more doc

windows/debug.py

@@ -426,7 +426,10 @@ class Debugger(object):
 
     # Public callback
     def on_exception(self, exception):
-        """Called on exception event other that known breakpoint
+        """Called on exception event other that known breakpoint. ``exception`` is one of the following type:
+
+                * :class:`windows.winobject.exception.EEXCEPTION_DEBUG_INFO32`
+                * :class:`windows.winobject.exception.EEXCEPTION_DEBUG_INFO64`
 
            The default behaviour is to return ``DBG_CONTINUE`` for the known exception code
            and ``DBG_EXCEPTION_NOT_HANDLED`` else
@@ -436,35 +439,35 @@ class Debugger(object):
         return DBG_CONTINUE
 
     def on_create_process(self, create_process):
-        """Called on create_process event"""
+        """Called on create_process event (see https://msdn.microsoft.com/en-us/library/windows/desktop/ms679286(v=vs.85).aspx)"""
         pass
 
     def on_exit_process(self, exit_process):
-        """Called on exit_process event"""
+        """Called on exit_process event (see https://msdn.microsoft.com/en-us/library/windows/desktop/ms679334(v=vs.85).aspx)"""
         pass
 
     def on_create_thread(self, create_thread):
-        """Called on create_thread event"""
+        """Called on create_thread event (see https://msdn.microsoft.com/en-us/library/windows/desktop/ms679287(v=vs.85).aspx)"""
         pass
 
     def on_exit_thread(self, exit_thread):
-        """Called on exit_thread event"""
+        """Called on exit_thread event (see https://msdn.microsoft.com/en-us/library/windows/desktop/ms679335(v=vs.85).aspx)"""
         pass
 
     def on_load_dll(self, load_dll):
-        """Called on load_dll event"""
+        """Called on load_dll event (see https://msdn.microsoft.com/en-us/library/windows/desktop/ms680351(v=vs.85).aspx)"""
         pass
 
     def on_unload_dll(self, unload_dll):
-        """Called on unload_dll event"""
+        """Called on unload_dll event (see https://msdn.microsoft.com/en-us/library/windows/desktop/ms681403(v=vs.85).aspx)"""
         pass
 
     def on_output_debug_string(self, debug_string):
-        """Called on debug_string event"""
+        """Called on debug_string event (see https://msdn.microsoft.com/en-us/library/windows/desktop/ms680545(v=vs.85).aspx)"""
         pass
 
     def on_rip(self, rip_info):
-        """Called on rip_info event"""
+        """Called on rip_info event (see https://msdn.microsoft.com/en-us/library/windows/desktop/ms680587(v=vs.85).aspx)"""
         pass
 
 def debug(path, args=None, dwCreationFlags=0, show_windows=False):

windows/winobject/exception.py

@@ -145,6 +145,11 @@ class EEflags(ctypes.Structure):
         return "{0}({1}:{2})".format(type(self).__name__, hex(self.raw), self.dump())
 
     raw = property(get_raw, set_raw)
+    """Raw value of the eflags
+
+       :type: :class:`int`
+    """
+
 
 class EDr7(ctypes.Structure):
     "Flag view of the DR7 register"
@@ -180,7 +185,11 @@ class ECONTEXTBase(object):
     pc_reg = ''
     special_reg_type = {}
 
+
     def regs(self, to_dump=None):
+        """Return the name and values of the registers
+
+        :returns: [(reg_name, value)] -- A :class:`list` of :class:`tuple`"""
         res = []
         if to_dump is None:
             to_dump = self.default_dump
@@ -208,7 +217,7 @@ class ECONTEXTBase(object):
 
     @property
     def EEFlags(self):
-        """Enhanced view of the Eflags
+        """Enhanced view of the Eflags (you also have ``EFlags`` for the raw value)
 
             :type: :class:`EEflags`
         """
@@ -219,7 +228,7 @@ class ECONTEXTBase(object):
 
