+<table class="docutils field-list" frame="void" rules="none">
+<col class="field-name" />
+<col class="field-body" />
+<tbody valign="top">
+<tr class="field-odd field"><th class="field-name">Return type:</th><td class="field-body"><a class="reference internal" href="#windows.winobject.process.LoadedModule" title="windows.winobject.process.LoadedModule"><code class="xref py py-class docutils literal notranslate"><span class="pre">LoadedModule</span></code></a></td>
+</tr>
+</tbody>
+</table>
 </dd></dl>

 <dl class="method">
@@ -428,6 +436,12 @@
 <dd><p>Write data at addr</p>
 </dd></dl>

+<dl class="method">
+<dt id="windows.winobject.process.CurrentProcess.write_ptr">
+<code class="descname">write_ptr</code><span class="sig-paren">(</span><em>addr</em>, <em>value</em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.CurrentProcess.write_ptr" title="Permalink to this definition">¶</a></dt>
+<dd><p>Write a <code class="docutils literal notranslate"><span class="pre">PTR</span></code> at <code class="docutils literal notranslate"><span class="pre">addr</span></code></p>
+</dd></dl>
+
 <dl class="method">
 <dt id="windows.winobject.process.CurrentProcess.write_qword">
 <code class="descname">write_qword</code><span class="sig-paren">(</span><em>addr</em>, <em>qword</em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.CurrentProcess.write_qword" title="Permalink to this definition">¶</a></dt>
@@ -448,7 +462,7 @@
 <dl class="class">
 <dt id="windows.winobject.process.CurrentThread">
 <em class="property">class </em><code class="descclassname">windows.winobject.process.</code><code class="descname">CurrentThread</code><a class="reference internal" href="_modules/windows/winobject/process.html#CurrentThread"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.winobject.process.CurrentThread" title="Permalink to this definition">¶</a></dt>
-<dd><p>Bases: <code class="xref py py-class docutils literal notranslate"><span class="pre">windows.winobject.process.AutoHandle</span></code></p>
+<dd><p>Bases: <code class="xref py py-class docutils literal notranslate"><span class="pre">windows.utils.pythonutils.AutoHandle</span></code></p>
 <p>The current thread</p>
 <dl class="method">
 <dt id="windows.winobject.process.CurrentThread.exit">
@@ -696,6 +710,14 @@ raises an exception if the remote thread raised one</p>
 <dt id="windows.winobject.process.WinProcess.load_library">
 <code class="descname">load_library</code><span class="sig-paren">(</span><em>dll_path</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/process.html#WinProcess.load_library"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.winobject.process.WinProcess.load_library" title="Permalink to this definition">¶</a></dt>
 <dd><p>Load the library in remote process</p>
+<table class="docutils field-list" frame="void" rules="none">
+<col class="field-name" />
+<col class="field-body" />
+<tbody valign="top">
+<tr class="field-odd field"><th class="field-name">Return type:</th><td class="field-body"><code class="xref py py-class docutils literal notranslate"><span class="pre">RemoteLoadedModule</span></code></td>
+</tr>
+</tbody>
+</table>
 </dd></dl>

 <dl class="method">
@@ -968,6 +990,12 @@ raises an exception if the remote thread raised one</p>
 <dd><p>Write <cite>data</cite> at <cite>addr</cite></p>
 </dd></dl>

