Update readme + version number (#52)

Fix hang & improves tests related to the debugger + activate Debugger tests in CI

.github/workflows/mypytest.yml

@@ -0,0 +1,70 @@
+# V0.1
+name: Pytest
+
+on: [push, workflow_dispatch]
+  # Allows you to run this workflow manually from the Actions tab
+
+jobs:
+  build:
+    runs-on: windows-latest
+    timeout-minutes: 15
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: [2.7, 3.6, 3.11]
+        python-architecture: [x86, x64]
+        include:
+            # Translate architecture to bitness for py.exe commandline
+            - python-bitness-to-test: 32
+              python-architecture: x86
+            - python-bitness-to-test: 64
+              python-architecture: x64
+
+    steps:
+      - uses: actions/checkout@v4
+      # Pfw testing need both 32b & 64b of tested python version for cross-bitness python injection tests
+
+      ## Install the 32bits version of python3 asked
+      - name: Set up Python3 ${{ matrix.python-version }} x86
+        if: ${{ matrix.python-version != '2.7' }}
+        uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version}}
+          architecture: x86
+      ## Install the 64bits version of python3 asked
+      - name: Set up Python3 ${{ matrix.python-version }} x64
+        if: ${{ matrix.python-version != '2.7' }}
+        uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version}}
+          architecture: x64
+
+      # Manually install python2.7 (both version at once)
+      - name: Set up Python2.7 ${{ matrix.python-version }} x86 & x64
+        shell: bash
+        if: ${{ matrix.python-version == '2.7' }}
+        run: |
+            choco install python2 --version=2.7.18 -y --no-progress --params '"/InstallDir:C:\tools\python27"'
+            choco install python2 --version=2.7.18 -y --no-progress -x86 --params '"/InstallDir:C:\tools\python2732"' --force
+
+      - name: Listing python versions availables
+        run: py -0
+
+      # Install PythonForWindows for both bitness
+      - name: Installing PythonForWindows for both bitness
+        run: |
+            py -${{ matrix.python-version}}-32 setup.py install
+            py -${{ matrix.python-version}}-64 setup.py install
+
+      - name: Installing pytest & capstone-windows
+        run: py -${{ matrix.python-version}}-${{ matrix.python-bitness-to-test}} -m pip install pytest capstone-windows
+
+      # Testing
+      - name: Testing
+        run: py -${{ matrix.python-version}}-${{ matrix.python-bitness-to-test}} -m pytest --junitxml=junit/test-results.xml -s -k "not known_to_fail" -v tests/
+
+      - name: Publish PyTest Results
+        uses: EnricoMi/publish-unit-test-result-action/composite@v1
+        if: always()
+        with:
+          files: junit/test-results.xml

.gitignore

@@ -2,6 +2,7 @@
 doctrees
 *.inv
 *.pickle
+*.ignore
 
 .vscode/
 .cache/

README.md

@@ -1,6 +1,7 @@
 # PythonForWindows
 
 [![Join the chat at https://gitter.im/PythonForWindows/general](https://badges.gitter.im/PythonForWindows/general.svg)](https://gitter.im/PythonForWindows/general)
+[![Pytest](https://github.com/hakril/PythonForWindows/actions/workflows/mypytest.yml/badge.svg?branch=master)](https://github.com/hakril/PythonForWindows/actions/workflows/mypytest.yml)
 
 PythonForWindows (PFW) is a base of code aimed to make interaction with `Windows` (on X86/X64) easier (for both 32 and 64 bits Python).
 Its goal is to offer abstractions around some of the OS features in a (I hope) pythonic way.
@@ -22,7 +23,14 @@ I am always glad to have feedbacks from people using this project.
 
 ## Installation
 
-You can install PythonForWindows using the ``setup.py`` script:
+
+PythonForWindows is available on [Pypi](https://pypi.org/project/PythonForWindows/) an this can be installed with
+
+``
+python -m pip install PythonForWindows
+``
+
+You can also install PythonForWindows by cloning it and using the ``setup.py`` script:
 
 ``
 python setup.py install
@@ -30,9 +38,10 @@ python setup.py install
 
 #### Python3
 
-python3 support is still in beta.
-All the tests pass on master, but I did not test it heavily on real case.
-Do not hesitate report bugs and issues.
+PythonForWindows support python3 and is currently tested for Python2.7, 3.6 & 3.11 via [Github Workflow](https://github.com/hakril/PythonForWindows/actions/workflows/mypytest.yml)
+Regarding the handling of encoding in the project it's currently a mix of Ascii & Unicode that may be awkward on Python3 as automatic encoding/decoding is not present.
+
+The aim of passing the whole project under unicode is actvily ongoing.
 
 ## Overview
 

ctypes_generation/definitions/com/WMI/IWbemObjectTextSrc.txt

@@ -0,0 +1,33 @@
+typedef struct IWbemObjectTextSrcVtbl
+    {
+        BEGIN_INTERFACE
+
+        HRESULT ( STDMETHODCALLTYPE *QueryInterface )(
+            IWbemObjectTextSrc * This,
+            /* [in] */ REFIID riid,
+            /* [iid_is][out] */ void **ppvObject);
+
+        ULONG ( STDMETHODCALLTYPE *AddRef )(
+            IWbemObjectTextSrc * This);
+
+        ULONG ( STDMETHODCALLTYPE *Release )(
+            IWbemObjectTextSrc * This);
+
+        HRESULT ( STDMETHODCALLTYPE *GetText )(
+            IWbemObjectTextSrc * This,
+            /* [in] */ long lFlags,
+            /* [in] */ IWbemClassObject *pObj,
+            /* [in] */ ULONG uObjTextFormat,
+            /* [in] */ IWbemContext *pCtx,
+            /* [out] */ BSTR *strText);
+
+        HRESULT ( STDMETHODCALLTYPE *CreateFromText )(
+            IWbemObjectTextSrc * This,
+            /* [in] */ long lFlags,
+            /* [in] */ BSTR strText,
+            /* [in] */ ULONG uObjTextFormat,
+            /* [in] */ IWbemContext *pCtx,
+            /* [out] */ IWbemClassObject **pNewObj);
+
+        END_INTERFACE
+    } IWbemObjectTextSrcVtbl;