     @property
     def EDr7(self):
-        """Enhanced view of the DR7 register
+        """Enhanced view of the DR7 register (you also have ``Dr7`` for the raw value)
 
             :type: :class:`EDr7`
         """
@@ -286,7 +295,7 @@ class EEXCEPTION_POINTERS(ctypes.Structure):
     ]
 
     def dump(self):
-        """Dump the EEXCEPTION_POINTERS"""
+        """Dump (print) the EEXCEPTION_POINTERS"""
         record = self.ExceptionRecord[0]
         print("Dumping Exception: ")
         print("    ExceptionCode = {0} at {1}".format(record.ExceptionCode, hex(record.ExceptionAddress)))

windows/winobject/process.py

@@ -24,6 +24,10 @@ from windows.generated_def import windef
 
 from windows.winobject import exception
 
+
+TimeInfo = namedtuple("TimeInfo", ["creation", "exit", "kernel", "user"])
+"""Time information about a process"""
+
 class AutoHandle(object):
     """An abstract class that allow easy handle creation/destruction/wait"""
      # Big bypass to prevent missing reference at programm close..
@@ -210,7 +214,7 @@ class WinThread(THREADENTRY32, AutoHandle):
             return DeadThread(handle, tid)
 
 class DeadThread(AutoHandle):
-    """An already dead thread"""
+    """An already dead thread (returned only by API returning a new thread if thread die before being returned)"""
     def __init__(self, handle, tid=None):
         if tid is None:
             tid = winproxy.GetThreadId(handle)
@@ -304,6 +308,7 @@ class Process(AutoHandle):
 
     @contextmanager
     def virtual_protected(self, addr, size, protect):
+        """A context manager for local virtual_protect (old Protection are restored at exit)"""
         old_protect = DWORD()
         self.low_virtual_protect(addr, size, protect, old_protect)
         try:
@@ -521,10 +526,11 @@ class Process(AutoHandle):
         """write a qword at ``addr``"""
         return self.write_memory(addr, struct.pack("<Q", qword))
 
-    TimeInfo = namedtuple("TimeInfo", ["creation", "exit", "kernel", "user"])
-
     @property
     def time_info(self):
+        """The time information of the process (creation, kernel/user time, exit time
+
+        :type: :class:`TimeInfo"""
         CreationTime = FILETIME()
         ExitTime = FILETIME()
         KernelTime = FILETIME()
@@ -536,7 +542,7 @@ class Process(AutoHandle):
         kernel = (KernelTime.dwHighDateTime << 32) + KernelTime.dwLowDateTime
         user = (UserTime.dwHighDateTime << 32) + UserTime.dwLowDateTime
 
-        return self.TimeInfo(creation, exit, kernel, user)
+        return TimeInfo(creation, exit, kernel, user)
 
     @utils.fixedpropety
     def token(self):

windows/winobject/service.py

@@ -23,7 +23,7 @@ ServiceStatus = namedtuple("ServiceStatus", ["type", "state", "control_accepted"
     * ``SERVICE_WIN32_SHARE_PROCESS(0x20L)``
     * ``SERVICE_INTERACTIVE_PROCESS(0x100L)``
 
-``state`` might be on of:
+``state`` might be one of:
 
     * ``SERVICE_STOPPED(0x1L)``
     * ``SERVICE_START_PENDING(0x2L)``

windows/wintrust.py

@@ -81,7 +81,7 @@ wintrust_return_value_mapper = {x:x for x in wintrust_know_return_value}
 def check_signature(filename):
     """Check if ``filename`` embeds a valid signature.
 
-        :return: ``0`` if ``filename`` have a valid signature else the error
+        :return: :class:`int`: ``0`` if ``filename`` have a valid signature else the error
     """
     file_data = WINTRUST_FILE_INFO()
     file_data.cbStruct = ctypes.sizeof(WINTRUST_FILE_INFO)