+<dl class="method">
+<dt id="windows.winobject.process.WinProcess.write_ptr">
+<code class="descname">write_ptr</code><span class="sig-paren">(</span><em>addr</em>, <em>value</em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.WinProcess.write_ptr" title="Permalink to this definition">¶</a></dt>
+<dd><p>Write a <code class="docutils literal notranslate"><span class="pre">PTR</span></code> at <code class="docutils literal notranslate"><span class="pre">addr</span></code></p>
+</dd></dl>
+
 <dl class="method">
 <dt id="windows.winobject.process.WinProcess.write_qword">
 <code class="descname">write_qword</code><span class="sig-paren">(</span><em>addr</em>, <em>qword</em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.WinProcess.write_qword" title="Permalink to this definition">¶</a></dt>
@@ -988,7 +1016,7 @@ raises an exception if the remote thread raised one</p>
 <dl class="class">
 <dt id="windows.winobject.process.WinThread">
 <em class="property">class </em><code class="descclassname">windows.winobject.process.</code><code class="descname">WinThread</code><span class="sig-paren">(</span><em>tid=None</em>, <em>handle=None</em>, <em>owner_pid=None</em>, <em>owner=None</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/process.html#WinThread"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.winobject.process.WinThread" title="Permalink to this definition">¶</a></dt>
-<dd><p>Bases: <code class="xref py py-class docutils literal notranslate"><span class="pre">windows.winobject.process.AutoHandle</span></code></p>
+<dd><p>Bases: <code class="xref py py-class docutils literal notranslate"><span class="pre">windows.utils.pythonutils.AutoHandle</span></code></p>
 <p>Represent a thread</p>
 <dl class="attribute">
 <dt id="windows.winobject.process.WinThread.context">
@@ -1162,7 +1190,7 @@ raises an exception if the remote thread raised one</p>
 <dl class="class">
 <dt id="windows.winobject.process.DeadThread">
 <em class="property">class </em><code class="descclassname">windows.winobject.process.</code><code class="descname">DeadThread</code><span class="sig-paren">(</span><em>handle</em>, <em>tid=None</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/process.html#DeadThread"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.winobject.process.DeadThread" title="Permalink to this definition">¶</a></dt>
-<dd><p>Bases: <code class="xref py py-class docutils literal notranslate"><span class="pre">windows.winobject.process.AutoHandle</span></code></p>
+<dd><p>Bases: <code class="xref py py-class docutils literal notranslate"><span class="pre">windows.utils.pythonutils.AutoHandle</span></code></p>
 <p>An already dead thread (returned only by API returning a new thread if thread die before being returned)</p>
 <dl class="attribute">
 <dt id="windows.winobject.process.DeadThread.exit_code">
@@ -400,6 +400,9 @@ Sections: [&lt;PESection &quot;.text&quot;&gt;, &lt;PESection &quot;.rdata&quot;
 <span class="c1"># Setup our hook</span>
 <span class="n">RegOpenKeyExA_iat</span><span class="o">.</span><span class="n">set_hook</span><span class="p">(</span><span class="n">open_reg_hook</span><span class="p">)</span>