ctypes_generation/definitions/defines/crypt_algid.txt

@@ -0,0 +1,153 @@
+#define ALG_CLASS_ANY                   (0)
+#define ALG_CLASS_SIGNATURE             (1 << 13)
+#define ALG_CLASS_MSG_ENCRYPT           (2 << 13)
+#define ALG_CLASS_DATA_ENCRYPT          (3 << 13)
+#define ALG_CLASS_HASH                  (4 << 13)
+#define ALG_CLASS_KEY_EXCHANGE          (5 << 13)
+#define ALG_CLASS_ALL                   (7 << 13)
+/* Algorithm types */
+#define ALG_TYPE_ANY                    (0)
+#define ALG_TYPE_DSS                    (1 << 9)
+#define ALG_TYPE_RSA                    (2 << 9)
+#define ALG_TYPE_BLOCK                  (3 << 9)
+#define ALG_TYPE_STREAM                 (4 << 9)
+#define ALG_TYPE_DH                     (5 << 9)
+#define ALG_TYPE_SECURECHANNEL          (6 << 9)
+#define ALG_TYPE_ECDH                   (7 << 9)
+
+/* SIDs */
+#define ALG_SID_ANY                     (0)
+/* RSA SIDs */
+#define ALG_SID_RSA_ANY                 0
+#define ALG_SID_RSA_PKCS                1
+#define ALG_SID_RSA_MSATWORK            2
+#define ALG_SID_RSA_ENTRUST             3
+#define ALG_SID_RSA_PGP                 4
+/* DSS SIDs */
+#define ALG_SID_DSS_ANY                 0
+#define ALG_SID_DSS_PKCS                1
+#define ALG_SID_DSS_DMS                 2
+#define ALG_SID_ECDSA                   3
+
+/* DES SIDs */
+#define ALG_SID_DES                     1
+#define ALG_SID_3DES                    3
+#define ALG_SID_DESX                    4
+#define ALG_SID_IDEA                    5
+#define ALG_SID_CAST                    6
+#define ALG_SID_SAFERSK64               7
+#define ALG_SID_SAFERSK128              8
+#define ALG_SID_3DES_112                9
+#define ALG_SID_CYLINK_MEK             12
+#define ALG_SID_RC5                    13
+#define ALG_SID_AES_128                14
+#define ALG_SID_AES_192                15
+#define ALG_SID_AES_256                16
+#define ALG_SID_AES                    17
+/* Fortezza */
+#define ALG_SID_SKIPJACK               10
+#define ALG_SID_TEK                    11
+/* Diffie-Hellmans SIDs */
+#define ALG_SID_DH_SANDF                1
+#define ALG_SID_DH_EPHEM                2
+#define ALG_SID_AGREED_KEY_ANY          3
+#define ALG_SID_KEA                     4
+#define ALG_SID_ECDH                    5
+#define ALG_SID_ECDH_EPHEM              6
+/* RC2 SIDs */
+#define ALG_SID_RC4                     1
+#define ALG_SID_RC2                     2
+#define ALG_SID_SEAL                    2
+/* Hash SIDs */
+#define ALG_SID_MD2                     1
+#define ALG_SID_MD4                     2
+#define ALG_SID_MD5                     3
+#define ALG_SID_SHA                     4
+#define ALG_SID_SHA1                    ALG_SID_SHA
+#define ALG_SID_MAC                     5
+#define ALG_SID_RIPEMD                  6
+#define ALG_SID_RIPEMD160               7
+#define ALG_SID_SSL3SHAMD5              8
+#define ALG_SID_HMAC                    9
+#define ALG_SID_TLS1PRF                10
+#define ALG_SID_HASH_REPLACE_OWF       11
+#define ALG_SID_SHA_256                12
+#define ALG_SID_SHA_384                13
+#define ALG_SID_SHA_512                14
+/* SCHANNEL SIDs */
+#define ALG_SID_SSL3_MASTER             1
+#define ALG_SID_SCHANNEL_MASTER_HASH    2
+#define ALG_SID_SCHANNEL_MAC_KEY        3
+#define ALG_SID_PCT1_MASTER             4
+#define ALG_SID_SSL2_MASTER             5
+#define ALG_SID_TLS1_MASTER             6
+#define ALG_SID_SCHANNEL_ENC_KEY        7
+#define ALG_SID_EXAMPLE                80
+
+#define ALG_SID_ECMQV                   1
+
+/* Algorithm Definitions */
+#define CALG_MD2                  (ALG_CLASS_HASH         | ALG_TYPE_ANY           | ALG_SID_MD2)
+#define CALG_MD4                  (ALG_CLASS_HASH         | ALG_TYPE_ANY           | ALG_SID_MD4)
+#define CALG_MD5                  (ALG_CLASS_HASH         | ALG_TYPE_ANY           | ALG_SID_MD5)
+#define CALG_SHA                  (ALG_CLASS_HASH         | ALG_TYPE_ANY           | ALG_SID_SHA)
+#define CALG_SHA1 CALG_SHA
+#define CALG_MAC                  (ALG_CLASS_HASH         | ALG_TYPE_ANY           | ALG_SID_MAC)
+#define CALG_SSL3_SHAMD5          (ALG_CLASS_HASH         | ALG_TYPE_ANY           | ALG_SID_SSL3SHAMD5)
+#define CALG_HMAC                 (ALG_CLASS_HASH         | ALG_TYPE_ANY           | ALG_SID_HMAC)
+#define CALG_TLS1PRF              (ALG_CLASS_HASH         | ALG_TYPE_ANY           | ALG_SID_TLS1PRF)
+#define CALG_HASH_REPLACE_OWF     (ALG_CLASS_HASH         | ALG_TYPE_ANY           | ALG_SID_HASH_REPLACE_OWF)
+#define CALG_SHA_256              (ALG_CLASS_HASH         | ALG_TYPE_ANY           | ALG_SID_SHA_256)
+#define CALG_SHA_384              (ALG_CLASS_HASH         | ALG_TYPE_ANY           | ALG_SID_SHA_384)
+#define CALG_SHA_512              (ALG_CLASS_HASH         | ALG_TYPE_ANY           | ALG_SID_SHA_512)
+#define CALG_RSA_SIGN             (ALG_CLASS_SIGNATURE    | ALG_TYPE_RSA           | ALG_SID_RSA_ANY)
+#define CALG_DSS_SIGN             (ALG_CLASS_SIGNATURE    | ALG_TYPE_DSS           | ALG_SID_DSS_ANY)
+#define CALG_NO_SIGN              (ALG_CLASS_SIGNATURE    | ALG_TYPE_ANY           | ALG_SID_ANY)
+#define CALG_ECDSA                (ALG_CLASS_SIGNATURE    | ALG_TYPE_DSS           | ALG_SID_ECDSA)
+#define CALG_DH_SF                (ALG_CLASS_KEY_EXCHANGE | ALG_TYPE_DH            | ALG_SID_DH_SANDF)
+#define CALG_DH_EPHEM             (ALG_CLASS_KEY_EXCHANGE | ALG_TYPE_DH            | ALG_SID_DH_EPHEM)
+#define CALG_AGREEDKEY_ANY        (ALG_CLASS_KEY_EXCHANGE | ALG_TYPE_DH            | ALG_SID_AGREED_KEY_ANY)
+#define CALG_KEA_KEYX             (ALG_CLASS_KEY_EXCHANGE | ALG_TYPE_DH            | ALG_SID_KEA)
+#define CALG_HUGHES_MD5           (ALG_CLASS_KEY_EXCHANGE | ALG_TYPE_ANY           | ALG_SID_MD5)
+#define CALG_ECDH                 (ALG_CLASS_KEY_EXCHANGE | ALG_TYPE_DH            | ALG_SID_ECDH)
+#define CALG_ECDH_EPHEM           (ALG_CLASS_KEY_EXCHANGE | ALG_TYPE_ECDH          | ALG_SID_ECDH_EPHEM)
+#define CALG_RSA_KEYX             (ALG_CLASS_KEY_EXCHANGE | ALG_TYPE_RSA           | ALG_SID_RSA_ANY)
+#define CALG_ECMQV                (ALG_CLASS_KEY_EXCHANGE | ALG_TYPE_ANY           | ALG_SID_ECMQV)
+#define CALG_DES                  (ALG_CLASS_DATA_ENCRYPT | ALG_TYPE_BLOCK         | ALG_SID_DES)
+#define CALG_RC2                  (ALG_CLASS_DATA_ENCRYPT | ALG_TYPE_BLOCK         | ALG_SID_RC2)
+#define CALG_3DES                 (ALG_CLASS_DATA_ENCRYPT | ALG_TYPE_BLOCK         | ALG_SID_3DES)
+#define CALG_3DES_112             (ALG_CLASS_DATA_ENCRYPT | ALG_TYPE_BLOCK         | ALG_SID_3DES_112)
+#define CALG_DESX                 (ALG_CLASS_DATA_ENCRYPT | ALG_TYPE_BLOCK         | ALG_SID_DESX)
+#define CALG_AES_128              (ALG_CLASS_DATA_ENCRYPT | ALG_TYPE_BLOCK         | ALG_SID_AES_128)
+#define CALG_AES_192              (ALG_CLASS_DATA_ENCRYPT | ALG_TYPE_BLOCK         | ALG_SID_AES_192)
+#define CALG_AES_256              (ALG_CLASS_DATA_ENCRYPT | ALG_TYPE_BLOCK         | ALG_SID_AES_256)
+#define CALG_AES                  (ALG_CLASS_DATA_ENCRYPT | ALG_TYPE_BLOCK         | ALG_SID_AES)
+#define CALG_RC4                  (ALG_CLASS_DATA_ENCRYPT | ALG_TYPE_STREAM        | ALG_SID_RC4)
+#define CALG_SEAL                 (ALG_CLASS_DATA_ENCRYPT | ALG_TYPE_STREAM        | ALG_SID_SEAL)
+#define CALG_RC5                  (ALG_CLASS_DATA_ENCRYPT | ALG_TYPE_STREAM        | ALG_SID_RC5)
+#define CALG_SKIPJACK             (ALG_CLASS_DATA_ENCRYPT | ALG_TYPE_BLOCK         | ALG_SID_SKIPJACK)
+#define CALG_TEK                  (ALG_CLASS_DATA_ENCRYPT | ALG_TYPE_BLOCK         | ALG_SID_TEK)
+#define CALG_CYLINK_MEK           (ALG_CLASS_DATA_ENCRYPT | ALG_TYPE_BLOCK         | ALG_SID_CYLINK_MEK)
+#define CALG_SSL3_MASTER          (ALG_CLASS_MSG_ENCRYPT  | ALG_TYPE_SECURECHANNEL | ALG_SID_SSL3_MASTER)
+#define CALG_SCHANNEL_MASTER_HASH (ALG_CLASS_MSG_ENCRYPT  | ALG_TYPE_SECURECHANNEL | ALG_SID_SCHANNEL_MASTER_HASH)
+#define CALG_SCHANNEL_MAC_KEY     (ALG_CLASS_MSG_ENCRYPT  | ALG_TYPE_SECURECHANNEL | ALG_SID_SCHANNEL_MAC_KEY)
+#define CALG_SCHANNEL_ENC_KEY     (ALG_CLASS_MSG_ENCRYPT  | ALG_TYPE_SECURECHANNEL | ALG_SID_SCHANNEL_ENC_KEY)
+#define CALG_PCT1_MASTER          (ALG_CLASS_MSG_ENCRYPT  | ALG_TYPE_SECURECHANNEL | ALG_SID_PCT1_MASTER)
+#define CALG_SSL2_MASTER          (ALG_CLASS_MSG_ENCRYPT  | ALG_TYPE_SECURECHANNEL | ALG_SID_SSL2_MASTER)
+#define CALG_TLS1_MASTER          (ALG_CLASS_MSG_ENCRYPT  | ALG_TYPE_SECURECHANNEL | ALG_SID_TLS1_MASTER)
+
+
+/* Protocol Flags */
+#define CRYPT_FLAG_PCT1    0x0001
+#define CRYPT_FLAG_SSL2    0x0002
+#define CRYPT_FLAG_SSL3    0x0004
+#define CRYPT_FLAG_TLS1    0x0008
+#define CRYPT_FLAG_IPSEC   0x0010
+#define CRYPT_FLAG_SIGNING 0x0020
+
+#define HP_ALGID                0x0001  // Hash algorithm
+#define HP_HASHVAL              0x0002  // Hash value
+#define HP_HASHSIZE             0x0004  // Hash value size
+#define HP_HMAC_INFO            0x0005  // information for creating an HMAC
+#define HP_TLS1PRF_LABEL        0x0006  // label for TLS1 PRF
+#define HP_TLS1PRF_SEED         0x0007  // seed for TLS1 PRF

ctypes_generation/definitions/defines/dpapi.txt

@@ -0,0 +1,94 @@
+//
+// CryptProtect PromptStruct dwPromtFlags
+//
+//
+// prompt on unprotect
+#define CRYPTPROTECT_PROMPT_ON_UNPROTECT     0x1  // 1<<0
+//
+// prompt on protect
+#define CRYPTPROTECT_PROMPT_ON_PROTECT       0x2  // 1<<1
+#define CRYPTPROTECT_PROMPT_RESERVED         0x04 // reserved, do not use.
+
+//
+// default to strong variant UI protection (user supplied password currently).
+#define CRYPTPROTECT_PROMPT_STRONG           0x08 // 1<<3
+
+//
+// require strong variant UI protection (user supplied password currently).
+#define CRYPTPROTECT_PROMPT_REQUIRE_STRONG   0x10 // 1<<4
+
+//
+// CryptProtectData and CryptUnprotectData dwFlags
+//
+// for remote-access situations where ui is not an option
+// if UI was specified on protect or unprotect operation, the call
+// will fail and GetLastError() will indicate ERROR_PASSWORD_RESTRICTION
+#define CRYPTPROTECT_UI_FORBIDDEN        0x1
+
+//
+// per machine protected data -- any user on machine where CryptProtectData
+// took place may CryptUnprotectData
+#define CRYPTPROTECT_LOCAL_MACHINE       0x4
+
+//
+// force credential synchronize during CryptProtectData()
+// Synchronize is only operation that occurs during this operation
+#define CRYPTPROTECT_CRED_SYNC           0x8
+
+//
+// Generate an Audit on protect and unprotect operations
+//
+#define CRYPTPROTECT_AUDIT              0x10
+
+//
+// Protect data with a non-recoverable key
+//
+#define CRYPTPROTECT_NO_RECOVERY        0x20
+
+
+//
+// Verify the protection of a protected blob
+//
+#define CRYPTPROTECT_VERIFY_PROTECTION  0x40
+
+//
+// Regenerate the local machine protection
+//
+#define CRYPTPROTECT_CRED_REGENERATE    0x80
+
+// flags reserved for system use
+#define CRYPTPROTECT_FIRST_RESERVED_FLAGVAL    0x0FFFFFFF
+#define CRYPTPROTECT_LAST_RESERVED_FLAGVAL     0xFFFFFFFF
+
+
+//
+// The buffer length passed into CryptProtectMemory and CryptUnprotectMemory
+// must be a multiple of this length (or zero).
+//
+
+#define CRYPTPROTECTMEMORY_BLOCK_SIZE           16
+
+
+//
+// CryptProtectMemory/CryptUnprotectMemory dwFlags
+//
+
+//
+// Encrypt/Decrypt within current process context.
+//
+
+#define CRYPTPROTECTMEMORY_SAME_PROCESS         0x00
+
+//
+// Encrypt/Decrypt across process boundaries.
+// eg: encrypted buffer passed across LPC to another process which calls CryptUnprotectMemory.
+//
+
+#define CRYPTPROTECTMEMORY_CROSS_PROCESS        0x01
+
+//
+// Encrypt/Decrypt across callers with same LogonId.
+// eg: encrypted buffer passed across LPC to another process which calls CryptUnprotectMemory whilst impersonating.
+//
+
+#define CRYPTPROTECTMEMORY_SAME_LOGON           0x02

ctypes_generation/definitions/defines/event_trace.txt

@@ -45,6 +45,40 @@
 #define EVENT_TRACE_FILE_MODE_NEWFILE       0x00000008  // Auto-switch log file
 #define EVENT_TRACE_FILE_MODE_PREALLOCATE   0x00000020  // Pre-allocate mode
 
