admin/hakril-PythonForWindows
1
0
Fork 0
mirror of https://github.com/hakril/PythonForWindows synced 2026-06-08 14:31:45 +00:00
Code Issues Packages Projects Releases Wiki Activity

Improve object manager doc + add samples

Browse Source
This commit is contained in:
hakril
2018-07-13 14:24:55 +02:00
parent eb3b13016f
commit c19241098a
7 changed files with 224 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/source/object_manager.rst
+10 -2
View File
@@ -6,7 +6,15 @@ Object Manager -- Kernel objects
The :class:`ObjectManager` instance is accessible via :py:attr:`windows.system.object_manager
<windows.winobject.system.System.object_manager>`
TODO: doc + sample
.. note::
See sample at :ref:`sample_object_manager`
.. warning::
This API have not been tested on real case yet and may be subject to changes.
ObjectManager
"""""""""""""
@@ -24,4 +32,4 @@ KernelObject
.. autoclass:: KernelObject
:members:
:undoc-members:
:special-members: __getitem__
:special-members: __getitem__, __iter__
docs/source/samples_output/object_manager_findobj.txt
+23
View File
@@ -0,0 +1,23 @@
(cmd) python object_manager\findobj.py
Looking for object name containing <ls>
* <KernelObject "\KnownDlls32" (type="Directory")>
* <KernelObject "\Win32kCrossSessionGlobals" (type="Section")>
* <KernelObject "\KnownDlls" (type="Directory")>
<\DriverStores\SYSTEM> -> STATUS_ACCESS_DENIED
* <KernelObject "\Device\MailslotRedirector" (type="SymbolicLink")> -> <\Device\Mup\;MailslotRedirector>
* <KernelObject "\Device\Mailslot" (type="Device")>
<\Device\00000020> -> STATUS_ACCESS_DENIED
<\Device\00000020> -> STATUS_ACCESS_DENIED
<\Device\00000020> -> STATUS_ACCESS_DENIED
<\Device\00000020> -> STATUS_ACCESS_DENIED
<\Device\00000020> -> STATUS_ACCESS_DENIED
<\KernelObjects\PrefetchTracesReady> -> STATUS_ACCESS_DENIED
<\KnownDlls\powrprof.dll> -> STATUS_ACCESS_DENIED
* <KernelObject "\RPC Control\lsapolicylookup" (type="ALPC Port")>
* <KernelObject "\RPC Control\lsacap" (type="ALPC Port")>
* <KernelObject "\RPC Control\lsasspirpc" (type="ALPC Port")>
<\Windows\SbApiPort> -> STATUS_ACCESS_DENIED
<\Windows\SbApiPort> -> STATUS_ACCESS_DENIED
<\Sessions\BNOLINKS\1> -> STATUS_ACCESS_DENIED
<\Sessions\BNOLINKS\1> -> STATUS_ACCESS_DENIED
<\Sessions\BNOLINKS\1> -> STATUS_ACCESS_DENIED
docs/source/samples_output/object_manager_object_manager.txt
+22
View File
@@ -0,0 +1,22 @@
(cmd) python object_manager\object_manager.py
Object manager is <windows.winobject.object_manager.ObjectManager object at 0x0370ED10>
Root object is <KernelObject "\" (type="Directory")>
Listing some of root-subobject:
* PendingRenameMutex: <KernelObject "\PendingRenameMutex" (type="Mutant")>
* ObjectTypes: <KernelObject "\ObjectTypes" (type="Directory")>
* storqosfltport: <KernelObject "\storqosfltport" (type="FilterConnectionPort")>
* MicrosoftMalwareProtectionRemoteIoPortWD: <KernelObject "\MicrosoftMalwareProtectionRemoteIoPortWD" (type="FilterConnectionPort")>
Retrieving <\Rpc Control\lsasspirpc>:
Object is: <KernelObject "\Rpc Control\lsasspirpc" (type="ALPC Port")>
* name: <lsasspirpc>
* path: <\Rpc Control>
* fullname: <\Rpc Control\lsasspirpc>
* type: <ALPC Port>
* target: <None>
Looking for a SymbolicLink in <ArcName>
Object is: <KernelObject "\ArcName\multi(0)disk(0)rdisk(0)" (type="SymbolicLink")>
* name: <multi(0)disk(0)rdisk(0)>
* target: <\Device\Harddisk0\Partition0>