+<span class="c1">### !!!! You must keep the iat_entry alive !!!!</span>
+<span class="c1">### If the hook is garbage collected while active -&gt; python will crash</span>
+
 <span class="c1"># Use python native module _winreg that call &#39;RegOpenKeyExA&#39;</span>
 <span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Asking for &lt;MY_SECRET_KEY&gt;&quot;</span><span class="p">)</span>
 <span class="n">v</span> <span class="o">=</span> <span class="n">_winreg</span><span class="o">.</span><span class="n">OpenKey</span><span class="p">(</span><span class="mi">1234567</span><span class="p">,</span> <span class="s2">&quot;MY_SECRET_KEY&quot;</span><span class="p">)</span>
@@ -1658,8 +1661,10 @@ Done!
 </pre></div>
 </div>
 </div>
-<div class="section" id="using-com-inetfwpolicy2">
-<span id="sample-com-firewall"></span><h2>17.9. using COM: <code class="docutils literal notranslate"><span class="pre">INetFwPolicy2</span></code><a class="headerlink" href="#using-com-inetfwpolicy2" title="Permalink to this headline">¶</a></h2>
+<div class="section" id="windows-com">
+<span id="sample-com"></span><h2>17.9. <a class="reference internal" href="com.html#module-windows.com" title="windows.com"><code class="xref py py-mod docutils literal notranslate"><span class="pre">windows.com</span></code></a><a class="headerlink" href="#windows-com" title="Permalink to this headline">¶</a></h2>
+<div class="section" id="inetfwpolicy2">
+<span id="sample-com-firewall"></span><h3>17.9.1. <code class="docutils literal notranslate"><span class="pre">INetFwPolicy2</span></code><a class="headerlink" href="#inetfwpolicy2" title="Permalink to this headline">¶</a></h3>
 <div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="kn">import</span> <span class="nn">sys</span>
 <span class="kn">import</span> <span class="nn">os.path</span>
 <span class="kn">import</span> <span class="nn">pprint</span>
@@ -1713,6 +1718,107 @@ Done!
 </pre></div>
 </div>
 </div>
+<div class="section" id="icallinterceptor">
+<span id="sample-com-icallinterceptor"></span><h3>17.9.2. <code class="docutils literal notranslate"><span class="pre">ICallInterceptor</span></code><a class="headerlink" href="#icallinterceptor" title="Permalink to this headline">¶</a></h3>
+<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="kn">import</span> <span class="nn">windows</span>
+<span class="kn">import</span> <span class="nn">windows.generated_def</span> <span class="k">as</span> <span class="nn">gdef</span>
+<span class="kn">from</span> <span class="nn">windows</span> <span class="k">import</span> <span class="n">winproxy</span>
+
+<span class="c1"># POC of ICallInterceptor</span>
+<span class="c1"># Based on works by Pavel Yosifovich</span>
+<span class="c1"># http://blogs.microsoft.co.il/pavely/2018/02/28/intercepting-com-objects-with-cogetinterceptor/</span>
+
+<span class="n">windows</span><span class="o">.</span><span class="n">com</span><span class="o">.</span><span class="n">init</span><span class="p">()</span>
+
+<span class="c1"># Create an interceptor for the firewall (INetFwPolicy2)</span>
+<span class="n">interceptor</span> <span class="o">=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">ICallInterceptor</span><span class="p">()</span>
+<span class="n">winproxy</span><span class="o">.</span><span class="n">CoGetInterceptor</span><span class="p">(</span><span class="n">gdef</span><span class="o">.</span><span class="n">INetFwPolicy2</span><span class="o">.</span><span class="n">IID</span><span class="p">,</span> <span class="kc">None</span><span class="p">,</span> <span class="n">interceptor</span><span class="o">.</span><span class="n">IID</span><span class="p">,</span> <span class="n">interceptor</span><span class="p">)</span>
+
+<span class="c1"># The PythonForWindows firewall object is a real/valid INetFwPolicy2</span>
+<span class="c1"># used for demos of ICallFrameEvents.Invoke</span>
+<span class="n">real_firewall</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">system</span><span class="o">.</span><span class="n">network</span><span class="o">.</span><span class="n">firewall</span>
+
+<span class="c1"># Custom Python ICallFrameEvents implementation</span>
+<span class="k">class</span> <span class="nc">MySink</span><span class="p">(</span><span class="n">windows</span><span class="o">.</span><span class="n">com</span><span class="o">.</span><span class="n">COMImplementation</span><span class="p">):</span>
+    <span class="n">IMPLEMENT</span> <span class="o">=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">ICallFrameEvents</span>
+
+    <span class="k">def</span> <span class="nf">OnCall</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">this</span><span class="p">,</span> <span class="n">frame</span><span class="p">):</span>