+#define EVENT_TRACE_FILE_MODE_NEWFILE       0x00000008  // Auto-switch log file
+#define EVENT_TRACE_FILE_MODE_PREALLOCATE   0x00000020  // Pre-allocate mode
+
+//
+// Logger Mode flags on Vista and above
+//
+
+#define EVENT_TRACE_NONSTOPPABLE_MODE       0x00000040  // Session cannot be stopped (Autologger only)
+#define EVENT_TRACE_SECURE_MODE             0x00000080  // Secure session
+#define EVENT_TRACE_USE_KBYTES_FOR_SIZE     0x00002000  // Use KBytes as file size unit
+#define EVENT_TRACE_PRIVATE_IN_PROC         0x00020000  // In process private logger
+
+#define EVENT_TRACE_MODE_RESERVED           0x00100000  // Reserved bit, used to signal Heap/Critsec tracing
+
+//
+// Logger Mode flags on Win7 and above
+//
+
+#define EVENT_TRACE_NO_PER_PROCESSOR_BUFFERING 0x10000000  // Use this for low frequency sessions.
+
+//
+// Logger Mode flags on Win8 and above
+//
+
+#define EVENT_TRACE_SYSTEM_LOGGER_MODE      0x02000000  // Receive events from SystemTraceProvider
+#define EVENT_TRACE_ADDTO_TRIAGE_DUMP       0x80000000  // Add ETW buffers to triage dumps
+#define EVENT_TRACE_STOP_ON_HYBRID_SHUTDOWN 0x00400000  // Stop on hybrid shutdown
+#define EVENT_TRACE_PERSIST_ON_HYBRID_SHUTDOWN 0x00800000 // Persist on hybrid shutdown
+
+//
+// Logger Mode flags on Blue and above
+//
+
+#define EVENT_TRACE_INDEPENDENT_SESSION_MODE  0x08000000  // Independent logger session
 
 //
 // ControlTrace Codes

ctypes_generation/definitions/defines/file.txt

@@ -0,0 +1,72 @@
+#define FILE_NOTIFY_CHANGE_FILE_NAME    0x00000001   // winnt
+#define FILE_NOTIFY_CHANGE_DIR_NAME     0x00000002   // winnt
+#define FILE_NOTIFY_CHANGE_NAME         0x00000003
+#define FILE_NOTIFY_CHANGE_ATTRIBUTES   0x00000004   // winnt
+#define FILE_NOTIFY_CHANGE_SIZE         0x00000008   // winnt
+#define FILE_NOTIFY_CHANGE_LAST_WRITE   0x00000010   // winnt
+#define FILE_NOTIFY_CHANGE_LAST_ACCESS  0x00000020   // winnt
+#define FILE_NOTIFY_CHANGE_CREATION     0x00000040   // winnt
+#define FILE_NOTIFY_CHANGE_EA           0x00000080
+#define FILE_NOTIFY_CHANGE_SECURITY     0x00000100   // winnt
+#define FILE_NOTIFY_CHANGE_STREAM_NAME  0x00000200
+#define FILE_NOTIFY_CHANGE_STREAM_SIZE  0x00000400
+#define FILE_NOTIFY_CHANGE_STREAM_WRITE 0x00000800
+#define FILE_NOTIFY_VALID_MASK          0x00000fff
+
+
+
+#define FILE_ACTION_ADDED                   0x00000001   // winnt
+#define FILE_ACTION_REMOVED                 0x00000002   // winnt
+#define FILE_ACTION_MODIFIED                0x00000003   // winnt
+#define FILE_ACTION_RENAMED_OLD_NAME        0x00000004   // winnt
+#define FILE_ACTION_RENAMED_NEW_NAME        0x00000005   // winnt
+#define FILE_ACTION_ADDED_STREAM            0x00000006
+#define FILE_ACTION_REMOVED_STREAM          0x00000007
+#define FILE_ACTION_MODIFIED_STREAM         0x00000008
+#define FILE_ACTION_REMOVED_BY_DELETE       0x00000009
+#define FILE_ACTION_ID_NOT_TUNNELLED        0x0000000A
+#define FILE_ACTION_TUNNELLED_ID_COLLISION  0x0000000B
+
+
+#define FILE_CASE_SENSITIVE_SEARCH          0x00000001
+#define FILE_CASE_PRESERVED_NAMES           0x00000002
+#define FILE_UNICODE_ON_DISK                0x00000004
+#define FILE_PERSISTENT_ACLS                0x00000008
+#define FILE_FILE_COMPRESSION               0x00000010
+#define FILE_VOLUME_QUOTAS                  0x00000020
+#define FILE_SUPPORTS_SPARSE_FILES          0x00000040
+#define FILE_SUPPORTS_REPARSE_POINTS        0x00000080
+#define FILE_SUPPORTS_REMOTE_STORAGE        0x00000100
+#define FILE_VOLUME_IS_COMPRESSED           0x00008000
+#define FILE_SUPPORTS_OBJECT_IDS            0x00010000
+#define FILE_SUPPORTS_ENCRYPTION            0x00020000
+#define FILE_NAMED_STREAMS                  0x00040000
+#define FILE_READ_ONLY_VOLUME               0x00080000
+#define FILE_SEQUENTIAL_WRITE_ONCE          0x00100000
+#define FILE_SUPPORTS_TRANSACTIONS          0x00200000
+#define FILE_SUPPORTS_HARD_LINKS            0x00400000
+#define FILE_SUPPORTS_EXTENDED_ATTRIBUTES   0x00800000
+#define FILE_SUPPORTS_OPEN_BY_FILE_ID       0x01000000
+#define FILE_SUPPORTS_USN_JOURNAL           0x02000000
+
+
+#define FILE_SHARE_READ                 0x00000001
+#define FILE_SHARE_WRITE                0x00000002
+#define FILE_SHARE_DELETE               0x00000004
+
+
+#define FILE_ATTRIBUTE_READONLY             0x00000001
+#define FILE_ATTRIBUTE_HIDDEN               0x00000002
+#define FILE_ATTRIBUTE_SYSTEM               0x00000004
+#define FILE_ATTRIBUTE_DIRECTORY            0x00000010
+#define FILE_ATTRIBUTE_ARCHIVE              0x00000020
+#define FILE_ATTRIBUTE_DEVICE               0x00000040
+#define FILE_ATTRIBUTE_NORMAL               0x00000080
+#define FILE_ATTRIBUTE_TEMPORARY            0x00000100
+#define FILE_ATTRIBUTE_SPARSE_FILE          0x00000200
+#define FILE_ATTRIBUTE_REPARSE_POINT        0x00000400
+#define FILE_ATTRIBUTE_COMPRESSED           0x00000800
+#define FILE_ATTRIBUTE_OFFLINE              0x00001000
+#define FILE_ATTRIBUTE_NOT_CONTENT_INDEXED  0x00002000
+#define FILE_ATTRIBUTE_ENCRYPTED            0x00004000
+#define FILE_ATTRIBUTE_VIRTUAL              0x00010000

