d7d2dacf33
Fixed thread.teb_base + add thread.teb_syswow_base for TEB64 of Syswow process
2022-08-05 11:30:45 +02:00
63dd0130f1
POC of windows.system.domain
2022-05-27 15:34:27 +02:00
5fa4ca6aae
Fixed bug introduced in token.privileges in ad592980 + associated tests
2022-05-09 17:24:55 +02:00
ad59298015
Token privilege code use W() API + use of GetNamedSecurityInfoW in security.py (fix issue #40 )
2022-05-07 11:35:36 +02:00
d23a9813e9
Prevent Token.__repr__ to raise on access denied
2022-04-01 14:10:41 +02:00
447069df32
Process listing now use Wide API (process name is still temporary a ascii string with backslashreplace)
2022-02-07 17:10:54 +01:00
61e027a678
Allow custom timeout to eventlog query
2021-12-30 13:39:38 +01:00
f9df80ca20
Improved handling of closing python in BaseSystemHandle.__del__
2021-11-03 09:27:13 +01:00
8b90c96c1a
utils.create_process now use CreateProcessW for simpler py3 usage + fix code in WinProcess.read_[w]string + associated tests
2021-07-13 13:22:50 +02:00
42fac92940
Added some setter in task-scheduled definition
2021-06-25 17:32:14 +02:00
fb9ff96a11
Fixed current_process.read_string/wstring for page end + tests
2021-06-22 19:03:35 +02:00
6fe784030f
Added some ETW define + Trace.start() now take a mode param
2021-06-18 17:21:36 +02:00
83b02310e4
Added some doc in eventlog xpath usage
2021-04-28 13:54:22 +02:00
39d683ffeb
Fix & Test infinite look in regkey.values in certains conditions
2021-04-19 09:23:37 +02:00
3149961634
Retrieving process ppid now use limited_handle, allowed more case of sucessful retrieval
2021-03-05 16:37:48 +01:00
04cbbf3888
Fixed a Evthandle leak on evtlog code
2020-09-08 13:34:20 +02:00
0f49dff128
Added some docstrings
2020-07-16 23:33:27 +02:00
5b210b50cb
Updated some code in object manager
2020-05-18 22:45:08 +02:00
c666882105
Improved available information about scheduled task + updated documentation
2020-05-12 23:22:00 +02:00
ffec0aa57e
Renamed NewService class as Service + updated doc/sample for new service API
2020-05-12 00:20:16 +02:00
eb131d2621
system.services now handle int/slice for getitem + update doc + add a sample
2020-05-11 23:42:51 +02:00
042e77acf1
Updated doc of event_log.py
2020-05-11 23:42:51 +02:00
b59522e504
Documented most of the classes/attributes related to devices_manager.py. Updated related rst.
2020-05-10 23:27:18 +02:00
0ec8ae2fa6
Adapted device manager samples & small API improvements
2020-05-10 23:27:18 +02:00
1077541ec4
POC of new high-level API for device manager adapted from lucasg work
2020-05-10 23:27:18 +02:00
97a1bb22e1
[device] Add device object associated with phy device
2020-05-10 23:27:18 +02:00
ec0e97c075
[device] Improve device's name retrieval
2020-05-10 23:27:18 +02:00
7652f597f3
[Device] Correctly parse device's resources
2020-05-10 23:27:18 +02:00
5aa181c4cf
[Device] Implement API to retrieve resources associated with devices
2020-05-10 23:27:18 +02:00
445c68537c
[Device] Implement apis to retrieve the list of devices under each class
2020-05-10 23:27:18 +02:00
0ee191c981
[Device] Add setupapi SetupDiClassNameFromGuid winproxy
2020-05-10 23:27:18 +02:00
e74089cda3
[Device] Add cfgmgr.CM_Enumerate_Classes winproxy
2020-05-10 23:27:18 +02:00
466d94c03c
Fixed broken basestring for py3 compatibility (see issue #15 )
2020-05-02 23:12:25 +02:00
c691d8eb84
Added EvtQuery.seek() + IsDebuggerPresent API for sample purpose
2020-03-19 10:33:12 +01:00
91e6ef824c
Added EventLog.date for simplicity of use
2020-03-16 13:19:03 +01:00
7921e74647
Fixed a GC issue with system.modules + added deprecation warning to utils.get_kernel_modules()
2020-03-10 20:50:04 +01:00
02b2ba13f9
Added a poc for a WinFile object
2020-02-13 23:24:37 +01:00
66382b89f7
Some more py3 compat fix + few feature in POC
2020-02-13 22:30:46 +01:00
4d3b3e18ad
Lot of small py3 compat fix
2020-02-13 22:23:20 +01:00
6a74c83670
test_process pass for python3 + added some pe_parse test
2020-02-07 23:06:26 +01:00
7638080ee4
Added new service API allowing to find service by name easily
2019-11-14 13:31:20 +01:00
5b55d4d693
[event_log] Add some more format type to support
2019-10-14 22:03:49 +02:00
4f92323abf
[event log] export message_id instead of message_name
...
It's more consistent with the other classes
2019-10-14 22:03:49 +02:00
6dd314659d
[event log] adding event channel metadata message ID
2019-10-14 22:03:49 +02:00
adb7d3b63a
[event log] adding event metadata
2019-10-14 22:03:49 +02:00
b5371ddf33
[event log] still adding publisher metadata
2019-10-14 22:03:49 +02:00
4495eca6d0
[event log] add some more metadata
2019-10-14 22:03:49 +02:00
df28515b97
[event log] Expose message filename
2019-10-14 22:03:49 +02:00
6374f91fef
[event log] Expose channel metadatas
2019-10-14 22:03:49 +02:00
6125a1fb15
[event_trace] Add a way to pass a Python object to an ETW trace's
...
context
It may be useful to pass a python object (e.g. class) to the ETW
processing callback. The ETW tracing API allows the user to fill out a
"Context" field with a pointer value that will be passed to the event
being sent, the rest is ctypes magic for wrapping the python object
into a native pointer value.
2019-10-14 22:03:49 +02:00
clement rouault