Improve object manager doc + add samples

docs/source/object_manager.rst

@@ -6,7 +6,15 @@ Object Manager -- Kernel objects
 The :class:`ObjectManager` instance is accessible via :py:attr:`windows.system.object_manager
 <windows.winobject.system.System.object_manager>`
 
-TODO: doc + sample
+
+.. note::
+
+    See sample at :ref:`sample_object_manager`
+
+
+.. warning::
+
+    This API have not been tested on real case yet and may be subject to changes.
 
 ObjectManager
 """""""""""""
@@ -24,4 +32,4 @@ KernelObject
 .. autoclass:: KernelObject
     :members:
     :undoc-members:
-    :special-members: __getitem__
+    :special-members: __getitem__, __iter__

docs/source/samples_output/object_manager_findobj.txt

@@ -0,0 +1,23 @@
+(cmd) python object_manager\findobj.py
+Looking for object name containing <ls>
+* <KernelObject "\KnownDlls32" (type="Directory")>
+* <KernelObject "\Win32kCrossSessionGlobals" (type="Section")>
+* <KernelObject "\KnownDlls" (type="Directory")>
+<\DriverStores\SYSTEM> -> STATUS_ACCESS_DENIED
+* <KernelObject "\Device\MailslotRedirector" (type="SymbolicLink")> -> <\Device\Mup\;MailslotRedirector>
+* <KernelObject "\Device\Mailslot" (type="Device")>
+<\Device\00000020> -> STATUS_ACCESS_DENIED
+<\Device\00000020> -> STATUS_ACCESS_DENIED
+<\Device\00000020> -> STATUS_ACCESS_DENIED
+<\Device\00000020> -> STATUS_ACCESS_DENIED
+<\Device\00000020> -> STATUS_ACCESS_DENIED
+<\KernelObjects\PrefetchTracesReady> -> STATUS_ACCESS_DENIED
+<\KnownDlls\powrprof.dll> -> STATUS_ACCESS_DENIED
+* <KernelObject "\RPC Control\lsapolicylookup" (type="ALPC Port")>
+* <KernelObject "\RPC Control\lsacap" (type="ALPC Port")>
+* <KernelObject "\RPC Control\lsasspirpc" (type="ALPC Port")>
+<\Windows\SbApiPort> -> STATUS_ACCESS_DENIED
+<\Windows\SbApiPort> -> STATUS_ACCESS_DENIED
+<\Sessions\BNOLINKS\1> -> STATUS_ACCESS_DENIED
+<\Sessions\BNOLINKS\1> -> STATUS_ACCESS_DENIED
+<\Sessions\BNOLINKS\1> -> STATUS_ACCESS_DENIED

docs/source/samples_output/object_manager_object_manager.txt

@@ -0,0 +1,22 @@
+(cmd) python object_manager\object_manager.py
+Object manager is <windows.winobject.object_manager.ObjectManager object at 0x0370ED10>
+Root object is <KernelObject "\" (type="Directory")>
+
+Listing some of root-subobject:
+  * PendingRenameMutex: <KernelObject "\PendingRenameMutex" (type="Mutant")>
+  * ObjectTypes: <KernelObject "\ObjectTypes" (type="Directory")>
+  * storqosfltport: <KernelObject "\storqosfltport" (type="FilterConnectionPort")>
+  * MicrosoftMalwareProtectionRemoteIoPortWD: <KernelObject "\MicrosoftMalwareProtectionRemoteIoPortWD" (type="FilterConnectionPort")>
+
+Retrieving <\Rpc Control\lsasspirpc>:
+Object is: <KernelObject "\Rpc Control\lsasspirpc" (type="ALPC Port")>
+   * name: <lsasspirpc>
+   * path: <\Rpc Control>
+   * fullname: <\Rpc Control\lsasspirpc>
+   * type: <ALPC Port>
+   * target: <None>
+
+Looking for a SymbolicLink in <ArcName>
+Object is: <KernelObject "\ArcName\multi(0)disk(0)rdisk(0)" (type="SymbolicLink")>
+   * name: <multi(0)disk(0)rdisk(0)>
+   * target: <\Device\Harddisk0\Partition0>