ctypes_generation/definitions/defines/netapi.txt

@@ -0,0 +1,608 @@
+#define MAX_PREFERRED_LENGTH    0xffffffff //((DWORD) -1)
+
+#define NERR_Success            0       /* Success */
+
+/***    NERR_BASE is the base of error codes from network utilities,
+ *      chosen to avoid conflict with system and redirector error codes.
+ *      2100 is a value that has been assigned to us by system.
+ */
+#define NERR_BASE       2100
+
+
+/**INTERNAL_ONLY**/
+
+/***********WARNING ****************
+ *See the comment in lmcons.h for  *
+ *info on the allocation of errors *
+ ***********************************/
+
+/***********WARNING ****************
+ *The range 2750-2799 has been     *
+ *allocated to the IBM LAN Server  *
+ ***********************************/
+
+/***********WARNING ****************
+ *The range 2900-2999 has been     *
+ *reserved for Microsoft OEMs      *
+ ***********************************/
+
+/**END_INTERNAL**/
+
+/* UNUSED BASE+0 */
+/* UNUSED BASE+1 */
+#define NERR_NetNotStarted      (NERR_BASE+2)   /* The workstation driver is not installed. */
+#define NERR_UnknownServer      (NERR_BASE+3)   /* The server could not be located. */
+#define NERR_ShareMem           (NERR_BASE+4)   /* An internal error occurred.  The network cannot access a shared memory segment. */
+
+#define NERR_NoNetworkResource  (NERR_BASE+5)   /* A network resource shortage occurred . */
+#define NERR_RemoteOnly         (NERR_BASE+6)   /* This operation is not supported on workstations. */
+#define NERR_DevNotRedirected   (NERR_BASE+7)   /* The device is not connected. */
+/* NERR_BASE+8 is used for ERROR_CONNECTED_OTHER_PASSWORD */
+/* NERR_BASE+9 is used for ERROR_CONNECTED_OTHER_PASSWORD_DEFAULT */
+/* UNUSED BASE+10 */
+/* UNUSED BASE+11 */
+/* UNUSED BASE+12 */
+/* UNUSED BASE+13 */
+#define NERR_ServerNotStarted   (NERR_BASE+14)  /* The Server service is not started. */
+#define NERR_ItemNotFound       (NERR_BASE+15)  /* The queue is empty. */
+#define NERR_UnknownDevDir      (NERR_BASE+16)  /* The device or directory does not exist. */
+#define NERR_RedirectedPath     (NERR_BASE+17)  /* The operation is invalid on a redirected resource. */
+#define NERR_DuplicateShare     (NERR_BASE+18)  /* The name has already been shared. */
+#define NERR_NoRoom             (NERR_BASE+19)  /* The server is currently out of the requested resource. */
+/* UNUSED BASE+20 */
+#define NERR_TooManyItems       (NERR_BASE+21)  /* Requested addition of items exceeds the maximum allowed. */
+#define NERR_InvalidMaxUsers    (NERR_BASE+22)  /* The Peer service supports only two simultaneous users. */
+#define NERR_BufTooSmall        (NERR_BASE+23)  /* The API return buffer is too small. */
+/* UNUSED BASE+24 */
+/* UNUSED BASE+25 */
+/* UNUSED BASE+26 */
+#define NERR_RemoteErr          (NERR_BASE+27)  /* A remote API error occurred.  */
+/* UNUSED BASE+28 */
+/* UNUSED BASE+29 */
+/* UNUSED BASE+30 */
+#define NERR_LanmanIniError     (NERR_BASE+31)  /* An error occurred when opening or reading the configuration file. */
+/* UNUSED BASE+32 */
+/* UNUSED BASE+33 */
+/* UNUSED BASE+34 */
+/* UNUSED BASE+35 */
+#define NERR_NetworkError       (NERR_BASE+36)  /* A general network error occurred. */
+#define NERR_WkstaInconsistentState (NERR_BASE+37)
+    /* The Workstation service is in an inconsistent state. Restart the computer before restarting the Workstation service. */
+#define NERR_WkstaNotStarted    (NERR_BASE+38)  /* The Workstation service has not been started. */
+#define NERR_BrowserNotStarted  (NERR_BASE+39)  /* The requested information is not available. */
+#define NERR_InternalError      (NERR_BASE+40)  /* An internal Windows error occurred.*/
+#define NERR_BadTransactConfig  (NERR_BASE+41)  /* The server is not configured for transactions. */
+#define NERR_InvalidAPI         (NERR_BASE+42)  /* The requested API is not supported on the remote server. */
+#define NERR_BadEventName       (NERR_BASE+43)  /* The event name is invalid. */
+#define NERR_DupNameReboot      (NERR_BASE+44)  /* The computer name already exists on the network. Change it and restart the computer. */
+/*
+ *      Config API related
+ *              Error codes from BASE+45 to BASE+49
+ */
+
+/* UNUSED BASE+45 */
+#define NERR_CfgCompNotFound    (NERR_BASE+46)  /* The specified component could not be found in the configuration information. */
+#define NERR_CfgParamNotFound   (NERR_BASE+47)  /* The specified parameter could not be found in the configuration information. */
+#define NERR_LineTooLong        (NERR_BASE+49)  /* A line in the configuration file is too long. */
+
+/*
+ *      Spooler API related
+ *              Error codes from BASE+50 to BASE+79
+ */
+
+#define NERR_QNotFound          (NERR_BASE+50)  /* The printer does not exist. */
+#define NERR_JobNotFound        (NERR_BASE+51)  /* The print job does not exist. */
+#define NERR_DestNotFound       (NERR_BASE+52)  /* The printer destination cannot be found. */
+#define NERR_DestExists         (NERR_BASE+53)  /* The printer destination already exists. */
+#define NERR_QExists            (NERR_BASE+54)  /* The printer queue already exists. */
+#define NERR_QNoRoom            (NERR_BASE+55)  /* No more printers can be added. */
+#define NERR_JobNoRoom          (NERR_BASE+56)  /* No more print jobs can be added.  */
+#define NERR_DestNoRoom         (NERR_BASE+57)  /* No more printer destinations can be added. */
+#define NERR_DestIdle           (NERR_BASE+58)  /* This printer destination is idle and cannot accept control operations. */
+#define NERR_DestInvalidOp      (NERR_BASE+59)  /* This printer destination request contains an invalid control function. */
+#define NERR_ProcNoRespond      (NERR_BASE+60)  /* The print processor is not responding. */
+#define NERR_SpoolerNotLoaded   (NERR_BASE+61)  /* The spooler is not running. */
+#define NERR_DestInvalidState   (NERR_BASE+62)  /* This operation cannot be performed on the print destination in its current state. */
+#define NERR_QInvalidState      (NERR_BASE+63)  /* This operation cannot be performed on the printer queue in its current state. */
+#define NERR_JobInvalidState    (NERR_BASE+64)  /* This operation cannot be performed on the print job in its current state. */
+#define NERR_SpoolNoMemory      (NERR_BASE+65)  /* A spooler memory allocation failure occurred. */
+#define NERR_DriverNotFound     (NERR_BASE+66)  /* The device driver does not exist. */
+#define NERR_DataTypeInvalid    (NERR_BASE+67)  /* The data type is not supported by the print processor. */
+#define NERR_ProcNotFound       (NERR_BASE+68)  /* The print processor is not installed. */
+
+/*
+ *      Service API related
+ *              Error codes from BASE+80 to BASE+99
+ */
+
+#define NERR_ServiceTableLocked (NERR_BASE+80)  /* The service database is locked. */
+#define NERR_ServiceTableFull   (NERR_BASE+81)  /* The service table is full. */
+#define NERR_ServiceInstalled   (NERR_BASE+82)  /* The requested service has already been started. */
+#define NERR_ServiceEntryLocked (NERR_BASE+83)  /* The service does not respond to control actions. */
+#define NERR_ServiceNotInstalled (NERR_BASE+84) /* The service has not been started. */
+#define NERR_BadServiceName     (NERR_BASE+85)  /* The service name is invalid. */
+#define NERR_ServiceCtlTimeout  (NERR_BASE+86)  /* The service is not responding to the control function. */
+#define NERR_ServiceCtlBusy     (NERR_BASE+87)  /* The service control is busy. */
+#define NERR_BadServiceProgName (NERR_BASE+88)  /* The configuration file contains an invalid service program name. */
+#define NERR_ServiceNotCtrl     (NERR_BASE+89)  /* The service could not be controlled in its present state. */
+#define NERR_ServiceKillProc    (NERR_BASE+90)  /* The service ended abnormally. */
+#define NERR_ServiceCtlNotValid (NERR_BASE+91)  /* The requested pause, continue, or stop is not valid for this service. */
+#define NERR_NotInDispatchTbl   (NERR_BASE+92)  /* The service control dispatcher could not find the service name in the dispatch table. */
+#define NERR_BadControlRecv     (NERR_BASE+93)  /* The service control dispatcher pipe read failed. */
+#define NERR_ServiceNotStarting (NERR_BASE+94)  /* A thread for the new service could not be created. */
+
+/*
+ *      Wksta and Logon API related
+ *              Error codes from BASE+100 to BASE+118
+ */
+
+#define NERR_AlreadyLoggedOn    (NERR_BASE+100) /* This workstation is already logged on to the local-area network. */
+#define NERR_NotLoggedOn        (NERR_BASE+101) /* The workstation is not logged on to the local-area network. */
+#define NERR_BadUsername        (NERR_BASE+102) /* The user name or group name parameter is invalid.  */
+#define NERR_BadPassword        (NERR_BASE+103) /* The password parameter is invalid. */
+#define NERR_UnableToAddName_W  (NERR_BASE+104) /* @W The logon processor did not add the message alias. */
+#define NERR_UnableToAddName_F  (NERR_BASE+105) /* The logon processor did not add the message alias. */
+#define NERR_UnableToDelName_W  (NERR_BASE+106) /* @W The logoff processor did not delete the message alias. */
+#define NERR_UnableToDelName_F  (NERR_BASE+107) /* The logoff processor did not delete the message alias. */
+/* UNUSED BASE+108 */
+#define NERR_LogonsPaused       (NERR_BASE+109) /* Network logons are paused. */
+#define NERR_LogonServerConflict (NERR_BASE+110)/* A centralized logon-server conflict occurred. */
+#define NERR_LogonNoUserPath    (NERR_BASE+111) /* The server is configured without a valid user path. */
+#define NERR_LogonScriptError   (NERR_BASE+112) /* An error occurred while loading or running the logon script. */
+/* UNUSED BASE+113 */
+#define NERR_StandaloneLogon    (NERR_BASE+114) /* The logon server was not specified.  Your computer will be logged on as STANDALONE. */
+#define NERR_LogonServerNotFound (NERR_BASE+115) /* The logon server could not be found.  */
+#define NERR_LogonDomainExists  (NERR_BASE+116) /* There is already a logon domain for this computer.  */
+#define NERR_NonValidatedLogon  (NERR_BASE+117) /* The logon server could not validate the logon. */
+
+/*
+ *      ACF API related (access, user, group)
+ *              Error codes from BASE+119 to BASE+149
+ */
+
+#define NERR_ACFNotFound        (NERR_BASE+119) /* The security database could not be found. */
+#define NERR_GroupNotFound      (NERR_BASE+120) /* The group name could not be found. */
+#define NERR_UserNotFound       (NERR_BASE+121) /* The user name could not be found. */
+#define NERR_ResourceNotFound   (NERR_BASE+122) /* The resource name could not be found.  */
+#define NERR_GroupExists        (NERR_BASE+123) /* The group already exists. */
+#define NERR_UserExists         (NERR_BASE+124) /* The account already exists. */
+#define NERR_ResourceExists     (NERR_BASE+125) /* The resource permission list already exists. */
+#define NERR_NotPrimary         (NERR_BASE+126) /* This operation is only allowed on the primary domain controller of the domain. */
+#define NERR_ACFNotLoaded       (NERR_BASE+127) /* The security database has not been started. */
+#define NERR_ACFNoRoom          (NERR_BASE+128) /* There are too many names in the user accounts database. */
+#define NERR_ACFFileIOFail      (NERR_BASE+129) /* A disk I/O failure occurred.*/
+#define NERR_ACFTooManyLists    (NERR_BASE+130) /* The limit of 64 entries per resource was exceeded. */
+#define NERR_UserLogon          (NERR_BASE+131) /* Deleting a user with a session is not allowed. */
+#define NERR_ACFNoParent        (NERR_BASE+132) /* The parent directory could not be located. */
+#define NERR_CanNotGrowSegment  (NERR_BASE+133) /* Unable to add to the security database session cache segment. */
+#define NERR_SpeGroupOp         (NERR_BASE+134) /* This operation is not allowed on this special group. */
+#define NERR_NotInCache         (NERR_BASE+135) /* This user is not cached in user accounts database session cache. */
+#define NERR_UserInGroup        (NERR_BASE+136) /* The user already belongs to this group. */
+#define NERR_UserNotInGroup     (NERR_BASE+137) /* The user does not belong to this group. */
+#define NERR_AccountUndefined   (NERR_BASE+138) /* This user account is undefined. */
+#define NERR_AccountExpired     (NERR_BASE+139) /* This user account has expired. */
+#define NERR_InvalidWorkstation (NERR_BASE+140) /* The user is not allowed to log on from this workstation. */
+#define NERR_InvalidLogonHours  (NERR_BASE+141) /* The user is not allowed to log on at this time.  */
+#define NERR_PasswordExpired    (NERR_BASE+142) /* The password of this user has expired. */
+#define NERR_PasswordCantChange (NERR_BASE+143) /* The password of this user cannot change. */
+#define NERR_PasswordHistConflict (NERR_BASE+144) /* This password cannot be used now. */
+#define NERR_PasswordTooShort   (NERR_BASE+145) /* The password does not meet the password policy requirements. Check the minimum password length, password complexity and password history requirements. */
+#define NERR_PasswordTooRecent  (NERR_BASE+146) /* The password of this user is too recent to change.  */
+#define NERR_InvalidDatabase    (NERR_BASE+147) /* The security database is corrupted. */
+#define NERR_DatabaseUpToDate   (NERR_BASE+148) /* No updates are necessary to this replicant network/local security database. */
+#define NERR_SyncRequired       (NERR_BASE+149) /* This replicant database is outdated; synchronization is required. */
+
+/*
+ *      Use API related
+ *              Error codes from BASE+150 to BASE+169
+ */
+
+#define NERR_UseNotFound        (NERR_BASE+150) /* The network connection could not be found. */
+#define NERR_BadAsgType         (NERR_BASE+151) /* This asg_type is invalid. */
+#define NERR_DeviceIsShared     (NERR_BASE+152) /* This device is currently being shared. */
+#define NERR_SameAsComputerName (NERR_BASE+153) /* The user name may not be same as computer name. */
+
+
+/*
+ *      Message Server related
+ *              Error codes BASE+170 to BASE+209
+ */
+
+#define NERR_NoComputerName     (NERR_BASE+170) /* The computer name could not be added as a message alias.  The name may already exist on the network. */
