updated doc

samples/pipe/child_send_object.py

@@ -18,19 +18,14 @@ windows.pipe.send_object("{pipe}", addr)
 """
 
 with windows.pipe.create(PIPE_NAME) as np:
-    print(np)
+    print("Created pipe is {0}".format(np))
     p.execute_python(rcode.format(pipe=PIPE_NAME))
+    print("Receiving object from injected process")
     addr = np.recv()
 
 print("Remote Address = {0:#x}".format(addr))
-print(p.query_memory(addr))
-print(p.get_mapped_filename(addr))
-p.exit()
-
-
-# python samples\pipe\child_send_object.py
-# Child is <WinProcess "notepad.exe" pid 16724 at 0x63455d0>
-# <PipeConnection name="\\.\pipe\PFW_Pipe" server=True>
-# Remote Address = 0x6fa0000
-# <MEMORY_BASIC_INFORMATION32 BaseAddress=0x6fa0000 RegionSize=0x001000 State=MEM_COMMIT(0x1000L) Type=MEM_MAPPED(0x40000L) Protect=PAGE_READWRITE(0x4L)>
-# \Device\HarddiskVolume2\Users\hakril\Documents\projets\PythonForWindows\tst.txt
+print("Querying memory in target at <{0:#x}>".format(addr))
+print("    * {0}".format(p.query_memory(addr)))
+print("Querying mapped file in target at <{0:#x}>".format(addr))
+print("    * {0}".format(p.get_mapped_filename(addr)))
+p.exit()

samples/process/apisetmap.py

@@ -0,0 +1,27 @@
+import windows
+
+print("Computer is a <{0}>".format(windows.system.version_name))
+
+cp = windows.current_process
+apism = cp.peb.apisetmap
+
+print("ApiSetMap: {0} (version = {1})".format(apism, apism.version))
+
+dll_demos_fullname = 'api-ms-win-core-processthreads-l1-1-3'
+dll_demos_utilname = 'api-ms-win-core-processthreads-l1-1-'
+
+print("Entries in 'apisetmap_dict' are the full api-dll path extracted")
+print(" * apisetmap.apisetmap_dict['{0}'] -> {1}".format(dll_demos_fullname, apism.apisetmap_dict[dll_demos_fullname]))
+print("Entries in 'resolution_dict' are the contains the util-part check by windows")
+print(" * apisetmap.resolution_dict['{0}'] -> {1}".format(dll_demos_utilname, apism.resolution_dict[dll_demos_utilname]))
+
+print("ApiSetMap.resolve resolve a api-dll based on the util part")
+for suffix in ["1", "2", "PART_IS_IGNORED"]:
+    testname = dll_demos_utilname + suffix
+    print(" * apisetmap.resolve('{0}') -> {1}".format(testname, apism.resolve(testname)))
+
+testname = "BAD_DLL-3.dll"
+try:
+    print(" * apisetmap.resolve('{0}') -> {1}".format(testname, apism.resolve(testname)))
+except KeyError as e:
+    print(" * apisetmap.resolve('{0}') -> raised: {1!r}".format(testname, e))

samples/wmi/wmi_request.py

@@ -6,12 +6,10 @@ sys.path.append(os.path.abspath(__file__ + "\..\.."))
 import windows
 
 print("WMI requester is {0}".format(windows.system.wmi))
-
 print("Selecting * from 'Win32_Process'")
 result = windows.system.wmi.select("Win32_Process")
 
 print("They are <{0}> processes".format(len(result)))
-
 print("Looking for ourself via pid")
 us = [p for p in result if int(p["ProcessId"]) == windows.current_process.pid][0]
 
@@ -27,5 +25,20 @@ print("<Select Caption,FileSystem,FreeSpace from Win32_LogicalDisk>:")
 for vol in windows.system.wmi.select("Win32_LogicalDisk", ["Caption", "FileSystem", "FreeSpace"]):
     print("    * " + str(vol))
 
+print("\n ==== Advanced use ====")
+print("Listing some namespaces:")
+for namespace in [ns for ns in windows.system.wmi.namespaces if "2" in ns]:
+    print("    * {0}".format(namespace))
+
+security2 = windows.system.wmi["root\\SecurityCenter2"]
+print("Querying non-default namespace: {0}".format(security2))
+print("Listing some available classes:")
+for clsname in [x for x in security2.classes if x.endswith("Product")]:
+    print("    * {0}".format(clsname))
+
+print("Listing <AntiVirusProduct>:")
+for av in security2.select("AntiVirusProduct"):
+    print("    * {0}".format(av["displayName"]))
+