+        <span class="n">ifname</span> <span class="o">=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">PWSTR</span><span class="p">()</span>
+        <span class="n">methodname</span> <span class="o">=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">PWSTR</span><span class="p">()</span>
+        <span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Hello from python sink !&quot;</span><span class="p">)</span>
+        <span class="n">frame</span><span class="o">.</span><span class="n">GetNames</span><span class="p">(</span><span class="n">ifname</span><span class="p">,</span> <span class="n">methodname</span><span class="p">)</span>
+        <span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Catching call to &lt;</span><span class="si">{0}</span><span class="s2">.</span><span class="si">{1}</span><span class="s2">&gt;&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">ifname</span><span class="o">.</span><span class="n">value</span><span class="p">,</span> <span class="n">methodname</span><span class="o">.</span><span class="n">value</span><span class="p">))</span>
+        <span class="n">param0info</span> <span class="o">=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">CALLFRAMEPARAMINFO</span><span class="p">()</span>
+        <span class="n">param0</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">com</span><span class="o">.</span><span class="n">ImprovedVariant</span><span class="p">()</span>
+        <span class="n">frame</span><span class="o">.</span><span class="n">GetParamInfo</span><span class="p">(</span><span class="mi">0</span><span class="p">,</span> <span class="n">param0info</span><span class="p">)</span>
+        <span class="n">frame</span><span class="o">.</span><span class="n">GetParam</span><span class="p">(</span><span class="mi">0</span><span class="p">,</span> <span class="n">param0</span><span class="p">)</span>
+        <span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Info about parameters 0:&quot;</span><span class="p">)</span>
+        <span class="n">windows</span><span class="o">.</span><span class="n">utils</span><span class="o">.</span><span class="n">sprint</span><span class="p">(</span><span class="n">param0info</span><span class="p">,</span> <span class="n">name</span><span class="o">=</span><span class="s2">&quot; * param0info&quot;</span><span class="p">)</span>
+        <span class="nb">print</span><span class="p">(</span><span class="s2">&quot;param0 value = </span><span class="si">{0}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">param0</span><span class="o">.</span><span class="n">aslong</span><span class="p">))</span>
+        <span class="n">frame</span><span class="o">.</span><span class="n">Invoke</span><span class="p">(</span><span class="n">real_firewall</span><span class="p">)</span>
+        <span class="n">frame</span><span class="o">.</span><span class="n">SetReturnValue</span><span class="p">(</span><span class="mi">1234</span><span class="p">)</span>
+        <span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Leaving the sink !&quot;</span><span class="p">)</span>
+        <span class="k">return</span> <span class="mi">0</span>
+
+<span class="c1"># Create and register our ICallFrameEvents sink</span>
+<span class="n">xsink</span> <span class="o">=</span> <span class="n">MySink</span><span class="p">()</span>
+<span class="n">interceptor</span><span class="o">.</span><span class="n">RegisterSink</span><span class="p">(</span><span class="n">xsink</span><span class="p">)</span>
+<span class="c1"># Create the INetFwPolicy2 interceptor interface</span>
+<span class="n">fakefirewall</span> <span class="o">=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">INetFwPolicy2</span><span class="p">()</span>
+<span class="n">interceptor</span><span class="o">.</span><span class="n">QueryInterface</span><span class="p">(</span><span class="n">fakefirewall</span><span class="o">.</span><span class="n">IID</span><span class="p">,</span> <span class="n">fakefirewall</span><span class="p">)</span>
+
+<span class="c1"># Calling one of the INetFwPolicy2 function for testing</span>
+<span class="c1"># Testing on https://msdn.microsoft.com/en-us/library/windows/desktop/aa365316(v=vs.85).aspx</span>
+<span class="n">enabled</span> <span class="o">=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">VARIANT_BOOL</span><span class="p">()</span>
+<span class="n">res</span> <span class="o">=</span> <span class="n">fakefirewall</span><span class="o">.</span><span class="n">get_FirewallEnabled</span><span class="p">(</span><span class="mi">2</span><span class="p">,</span> <span class="n">enabled</span><span class="p">)</span>