+#define NERR_MsgAlreadyStarted  (NERR_BASE+171) /* The Messenger service is already started. */
+#define NERR_MsgInitFailed      (NERR_BASE+172) /* The Messenger service failed to start.  */
+#define NERR_NameNotFound       (NERR_BASE+173) /* The message alias could not be found on the network. */
+#define NERR_AlreadyForwarded   (NERR_BASE+174) /* This message alias has already been forwarded. */
+#define NERR_AddForwarded       (NERR_BASE+175) /* This message alias has been added but is still forwarded. */
+#define NERR_AlreadyExists      (NERR_BASE+176) /* This message alias already exists locally. */
+#define NERR_TooManyNames       (NERR_BASE+177) /* The maximum number of added message aliases has been exceeded. */
+#define NERR_DelComputerName    (NERR_BASE+178) /* The computer name could not be deleted.*/
+#define NERR_LocalForward       (NERR_BASE+179) /* Messages cannot be forwarded back to the same workstation. */
+#define NERR_GrpMsgProcessor    (NERR_BASE+180) /* An error occurred in the domain message processor. */
+#define NERR_PausedRemote       (NERR_BASE+181) /* The message was sent, but the recipient has paused the Messenger service. */
+#define NERR_BadReceive         (NERR_BASE+182) /* The message was sent but not received. */
+#define NERR_NameInUse          (NERR_BASE+183) /* The message alias is currently in use. Try again later. */
+#define NERR_MsgNotStarted      (NERR_BASE+184) /* The Messenger service has not been started. */
+#define NERR_NotLocalName       (NERR_BASE+185) /* The name is not on the local computer. */
+#define NERR_NoForwardName      (NERR_BASE+186) /* The forwarded message alias could not be found on the network. */
+#define NERR_RemoteFull         (NERR_BASE+187) /* The message alias table on the remote station is full. */
+#define NERR_NameNotForwarded   (NERR_BASE+188) /* Messages for this alias are not currently being forwarded. */
+#define NERR_TruncatedBroadcast (NERR_BASE+189) /* The broadcast message was truncated. */
+#define NERR_InvalidDevice      (NERR_BASE+194) /* This is an invalid device name. */
+#define NERR_WriteFault         (NERR_BASE+195) /* A write fault occurred. */
+/* UNUSED BASE+196 */
+#define NERR_DuplicateName      (NERR_BASE+197) /* A duplicate message alias exists on the network. */
+#define NERR_DeleteLater        (NERR_BASE+198) /* @W This message alias will be deleted later. */
+#define NERR_IncompleteDel      (NERR_BASE+199) /* The message alias was not successfully deleted from all networks. */
+#define NERR_MultipleNets       (NERR_BASE+200) /* This operation is not supported on computers with multiple networks. */
+
+/*
+ *      Server API related
+ *              Error codes BASE+210 to BASE+229
+ */
+
+#define NERR_NetNameNotFound    (NERR_BASE+210) /* This shared resource does not exist.*/
+#define NERR_DeviceNotShared    (NERR_BASE+211) /* This device is not shared. */
+#define NERR_ClientNameNotFound (NERR_BASE+212) /* A session does not exist with that computer name. */
+#define NERR_FileIdNotFound     (NERR_BASE+214) /* There is not an open file with that identification number. */
+#define NERR_ExecFailure        (NERR_BASE+215) /* A failure occurred when executing a remote administration command. */
+#define NERR_TmpFile            (NERR_BASE+216) /* A failure occurred when opening a remote temporary file. */
+#define NERR_TooMuchData        (NERR_BASE+217) /* The data returned from a remote administration command has been truncated to 64K. */
+#define NERR_DeviceShareConflict (NERR_BASE+218) /* This device cannot be shared as both a spooled and a non-spooled resource. */
+#define NERR_BrowserTableIncomplete (NERR_BASE+219)  /* The information in the list of servers may be incorrect. */
+#define NERR_NotLocalDomain     (NERR_BASE+220) /* The computer is not active in this domain. */
+#define NERR_IsDfsShare         (NERR_BASE+221) /* The share must be removed from the Distributed File System before it can be deleted. */
+
+/*
+ *      CharDev API related
+ *              Error codes BASE+230 to BASE+249
+ */
+
+/* UNUSED BASE+230 */
+#define NERR_DevInvalidOpCode   (NERR_BASE+231) /* The operation is invalid for this device. */
+#define NERR_DevNotFound        (NERR_BASE+232) /* This device cannot be shared. */
+#define NERR_DevNotOpen         (NERR_BASE+233) /* This device was not open. */
+#define NERR_BadQueueDevString  (NERR_BASE+234) /* This device name list is invalid. */
+#define NERR_BadQueuePriority   (NERR_BASE+235) /* The queue priority is invalid. */
+#define NERR_NoCommDevs         (NERR_BASE+237) /* There are no shared communication devices. */
+#define NERR_QueueNotFound      (NERR_BASE+238) /* The queue you specified does not exist. */
+#define NERR_BadDevString       (NERR_BASE+240) /* This list of devices is invalid. */
+#define NERR_BadDev             (NERR_BASE+241) /* The requested device is invalid. */
+#define NERR_InUseBySpooler     (NERR_BASE+242) /* This device is already in use by the spooler. */
+#define NERR_CommDevInUse       (NERR_BASE+243) /* This device is already in use as a communication device. */
+
+/*
+ *      NetICanonicalize and NetIType and NetIMakeLMFileName
+ *      NetIListCanon and NetINameCheck
+ *              Error codes BASE+250 to BASE+269
+ */
+
+#define NERR_InvalidComputer   (NERR_BASE+251) /* This computer name is invalid. */
+/* UNUSED BASE+252 */
+/* UNUSED BASE+253 */
+#define NERR_MaxLenExceeded    (NERR_BASE+254) /* The string and prefix specified are too long. */
+/* UNUSED BASE+255 */
+#define NERR_BadComponent      (NERR_BASE+256) /* This path component is invalid. */
+#define NERR_CantType          (NERR_BASE+257) /* Could not determine the type of input. */
+/* UNUSED BASE+258 */
+/* UNUSED BASE+259 */
+#define NERR_TooManyEntries    (NERR_BASE+262) /* The buffer for types is not big enough. */
+
+/*
+ *      NetProfile
+ *              Error codes BASE+270 to BASE+276
+ */
+
+#define NERR_ProfileFileTooBig  (NERR_BASE+270) /* Profile files cannot exceed 64K. */
+#define NERR_ProfileOffset      (NERR_BASE+271) /* The start offset is out of range. */
+#define NERR_ProfileCleanup     (NERR_BASE+272) /* The system cannot delete current connections to network resources. */
+#define NERR_ProfileUnknownCmd  (NERR_BASE+273) /* The system was unable to parse the command line in this file.*/
+#define NERR_ProfileLoadErr     (NERR_BASE+274) /* An error occurred while loading the profile file. */
+#define NERR_ProfileSaveErr     (NERR_BASE+275) /* @W Errors occurred while saving the profile file.  The profile was partially saved. */
+
+
+/*
+ *      NetAudit and NetErrorLog
+ *              Error codes BASE+277 to BASE+279
+ */
+
+#define NERR_LogOverflow           (NERR_BASE+277)      /* Log file %1 is full. */
+#define NERR_LogFileChanged        (NERR_BASE+278)      /* This log file has changed between reads. */
+#define NERR_LogFileCorrupt        (NERR_BASE+279)      /* Log file %1 is corrupt. */
+
+
+/*
+ *      NetRemote
+ *              Error codes BASE+280 to BASE+299
+ */
+#define NERR_SourceIsDir   (NERR_BASE+280) /* The source path cannot be a directory. */
+#define NERR_BadSource     (NERR_BASE+281) /* The source path is illegal. */
+#define NERR_BadDest       (NERR_BASE+282) /* The destination path is illegal. */
+#define NERR_DifferentServers   (NERR_BASE+283) /* The source and destination paths are on different servers. */
+/* UNUSED BASE+284 */
+#define NERR_RunSrvPaused       (NERR_BASE+285) /* The Run server you requested is paused. */
+/* UNUSED BASE+286 */
+/* UNUSED BASE+287 */
+/* UNUSED BASE+288 */
+#define NERR_ErrCommRunSrv      (NERR_BASE+289) /* An error occurred when communicating with a Run server. */
+/* UNUSED BASE+290 */
+#define NERR_ErrorExecingGhost  (NERR_BASE+291) /* An error occurred when starting a background process. */
+#define NERR_ShareNotFound      (NERR_BASE+292) /* The shared resource you are connected to could not be found.*/
+/* UNUSED BASE+293 */
+/* UNUSED BASE+294 */
+
+
+/*
+ *  NetWksta.sys (redir) returned error codes.
+ *
+ *          NERR_BASE + (300-329)
+ */
+
+#define NERR_InvalidLana        (NERR_BASE+300) /* The LAN adapter number is invalid.  */
+#define NERR_OpenFiles          (NERR_BASE+301) /* There are open files on the connection.    */
+#define NERR_ActiveConns        (NERR_BASE+302) /* Active connections still exist. */
+#define NERR_BadPasswordCore    (NERR_BASE+303) /* This share name or password is invalid. */
+#define NERR_DevInUse           (NERR_BASE+304) /* The device is being accessed by an active process. */
+#define NERR_LocalDrive         (NERR_BASE+305) /* The drive letter is in use locally. */
+
+/*
+ *  Alert error codes.
+ *
+ *          NERR_BASE + (330-339)
+ */
+#define NERR_AlertExists        (NERR_BASE+330) /* The specified client is already registered for the specified event. */
+#define NERR_TooManyAlerts      (NERR_BASE+331) /* The alert table is full. */
+#define NERR_NoSuchAlert        (NERR_BASE+332) /* An invalid or nonexistent alert name was raised. */
+#define NERR_BadRecipient       (NERR_BASE+333) /* The alert recipient is invalid.*/
+#define NERR_AcctLimitExceeded  (NERR_BASE+334) /* A user's session with this server has been deleted
+                                                 * because the user's logon hours are no longer valid. */
+
+/*
+ *  Additional Error and Audit log codes.
+ *
+ *          NERR_BASE +(340-343)
+ */
+#define NERR_InvalidLogSeek     (NERR_BASE+340) /* The log file does not contain the requested record number. */
+/* UNUSED BASE+341 */
+/* UNUSED BASE+342 */
+/* UNUSED BASE+343 */
+
+/*
+ *  Additional UAS and NETLOGON codes
+ *
+ *          NERR_BASE +(350-359)
+ */
+#define NERR_BadUasConfig       (NERR_BASE+350) /* The user accounts database is not configured correctly. */
+#define NERR_InvalidUASOp       (NERR_BASE+351) /* This operation is not permitted when the Netlogon service is running. */
+#define NERR_LastAdmin          (NERR_BASE+352) /* This operation is not allowed on the last administrative account. */
+#define NERR_DCNotFound         (NERR_BASE+353) /* Could not find domain controller for this domain. */
+#define NERR_LogonTrackingError (NERR_BASE+354) /* Could not set logon information for this user. */
+#define NERR_NetlogonNotStarted (NERR_BASE+355) /* The Netlogon service has not been started. */
+#define NERR_CanNotGrowUASFile  (NERR_BASE+356) /* Unable to add to the user accounts database. */
+#define NERR_TimeDiffAtDC       (NERR_BASE+357) /* This server's clock is not synchronized with the primary domain controller's clock. */
+#define NERR_PasswordMismatch   (NERR_BASE+358) /* A password mismatch has been detected. */
+
+
+/*
+ *  Server Integration error codes.
+ *
+ *          NERR_BASE +(360-369)
+ */
+#define NERR_NoSuchServer       (NERR_BASE+360) /* The server identification does not specify a valid server. */
+#define NERR_NoSuchSession      (NERR_BASE+361) /* The session identification does not specify a valid session. */
+#define NERR_NoSuchConnection   (NERR_BASE+362) /* The connection identification does not specify a valid connection. */
+#define NERR_TooManyServers     (NERR_BASE+363) /* There is no space for another entry in the table of available servers. */
+#define NERR_TooManySessions    (NERR_BASE+364) /* The server has reached the maximum number of sessions it supports. */
+#define NERR_TooManyConnections (NERR_BASE+365) /* The server has reached the maximum number of connections it supports. */
+#define NERR_TooManyFiles       (NERR_BASE+366) /* The server cannot open more files because it has reached its maximum number. */
+#define NERR_NoAlternateServers (NERR_BASE+367) /* There are no alternate servers registered on this server. */
+/* UNUSED BASE+368 */
+/* UNUSED BASE+369 */
+
+#define NERR_TryDownLevel       (NERR_BASE+370) /* Try down-level (remote admin protocol) version of API instead. */
+
+/*
+ *  UPS error codes.
+ *
+ *          NERR_BASE + (380-384)
+ */
+#define NERR_UPSDriverNotStarted    (NERR_BASE+380) /* The UPS driver could not be accessed by the UPS service. */
+#define NERR_UPSInvalidConfig       (NERR_BASE+381) /* The UPS service is not configured correctly. */
+#define NERR_UPSInvalidCommPort     (NERR_BASE+382) /* The UPS service could not access the specified Comm Port. */
+#define NERR_UPSSignalAsserted      (NERR_BASE+383) /* The UPS indicated a line fail or low battery situation. Service not started. */
+#define NERR_UPSShutdownFailed      (NERR_BASE+384) /* The UPS service failed to perform a system shut down. */
+
+/*
+ *  Remoteboot error codes.
+ *
+ *          NERR_BASE + (400-419)
+ *          Error codes 400 - 405 are used by RPLBOOT.SYS.
+ *          Error codes 403, 407 - 416 are used by RPLLOADR.COM,
+ *          Error code 417 is the alerter message of REMOTEBOOT (RPLSERVR.EXE).
+ *          Error code 418 is for when REMOTEBOOT can't start
+ *          Error code 419 is for a disallowed 2nd rpl connection
+ *
+ */
+#define NERR_BadDosRetCode      (NERR_BASE+400) /* The program below returned an MS-DOS error code:*/
+#define NERR_ProgNeedsExtraMem  (NERR_BASE+401) /* The program below needs more memory:*/
+#define NERR_BadDosFunction     (NERR_BASE+402) /* The program below called an unsupported MS-DOS function:*/
+#define NERR_RemoteBootFailed   (NERR_BASE+403) /* The workstation failed to boot.*/
+#define NERR_BadFileCheckSum    (NERR_BASE+404) /* The file below is corrupt.*/
+#define NERR_NoRplBootSystem    (NERR_BASE+405) /* No loader is specified in the boot-block definition file.*/
+#define NERR_RplLoadrNetBiosErr (NERR_BASE+406) /* NetBIOS returned an error: The NCB and SMB are dumped above.*/
+#define NERR_RplLoadrDiskErr    (NERR_BASE+407) /* A disk I/O error occurred.*/
+#define NERR_ImageParamErr      (NERR_BASE+408) /* Image parameter substitution failed.*/
+#define NERR_TooManyImageParams (NERR_BASE+409) /* Too many image parameters cross disk sector boundaries.*/
+#define NERR_NonDosFloppyUsed   (NERR_BASE+410) /* The image was not generated from an MS-DOS diskette formatted with /S.*/
+#define NERR_RplBootRestart     (NERR_BASE+411) /* Remote boot will be restarted later.*/
+#define NERR_RplSrvrCallFailed  (NERR_BASE+412) /* The call to the Remoteboot server failed.*/
+#define NERR_CantConnectRplSrvr (NERR_BASE+413) /* Cannot connect to the Remoteboot server.*/
+#define NERR_CantOpenImageFile  (NERR_BASE+414) /* Cannot open image file on the Remoteboot server.*/
+#define NERR_CallingRplSrvr     (NERR_BASE+415) /* Connecting to the Remoteboot server...*/
+#define NERR_StartingRplBoot    (NERR_BASE+416) /* Connecting to the Remoteboot server...*/
+#define NERR_RplBootServiceTerm (NERR_BASE+417) /* Remote boot service was stopped; check the error log for the cause of the problem.*/
+#define NERR_RplBootStartFailed (NERR_BASE+418) /* Remote boot startup failed; check the error log for the cause of the problem.*/
+#define NERR_RPL_CONNECTED      (NERR_BASE+419) /* A second connection to a Remoteboot resource is not allowed.*/
+
+/*
+ *  FTADMIN API error codes
+ *
+ *       NERR_BASE + (425-434)
+ *
+ *       (Currently not used in NT)
+ *
+ */
+
+/*
+ *  Browser service API error codes
+ *
+ *       NERR_BASE + (450-475)
+ *
+ */
+#define NERR_BrowserConfiguredToNotRun     (NERR_BASE+450) /* The browser service was configured with MaintainServerList=No. */
+
+/*
+ *  Additional Remoteboot error codes.
+ *
+ *          NERR_BASE + (510-550)
+ */
+#define NERR_RplNoAdaptersStarted          (NERR_BASE+510) /*Service failed to start since none of the network adapters started with this service.*/
+#define NERR_RplBadRegistry                (NERR_BASE+511) /*Service failed to start due to bad startup information in the registry.*/
+#define NERR_RplBadDatabase                (NERR_BASE+512) /*Service failed to start because its database is absent or corrupt.*/
+#define NERR_RplRplfilesShare              (NERR_BASE+513) /*Service failed to start because RPLFILES share is absent.*/
+#define NERR_RplNotRplServer               (NERR_BASE+514) /*Service failed to start because RPLUSER group is absent.*/
+#define NERR_RplCannotEnum                 (NERR_BASE+515) /*Cannot enumerate service records.*/
+#define NERR_RplWkstaInfoCorrupted         (NERR_BASE+516) /*Workstation record information has been corrupted.*/
+#define NERR_RplWkstaNotFound              (NERR_BASE+517) /*Workstation record was not found.*/
+#define NERR_RplWkstaNameUnavailable       (NERR_BASE+518) /*Workstation name is in use by some other workstation.*/
+#define NERR_RplProfileInfoCorrupted       (NERR_BASE+519) /*Profile record information has been corrupted.*/
+#define NERR_RplProfileNotFound            (NERR_BASE+520) /*Profile record was not found.*/
+#define NERR_RplProfileNameUnavailable     (NERR_BASE+521) /*Profile name is in use by some other profile.*/
+#define NERR_RplProfileNotEmpty            (NERR_BASE+522) /*There are workstations using this profile.*/
+#define NERR_RplConfigInfoCorrupted        (NERR_BASE+523) /*Configuration record information has been corrupted.*/
+#define NERR_RplConfigNotFound             (NERR_BASE+524) /*Configuration record was not found.*/
+#define NERR_RplAdapterInfoCorrupted       (NERR_BASE+525) /*Adapter id record information has been corrupted.*/
+#define NERR_RplInternal                   (NERR_BASE+526) /*An internal service error has occurred.*/
+#define NERR_RplVendorInfoCorrupted        (NERR_BASE+527) /*Vendor id record information has been corrupted.*/
+#define NERR_RplBootInfoCorrupted          (NERR_BASE+528) /*Boot block record information has been corrupted.*/
+#define NERR_RplWkstaNeedsUserAcct         (NERR_BASE+529) /*The user account for this workstation record is missing.*/
+#define NERR_RplNeedsRPLUSERAcct           (NERR_BASE+530) /*The RPLUSER local group could not be found.*/
+#define NERR_RplBootNotFound               (NERR_BASE+531) /*Boot block record was not found.*/
+#define NERR_RplIncompatibleProfile        (NERR_BASE+532) /*Chosen profile is incompatible with this workstation.*/
+#define NERR_RplAdapterNameUnavailable     (NERR_BASE+533) /*Chosen network adapter id is in use by some other workstation.*/
+#define NERR_RplConfigNotEmpty             (NERR_BASE+534) /*There are profiles using this configuration.*/
+#define NERR_RplBootInUse                  (NERR_BASE+535) /*There are workstations, profiles or configurations using this boot block.*/
+#define NERR_RplBackupDatabase             (NERR_BASE+536) /*Service failed to backup Remoteboot database.*/
+#define NERR_RplAdapterNotFound            (NERR_BASE+537) /*Adapter record was not found.*/
+#define NERR_RplVendorNotFound             (NERR_BASE+538) /*Vendor record was not found.*/
+#define NERR_RplVendorNameUnavailable      (NERR_BASE+539) /*Vendor name is in use by some other vendor record.*/
+#define NERR_RplBootNameUnavailable        (NERR_BASE+540) /*(boot name, vendor id) is in use by some other boot block record.*/
+#define NERR_RplConfigNameUnavailable      (NERR_BASE+541) /*Configuration name is in use by some other configuration.*/
+
+/**INTERNAL_ONLY**/
+
+/*
+ *  Dfs API error codes.
+ *
+ *          NERR_BASE + (560-590)
+ */
+
+#define NERR_DfsInternalCorruption         (NERR_BASE+560) /*The internal database maintained by the DFS service is corrupt*/
+#define NERR_DfsVolumeDataCorrupt          (NERR_BASE+561) /*One of the records in the internal DFS database is corrupt*/
+#define NERR_DfsNoSuchVolume               (NERR_BASE+562) /*There is no DFS name whose entry path matches the input Entry Path*/
+#define NERR_DfsVolumeAlreadyExists        (NERR_BASE+563) /*A root or link with the given name already exists*/
+#define NERR_DfsAlreadyShared              (NERR_BASE+564) /*The server share specified is already shared in the DFS*/
+#define NERR_DfsNoSuchShare                (NERR_BASE+565) /*The indicated server share does not support the indicated DFS namespace*/
+#define NERR_DfsNotALeafVolume             (NERR_BASE+566) /*The operation is not valid on this portion of the namespace*/
+#define NERR_DfsLeafVolume                 (NERR_BASE+567) /*The operation is not valid on this portion of the namespace*/
+#define NERR_DfsVolumeHasMultipleServers   (NERR_BASE+568) /*The operation is ambiguous because the link has multiple servers*/
+#define NERR_DfsCantCreateJunctionPoint    (NERR_BASE+569) /*Unable to create a link*/
+#define NERR_DfsServerNotDfsAware          (NERR_BASE+570) /*The server is not DFS Aware*/
+#define NERR_DfsBadRenamePath              (NERR_BASE+571) /*The specified rename target path is invalid*/
+#define NERR_DfsVolumeIsOffline            (NERR_BASE+572) /*The specified DFS link is offline*/
+#define NERR_DfsNoSuchServer               (NERR_BASE+573) /*The specified server is not a server for this link*/
+#define NERR_DfsCyclicalName               (NERR_BASE+574) /*A cycle in the DFS name was detected*/
+#define NERR_DfsNotSupportedInServerDfs    (NERR_BASE+575) /*The operation is not supported on a server-based DFS*/
+#define NERR_DfsDuplicateService           (NERR_BASE+576) /*This link is already supported by the specified server-share*/
+#define NERR_DfsCantRemoveLastServerShare  (NERR_BASE+577) /*Can't remove the last server-share supporting this root or link*/
+#define NERR_DfsVolumeIsInterDfs           (NERR_BASE+578) /*The operation is not supported for an Inter-DFS link*/
+#define NERR_DfsInconsistent               (NERR_BASE+579) /*The internal state of the DFS Service has become inconsistent*/
+#define NERR_DfsServerUpgraded             (NERR_BASE+580) /*The DFS Service has been installed on the specified server*/
+#define NERR_DfsDataIsIdentical            (NERR_BASE+581) /*The DFS data being reconciled is identical*/
+#define NERR_DfsCantRemoveDfsRoot          (NERR_BASE+582) /*The DFS root cannot be deleted - Uninstall DFS if required*/
+#define NERR_DfsChildOrParentInDfs         (NERR_BASE+583) /*A child or parent directory of the share is already in a DFS*/
+#define NERR_DfsInternalError              (NERR_BASE+590) /*DFS internal error*/
+
+/*
+ *  Net setup error codes.
+ *
+ *          NERR_BASE + (591-600)
+ */
+#define NERR_SetupAlreadyJoined            (NERR_BASE+591) /*This machine is already joined to a domain.*/
+#define NERR_SetupNotJoined                (NERR_BASE+592) /*This machine is not currently joined to a domain.*/
+#define NERR_SetupDomainController         (NERR_BASE+593) /*This machine is a domain controller and cannot be unjoined from a domain.*/
+#define NERR_DefaultJoinRequired           (NERR_BASE+594) /*The destination domain controller does not support creating machine accounts in OUs.*/
+#define NERR_InvalidWorkgroupName          (NERR_BASE+595) /*The specified workgroup name is invalid.*/
+#define NERR_NameUsesIncompatibleCodePage  (NERR_BASE+596) /*The specified computer name is incompatible with the default language used on the domain controller.*/
+#define NERR_ComputerAccountNotFound       (NERR_BASE+597) /*The specified computer account could not be found. Contact an administrator to verify the account is in the domain. If the account has been deleted unjoin, reboot, and rejoin the domain.*/
+#define NERR_PersonalSku                   (NERR_BASE+598) /*This version of Windows cannot be joined to a domain.*/
+#define NERR_SetupCheckDNSConfig           (NERR_BASE+599) /*An attempt to resolve the DNS name of a domain controller in the domain being joined has failed.  Please verify this client is configured to reach a DNS server that can resolve DNS names in the target domain. For information about network troubleshooting, see Windows Help.*/
+#define NERR_AlreadyCloudDomainJoined      (NERR_BASE+600) /*This device is joined to Azure AD. To join an Active Directory domain, you must first go to settings and choose to disconnect your device from your work or school.*/
+
+/*
+ *  Some Password and account error results
+ *
+ *          NERR_BASE + (601 - 608)
+*/
+#define NERR_PasswordMustChange            (NERR_BASE + 601)   /* Password must change at next logon */
+#define NERR_AccountLockedOut              (NERR_BASE + 602)   /* Account is locked out */
+#define NERR_PasswordTooLong               (NERR_BASE + 603)   /* Password is too long */
+#define NERR_PasswordNotComplexEnough      (NERR_BASE + 604)   /* Password doesn't meet the complexity policy */
+#define NERR_PasswordFilterError           (NERR_BASE + 605)   /* Password doesn't meet the requirements of the filter dll's */
+
+/*
+ *  Error codes used for offline domain join and completion
+ *
+ *          NERR_BASE + (609 - 621)
+ */
+#define NERR_NoOfflineJoinInfo             (NERR_BASE + 609)   /* Offline join completion information was not found. */
+#define NERR_BadOfflineJoinInfo            (NERR_BASE + 610)   /* The offline join completion information was bad. */
+#define NERR_CantCreateJoinInfo            (NERR_BASE + 611)   /* Unable to create offline join information. Please ensure you have access to the specified path location and permissions to modify its contents. Running as an elevated administrator may be required. */
+#define NERR_BadDomainJoinInfo             (NERR_BASE + 612)   /* The domain join info being saved was incomplete or bad. */
+#define NERR_JoinPerformedMustRestart      (NERR_BASE + 613)   /* Offline join operation successfully completed but a restart is needed. */
+#define NERR_NoJoinPending                 (NERR_BASE + 614)   /* There was no offline join operation pending. */
+#define NERR_ValuesNotSet                  (NERR_BASE + 615)   /* Unable to set one or more requested machine or domain name values on the local computer. */
+#define NERR_CantVerifyHostname            (NERR_BASE + 616)   /* Could not verify the current machine's hostname against the saved value in the join completion information. */
+#define NERR_CantLoadOfflineHive           (NERR_BASE + 617)   /* Unable to load the specified offline registry hive. Please ensure you have access to the specified path location and permissions to modify its contents. Running as an elevated administrator may be required. */
+#define NERR_ConnectionInsecure            (NERR_BASE + 618)   /* The minimum session security requirements for this operation were not met. */
+#define NERR_ProvisioningBlobUnsupported   (NERR_BASE + 619)   /* Computer account provisioning blob version is not supported. */
+#define NERR_DS8DCRequired                 (NERR_BASE + 620)   /* The specified domain controller does not meet the version requirement for this operation. Please select a domain controller capable of issuing claims. */
+#define NERR_LDAPCapableDCRequired         (NERR_BASE + 621)   /* This operation requires a domain controller which supports LDAP. Please select an LDAP-capable domain controller. */
+#define NERR_DS8DCNotFound                 (NERR_BASE + 622)   /* A domain controller which meets the version requirement for this operation could not be located. Please ensure that a domain controller capable of issuing claims is available. */
+#define NERR_TargetVersionUnsupported      (NERR_BASE + 623)   /* The Windows version of the specified image does not support provisioning. */
+#define NERR_InvalidMachineNameForJoin     (NERR_BASE + 624)   /* The machine name is blocked from joining the domain.*/
+#define NERR_DS9DCNotFound                 (NERR_BASE + 625)   /* The domain controller does not meet the version requirement for this operation. See http://go.microsoft.com/fwlink/?LinkId=294288 for more information. */
+#define NERR_PlainTextSecretsRequired      (NERR_BASE + 626)   /* The local machine does not allow querying of LSA secrets in plain-text. */
+#define NERR_CannotUnjoinAadDomain         (NERR_BASE + 627)   /* Unable to leave the Azure AD domain that this machine is joined to. Check the event log for detailed error information. */
+
+
+/***********WARNING ****************
+ *The range 2750-2799 has been     *
+ *allocated to the IBM LAN Server  *
+ ***********************************/
+
+/***********WARNING ****************
+ *The range 2900-2999 has been     *
+ *reserved for Microsoft OEMs      *
+ ***********************************/
+
+/**END_INTERNAL**/
+
+#define MAX_NERR                (NERR_BASE+899) /* This is the last error in NERR range. */
+
+/*
+ * end of list
+ *
+ *    WARNING:  Do not exceed MAX_NERR; values above this are used by
+ *              other error code ranges (errlog.h, service.h, apperr.h).
+ */