+<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;return value = </span><span class="si">{0}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">res</span><span class="p">))</span>
+<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;firewall enabled = </span><span class="si">{0}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">enabled</span><span class="p">))</span>
+
+<span class="c1"># Test a function taking a POINTER(ICallFrameEvents) (PTR to interface)</span>
+<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Testing a function taking a PTR to a COM interface&quot;</span><span class="p">)</span>
+<span class="n">sink2</span> <span class="o">=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">ICallFrameEvents</span><span class="p">()</span>
+<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Before call: </span><span class="si">{0}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">((</span><span class="n">sink2</span><span class="p">,</span> <span class="n">sink2</span><span class="o">.</span><span class="n">value</span><span class="p">)))</span>
+<span class="n">interceptor</span><span class="o">.</span><span class="n">GetRegisteredSink</span><span class="p">(</span><span class="n">sink2</span><span class="p">)</span>
+<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;After call: </span><span class="si">{0}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">((</span><span class="n">sink2</span><span class="p">,</span> <span class="n">sink2</span><span class="o">.</span><span class="n">value</span><span class="p">)))</span>
+
+
+<span class="c1"># (cmd) python samples\com\icallinterceptor.py</span>
+<span class="c1"># Hello from python sink !</span>
+<span class="c1"># Catching call to &lt;INetFwPolicy2.FirewallEnabled&gt;</span>
+<span class="c1"># Info about parameters 0:</span>
+<span class="c1">#  * param0info.fIn -&gt; 0x1</span>
+<span class="c1">#  * param0info.fOut -&gt; 0x0</span>
+<span class="c1">#  * param0info.stackOffset -&gt; 0x4L</span>
+<span class="c1">#  * param0info.cbParam -&gt; 0x4L</span>
+<span class="c1"># param0 value = 2</span>
+<span class="c1"># Leaving the sink !</span>
+<span class="c1"># return value = 1234</span>
+<span class="c1"># firewall enabled = VARIANT_BOOL(True)</span>
+<span class="c1"># Testing a function taking a PTR to a COM interface</span>
+<span class="c1"># Before call: (&lt;ICallFrameEvents object at 0x066EF3F0&gt;, None)</span>
+<span class="c1"># After call: (&lt;ICallFrameEvents object at 0x066EF3F0&gt;, 107934504)</span>
+</pre></div>
+</div>
+<p>Output</p>
+<div class="highlight-default notranslate"><div class="highlight"><pre><span></span>(cmd) python com\icallinterceptor.py
+Hello from python sink !
+Catching call to &lt;INetFwPolicy2.FirewallEnabled&gt;
+Info about parameters 0:
+ * param0info.fIn -&gt; 0x1
+ * param0info.fOut -&gt; 0x0
+ * param0info.stackOffset -&gt; 0x4L
+ * param0info.cbParam -&gt; 0x4L
+param0 value = 2
+Leaving the sink !
+return value = 1234
+firewall enabled = VARIANT_BOOL(True)
+Testing a function taking a PTR to a COM interface
+Before call: (&lt;ICallFrameEvents object at 0x066EF3F0&gt;, None)
+After call: (&lt;ICallFrameEvents object at 0x066EF3F0&gt;, 107934504)
+</pre></div>
+</div>
+</div>
+</div>
 <div class="section" id="windows-crypto">
 <h2>17.10. <a class="reference internal" href="crypto.html#module-windows.crypto" title="windows.crypto"><code class="xref py py-mod docutils literal notranslate"><span class="pre">windows.crypto</span></code></a><a class="headerlink" href="#windows-crypto" title="Permalink to this headline">¶</a></h2>
 <div class="section" id="encryption-demo">
@@ -2139,6 +2245,8 @@ BYE
                <span class="n">windows</span><span class="o">.</span><span class="n">utils</span><span class="o">.</span><span class="n">print_ctypes_struct</span><span class="p">(</span><span class="n">msg</span><span class="o">.</span><span class="n">view_attribute</span><span class="p">,</span> <span class="s2">&quot;       - VIEW&quot;</span><span class="p">,</span> <span class="n">hexa</span><span class="o">=</span><span class="kc">True</span><span class="p">)</span>
                <span class="n">view_data</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">read_string</span><span class="p">(</span><span class="n">msg</span><span class="o">.</span><span class="n">view_attribute</span><span class="o">.</span><span class="n">ViewBase</span><span class="p">)</span>
                <span class="nb">print</span><span class="p">(</span><span class="s2">&quot;   * Reading view content: &lt;</span><span class="si">{0}</span><span class="s2">&gt;&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">view_data</span><span class="p">))</span>
+                <span class="c1"># Needed in Win7 - TODO: why is there a different behavior ?</span>