ctypes_generation/definitions/defines/network.txt

@@ -8,6 +8,8 @@
 #define DNS_ATMA_MAX_ADDR_LENGTH        ATM_ADDR_SIZE
 
 
+#define DNS_ADDR_MAX_SOCKADDR_LENGTH         (32)
+
 #define DNS_TYPE_ZERO       0x0000
 
 //  RFC 1034/1035
@@ -174,3 +176,16 @@
 #define DNS_QUERY_DNSSEC_CHECKING_DISABLED  0x02000000
 #define DNS_QUERY_RESERVED                  0xf0000000
 
+
+/** IPTypes.h **/
+// Definitions and structures used by getnetworkparams and getadaptersinfo apis
+
+#define MAX_ADAPTER_DESCRIPTION_LENGTH  128 // arb.
+#define MAX_ADAPTER_NAME_LENGTH         256 // arb.
+#define MAX_ADAPTER_ADDRESS_LENGTH      8   // arb.
+#define DEFAULT_MINIMUM_ENTITIES        32  // arb.
+#define MAX_HOSTNAME_LEN                128 // arb.
+#define MAX_DOMAIN_NAME_LEN             128 // arb.
+#define MAX_SCOPE_ID_LEN                256 // arb.
+#define MAX_DHCPV6_DUID_LENGTH          130 // RFC 3315.
+#define MAX_DNS_SUFFIX_STRING_LENGTH    256

ctypes_generation/definitions/defines/registry.txt

@@ -9,3 +9,38 @@
 #define HKEY_CURRENT_CONFIG                 (0x80000005)
 #define HKEY_DYN_DATA                       (0x80000006)
 #define HKEY_CURRENT_USER_LOCAL_SETTINGS    (0x80000007)
+
+/* From: public/sdk/inc/ntregapi.h */
+
+#define REG_OPTION_RESERVED         (0x00000000L)   // Parameter is reserved
+
+#define REG_OPTION_NON_VOLATILE     (0x00000000L)   // Key is preserved
+                                                    // when system is rebooted
+
+#define REG_OPTION_VOLATILE         (0x00000001L)   // Key is not preserved
+                                                    // when system is rebooted
+
+#define REG_OPTION_CREATE_LINK      (0x00000002L)   // Created key is a
+                                                    // symbolic link
+
+#define REG_OPTION_BACKUP_RESTORE   (0x00000004L)   // open for backup or restore
+                                                    // special access rules
+                                                    // privilege required
+
+#define REG_OPTION_OPEN_LINK        (0x00000008L)   // Open symbolic link
+
+#define REG_LEGAL_OPTION            \
+                (REG_OPTION_RESERVED            |\
+                 REG_OPTION_NON_VOLATILE        |\
+                 REG_OPTION_VOLATILE            |\
+                 REG_OPTION_CREATE_LINK         |\
+                 REG_OPTION_BACKUP_RESTORE      |\
+                 REG_OPTION_OPEN_LINK)
+
+
+//
+// hive format to be used by Reg(Nt)SaveKeyEx
+//
+#define REG_STANDARD_FORMAT     1
+#define REG_LATEST_FORMAT       2
+#define REG_NO_COMPRESSION      4