+                <span class="n">msg</span><span class="o">.</span><span class="n">attributes</span><span class="o">.</span><span class="n">ValidAttributes</span> <span class="o">-=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">ALPC_MESSAGE_VIEW_ATTRIBUTE</span>
            <span class="nb">print</span><span class="p">(</span><span class="s2">&quot; * security_is_valid &lt;</span><span class="si">{0}</span><span class="s2">&gt;&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">msg</span><span class="o">.</span><span class="n">security_is_valid</span><span class="p">))</span>
            <span class="nb">print</span><span class="p">(</span><span class="s2">&quot; * handle_is_valid &lt;</span><span class="si">{0}</span><span class="s2">&gt;&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">msg</span><span class="o">.</span><span class="n">handle_is_valid</span><span class="p">))</span>
            <span class="k">if</span> <span class="n">msg</span><span class="o">.</span><span class="n">handle_is_valid</span><span class="p">:</span>
@@ -2676,7 +2784,11 @@ BYE
 </ul>
 </li>
 <li><a class="reference internal" href="#wmi-requests">17.8. WMI requests</a></li>
-<li><a class="reference internal" href="#using-com-inetfwpolicy2">17.9. using COM: <code class="docutils literal notranslate"><span class="pre">INetFwPolicy2</span></code></a></li>
+<li><a class="reference internal" href="#windows-com">17.9. <code class="docutils literal notranslate"><span class="pre">windows.com</span></code></a><ul>
+<li><a class="reference internal" href="#inetfwpolicy2">17.9.1. <code class="docutils literal notranslate"><span class="pre">INetFwPolicy2</span></code></a></li>
+<li><a class="reference internal" href="#icallinterceptor">17.9.2. <code class="docutils literal notranslate"><span class="pre">ICallInterceptor</span></code></a></li>
+</ul>
+</li>
 <li><a class="reference internal" href="#windows-crypto">17.10. <code class="docutils literal notranslate"><span class="pre">windows.crypto</span></code></a><ul>
 <li><a class="reference internal" href="#encryption-demo">17.10.1. Encryption demo</a></li>
 <li><a class="reference internal" href="#certificate-demo">17.10.2. Certificate demo</a></li>
@@ -16,7 +16,7 @@
    <script type="text/javascript" src="_static/doctools.js"></script>
    <link rel="index" title="Index" href="genindex.html" />
    <link rel="search" title="Search" href="search.html" />
-    <link rel="next" title="5. windows.utils – Windows Utilities" href="utils.html" />
+    <link rel="next" title="5. windows.pipe – Inter-Process Communication" href="pipe.html" />
    <link rel="prev" title="3. windows.native_exec – Native Code Execution" href="native_exec.html" /> 
  </head><body>
    <div class="related" role="navigation" aria-label="related navigation">
@@ -29,7 +29,7 @@
          <a href="py-modindex.html" title="Python Module Index"
             >modules</a> |</li>
        <li class="right" >
-          <a href="utils.html" title="5. windows.utils – Windows Utilities"
+          <a href="pipe.html" title="5. windows.pipe – Inter-Process Communication"
             accesskey="N">next</a> |</li>
        <li class="right" >
          <a href="native_exec.html" title="3. windows.native_exec – Native Code Execution"
@@ -1676,8 +1676,8 @@ It also heavily relies on <a class="reference external" href="https://docs.pytho
  <p class="topless"><a href="native_exec.html"
                        title="previous chapter">3. <code class="docutils literal notranslate"><span class="pre">windows.native_exec</span></code> – Native Code Execution</a></p>
  <h4>Next topic</h4>
-  <p class="topless"><a href="utils.html"
-                        title="next chapter">5. <code class="docutils literal notranslate"><span class="pre">windows.utils</span></code> – Windows Utilities</a></p>
+  <p class="topless"><a href="pipe.html"
+                        title="next chapter">5. <code class="docutils literal notranslate"><span class="pre">windows.pipe</span></code> – Inter-Process Communication</a></p>
  <div role="note" aria-label="source link">
    <h3>This Page</h3>
    <ul class="this-page-menu">
@@ -1711,7 +1711,7 @@ It also heavily relies on <a class="reference external" href="https://docs.pytho
          <a href="py-modindex.html" title="Python Module Index"
             >modules</a> |</li>
        <li class="right" >
-          <a href="utils.html" title="5. windows.utils – Windows Utilities"
+          <a href="pipe.html" title="5. windows.pipe – Inter-Process Communication"
             >next</a> |</li>
        <li class="right" >
          <a href="native_exec.html" title="3. windows.native_exec – Native Code Execution"
@@ -31,7 +31,7 @@ You can then use the instance to call whatever method you need.

 .. note::

-    see sample :ref:`sample_com_firewall`
+    see samples :ref:`sample_com`

 Implementing a COM interface
 ''''''''''''''''''''''''''''
@@ -41,4 +41,15 @@ To create `COM` object you need to:
    1. Create your ``COMImplementation`` with an ``IMPLEMENT`` attribute  that should be a cominterface `CODE 1 <https://github.com/sogeti-esec-lab/LKD/blob/efabf3cc38b94d4180ebe8d2c554da5d76b2fea1/lkd/dbginterface/base.py#L48>`_
    2. Implements the methods of the interface `CODE 2 <https://github.com/sogeti-esec-lab/LKD/blob/efabf3cc38b94d4180ebe8d2c554da5d76b2fea1/lkd/dbginterface/base.py#L55>`_
    3. Create an instance `CODE3 <https://github.com/sogeti-esec-lab/LKD/blob/efabf3cc38b94d4180ebe8d2c554da5d76b2fea1/lkd/dbginterface/base.py#L59>`_
-    4. Pass it to whatever native function expects it `CODE4 <https://github.com/sogeti-esec-lab/LKD/blob/efabf3cc38b94d4180ebe8d2c554da5d76b2fea1/lkd/dbginterface/base.py#L272>`_
+    4. Pass it to whatever native function expects it `CODE4 <https://github.com/sogeti-esec-lab/LKD/blob/efabf3cc38b94d4180ebe8d2c554da5d76b2fea1/lkd/dbginterface/base.py#L272>`_
+
+.. note::
+
+    see samples :ref:`sample_com_icallinterceptor`
+
+API
+'''
+
+.. autofunction:: init
+.. autofunction:: create_instance
+.. autoclass:: COMImplementation
@@ -287,10 +287,15 @@ Output
 .. literalinclude:: samples_output\wmi_wmi_request.txt


+.. _sample_com:
+
+:mod:`windows.com`
+""""""""""""""""""
+
 .. _sample_com_firewall:

-using COM: ``INetFwPolicy2``
-""""""""""""""""""""""""""""
+``INetFwPolicy2``
+'''''''''''''''''

 .. literalinclude:: ..\..\samples\com\com_inetfwpolicy2.py

@@ -299,6 +304,18 @@ Output
 .. literalinclude:: samples_output\com_com_inetfwpolicy2.txt


+.. _sample_com_icallinterceptor:
+
+``ICallInterceptor``
+''''''''''''''''''''
+
+.. literalinclude:: ..\..\samples\com\icallinterceptor.py
+
+Output
+
+.. literalinclude:: samples_output\com_icallinterceptor.txt
+
+

 :mod:`windows.crypto`
 """""""""""""""""""""
@@ -0,0 +1,15 @@
+(cmd) python com\icallinterceptor.py
+Hello from python sink !
+Catching call to <INetFwPolicy2.FirewallEnabled>
+Info about parameters 0:
+ * param0info.fIn -> 0x1
+ * param0info.fOut -> 0x0
+ * param0info.stackOffset -> 0x4L
+ * param0info.cbParam -> 0x4L
+param0 value = 2
+Leaving the sink !
+return value = 1234
+firewall enabled = VARIANT_BOOL(True)
+Testing a function taking a PTR to a COM interface
+Before call: (<ICallFrameEvents object at 0x066EF3F0>, None)
+After call: (<ICallFrameEvents object at 0x066EF3F0>, 107934504)
@@ -53,10 +53,11 @@ print("return value = {0}".format(res))
 print("firewall enabled = {0}".format(enabled))

 # Test a function taking a POINTER(ICallFrameEvents) (PTR to interface)
+print("Testing a function taking a PTR to a COM interface")
 sink2 = gdef.ICallFrameEvents()
+print("Before call: {0}".format((sink2, sink2.value)))
 interceptor.GetRegisteredSink(sink2)
-print(sink2, sink2.value)
-
+print("After call: {0}".format((sink2, sink2.value)))


 # (cmd) python samples\com\icallinterceptor.py
@@ -70,4 +71,7 @@ print(sink2, sink2.value)
 # param0 value = 2
 # Leaving the sink !
 # return value = 1234
-# firewall enabled = VARIANT_BOOL(True)
+# firewall enabled = VARIANT_BOOL(True)
+# Testing a function taking a PTR to a COM interface
+# Before call: (<ICallFrameEvents object at 0x066EF3F0>, None)
+# After call: (<ICallFrameEvents object at 0x066EF3F0>, 107934504)
@@ -16,6 +16,7 @@ from windows.generated_def.interfaces import generate_IID, IID
 # "-".join("{:02X}".format(c) for c in struct.unpack("<IHHHBBBBBB", x))

 def init():
+    """Init COM with some default parameters"""
    try:
        t = winproxy.CoInitializeEx()
    except WindowsError as e:
@@ -29,6 +30,7 @@ def initsecurity(): # Should take some parameters..


 def create_instance(clsiid, targetinterface, custom_iid=None, context=CLSCTX_INPROC_SERVER | CLSCTX_LOCAL_SERVER):
+    """A simple wrapper around ``CoCreateInstance <https://msdn.microsoft.com/en-us/library/windows/desktop/ms686615(v=vs.85).aspx>``"""
    if custom_iid is None:
        custom_iid = targetinterface.IID
    return winproxy.CoCreateInstance(byref(clsiid), None, context, byref(custom_iid), byref(targetinterface))
@@ -190,6 +192,7 @@ ImprovedVariant.MAPPER = {


 class COMImplementation(object):
+    """The base class to implements COM object respecting a given interface"""
    IMPLEMENT = None

    def get_index_of_method(self, method):
@@ -236,13 +239,16 @@ class COMImplementation(object):
        self._as_parameter_ = ctypes.addressof(self.vtable_pointer)

    def QueryInterface(self, this, piid, result):
+        """Default ``QueryInterface`` implementation that returns ``self`` if piid is the implemented interface"""
        if piid[0] in (IUnknown.IID, self.IMPLEMENT.IID):
            result[0] = this
            return 1
        return E_NOINTERFACE

    def AddRef(self, *args):
+        """Default ``AddRef`` implementation that returns ``1``"""
        return 1

    def Release(self, *args):
+        """Default ``Release`` implementation that returns ``1``"""
        return 0