ctypes_generation/definitions/defines/security.txt

@@ -122,3 +122,5 @@
 #define PROTECTED_SACL_SECURITY_INFORMATION     (0x40000000L)
 #define UNPROTECTED_DACL_SECURITY_INFORMATION   (0x20000000L)
 #define UNPROTECTED_SACL_SECURITY_INFORMATION   (0x10000000L)
+
+#define	SECURITY_DESCRIPTOR_REVISION	1

ctypes_generation/definitions/defines/shell.txt

@@ -0,0 +1,26 @@
+// Shell File Operations
+
+#define FO_MOVE                    0x0001
+#define FO_COPY                    0x0002
+#define FO_DELETE                  0x0003
+#define FO_RENAME                  0x0004
+
+
+#define FOF_MULTIDESTFILES         0x0001
+#define FOF_CONFIRMMOUSE           0x0002
+#define FOF_SILENT                 0x0004  // don't display progress UI (confirm prompts may be displayed still)
+#define FOF_RENAMEONCOLLISION      0x0008  // automatically rename the source files to avoid the collisions
+#define FOF_NOCONFIRMATION         0x0010  // don't display confirmation UI, assume "yes" for cases that can be bypassed, "no" for those that can not
+#define FOF_WANTMAPPINGHANDLE      0x0020  // Fill in SHFILEOPSTRUCT.hNameMappings
+                                           // Must be freed using SHFreeNameMappings
+#define FOF_ALLOWUNDO              0x0040  // enable undo including Recycle behavior for IFileOperation::Delete()
+#define FOF_FILESONLY              0x0080  // only operate on the files (non folders), both files and folders are assumed without this
+#define FOF_SIMPLEPROGRESS         0x0100  // means don't show names of files
+#define FOF_NOCONFIRMMKDIR         0x0200  // don't dispplay confirmatino UI before making any needed directories, assume "Yes" in these cases
+#define FOF_NOERRORUI              0x0400  // don't put up error UI, other UI may be displayed, progress, confirmations
+#define FOF_NOCOPYSECURITYATTRIBS  0x0800  // dont copy file security attributes (ACLs)
+#define FOF_NORECURSION            0x1000  // don't recurse into directories for operations that would recurse
+#define FOF_NO_CONNECTED_ELEMENTS  0x2000  // don't operate on connected elements ("xxx_files" folders that go with .htm files)
+#define FOF_WANTNUKEWARNING        0x4000  // during delete operation, warn if object is being permanently destroyed instead of recycling (partially overrides FOF_NOCONFIRMATION)
+#define FOF_NORECURSEREPARSE       0x8000  // deprecated; the operations engine always does the right thing on FolderLink objects (symlinks, reparse points, folder shortcuts)
+#define FOF_NO_UI                   (FOF_SILENT | FOF_NOCONFIRMATION | FOF_NOERRORUI | FOF_NOCONFIRMMKDIR) // don't display any UI at all

ctypes_generation/definitions/defines/windef.txt

@@ -198,38 +198,6 @@
 #define SPECIFIC_RIGHTS_ALL              (0x0000FFFFL)
 
 
-#define AF_UNSPEC       0
-#define AF_UNIX         1
-#define AF_INET         2
-#define AF_IMPLINK      3
-#define AF_PUP          4
-#define AF_CHAOS        5
-#define AF_NS           6
-#define AF_IPX          AF_NS
-#define AF_ISO          7
-#define AF_OSI          AF_ISO
-#define AF_ECMA         8
-#define AF_DATAKIT      9
-#define AF_CCITT        10
-#define AF_SNA          11
-#define AF_DECnet       12
-#define AF_DLI          13
-#define AF_LAT          14
-#define AF_HYLINK       15
-#define AF_APPLETALK    16
-#define AF_NETBIOS      17
-#define AF_VOICEVIEW    18
-#define AF_FIREFOX      19
-#define AF_UNKNOWN1     20
-#define AF_BAN          21
-#define AF_ATM          22
-#define AF_INET6        23
-#define AF_CLUSTER      24
-#define AF_12844        25
-#define AF_IRDA         26
-#define AF_NETDES       28
-
-
 #define EXCEPTION_NONCONTINUABLE 0x1
 #define EXCEPTION_MAXIMUM_PARAMETERS 15
 
@@ -263,59 +231,11 @@
 #define TRUNCATE_EXISTING   5
 
 
-#define FILE_SHARE_READ                 0x00000001
-#define FILE_SHARE_WRITE                0x00000002
-#define FILE_SHARE_DELETE               0x00000004
-#define FILE_ATTRIBUTE_READONLY             0x00000001
-#define FILE_ATTRIBUTE_HIDDEN               0x00000002
-#define FILE_ATTRIBUTE_SYSTEM               0x00000004
-#define FILE_ATTRIBUTE_DIRECTORY            0x00000010
-#define FILE_ATTRIBUTE_ARCHIVE              0x00000020
-#define FILE_ATTRIBUTE_DEVICE               0x00000040
-#define FILE_ATTRIBUTE_NORMAL               0x00000080
-#define FILE_ATTRIBUTE_TEMPORARY            0x00000100
-#define FILE_ATTRIBUTE_SPARSE_FILE          0x00000200
-#define FILE_ATTRIBUTE_REPARSE_POINT        0x00000400
-#define FILE_ATTRIBUTE_COMPRESSED           0x00000800
-#define FILE_ATTRIBUTE_OFFLINE              0x00001000
-#define FILE_ATTRIBUTE_NOT_CONTENT_INDEXED  0x00002000
-#define FILE_ATTRIBUTE_ENCRYPTED            0x00004000
-#define FILE_ATTRIBUTE_VIRTUAL              0x00010000
-#define FILE_NOTIFY_CHANGE_FILE_NAME    0x00000001
-#define FILE_NOTIFY_CHANGE_DIR_NAME     0x00000002
-#define FILE_NOTIFY_CHANGE_ATTRIBUTES   0x00000004
-#define FILE_NOTIFY_CHANGE_SIZE         0x00000008
-#define FILE_NOTIFY_CHANGE_LAST_WRITE   0x00000010
-#define FILE_NOTIFY_CHANGE_LAST_ACCESS  0x00000020
-#define FILE_NOTIFY_CHANGE_CREATION     0x00000040
-#define FILE_NOTIFY_CHANGE_SECURITY     0x00000100
-#define FILE_ACTION_ADDED                   0x00000001
-#define FILE_ACTION_REMOVED                 0x00000002
-#define FILE_ACTION_MODIFIED                0x00000003
-#define FILE_ACTION_RENAMED_OLD_NAME        0x00000004
-#define FILE_ACTION_RENAMED_NEW_NAME        0x00000005
+
+
 #define MAILSLOT_NO_MESSAGE             (-1)
 #define MAILSLOT_WAIT_FOREVER           (-1)
-#define FILE_CASE_SENSITIVE_SEARCH          0x00000001
-#define FILE_CASE_PRESERVED_NAMES           0x00000002
-#define FILE_UNICODE_ON_DISK                0x00000004
-#define FILE_PERSISTENT_ACLS                0x00000008
-#define FILE_FILE_COMPRESSION               0x00000010
-#define FILE_VOLUME_QUOTAS                  0x00000020
-#define FILE_SUPPORTS_SPARSE_FILES          0x00000040
-#define FILE_SUPPORTS_REPARSE_POINTS        0x00000080
-#define FILE_SUPPORTS_REMOTE_STORAGE        0x00000100
-#define FILE_VOLUME_IS_COMPRESSED           0x00008000
-#define FILE_SUPPORTS_OBJECT_IDS            0x00010000
-#define FILE_SUPPORTS_ENCRYPTION            0x00020000
-#define FILE_NAMED_STREAMS                  0x00040000
-#define FILE_READ_ONLY_VOLUME               0x00080000
-#define FILE_SEQUENTIAL_WRITE_ONCE          0x00100000
-#define FILE_SUPPORTS_TRANSACTIONS          0x00200000
-#define FILE_SUPPORTS_HARD_LINKS            0x00400000
-#define FILE_SUPPORTS_EXTENDED_ATTRIBUTES   0x00800000
-#define FILE_SUPPORTS_OPEN_BY_FILE_ID       0x01000000
-#define FILE_SUPPORTS_USN_JOURNAL           0x02000000
+
 
 
 #define RRF_RT_REG_NONE        0x00000001
@@ -385,38 +305,6 @@
 #define IMAGE_FILE_UP_SYSTEM_ONLY            0x4000
 #define IMAGE_FILE_BYTES_REVERSED_HI         0x8000
 
-#define IMAGE_FILE_MACHINE_UNKNOWN           0
-#define IMAGE_FILE_MACHINE_I386              0x014c
-#define IMAGE_FILE_MACHINE_R3000             0x0162
-#define IMAGE_FILE_MACHINE_R4000             0x0166
-#define IMAGE_FILE_MACHINE_R10000            0x0168
-#define IMAGE_FILE_MACHINE_WCEMIPSV2         0x0169
-#define IMAGE_FILE_MACHINE_ALPHA             0x0184
-#define IMAGE_FILE_MACHINE_SH3               0x01a2
-#define IMAGE_FILE_MACHINE_SH3DSP            0x01a3
-#define IMAGE_FILE_MACHINE_SH3E              0x01a4
-#define IMAGE_FILE_MACHINE_SH4               0x01a6
-#define IMAGE_FILE_MACHINE_SH5               0x01a8
-#define IMAGE_FILE_MACHINE_ARM               0x01c0
-#define IMAGE_FILE_MACHINE_THUMB             0x01c2
-#define IMAGE_FILE_MACHINE_ARMNT             0x01c4
-#define IMAGE_FILE_MACHINE_AM33              0x01d3
-#define IMAGE_FILE_MACHINE_POWERPC           0x01F0
-#define IMAGE_FILE_MACHINE_POWERPCFP         0x01f1
-#define IMAGE_FILE_MACHINE_IA64              0x0200
-#define IMAGE_FILE_MACHINE_MIPS16            0x0266
-#define IMAGE_FILE_MACHINE_ALPHA64           0x0284
-#define IMAGE_FILE_MACHINE_MIPSFPU           0x0366
-#define IMAGE_FILE_MACHINE_MIPSFPU16         0x0466
-#define IMAGE_FILE_MACHINE_AXP64             IMAGE_FILE_MACHINE_ALPHA64
-#define IMAGE_FILE_MACHINE_TRICORE           0x0520
-#define IMAGE_FILE_MACHINE_CEF               0x0CEF
-#define IMAGE_FILE_MACHINE_EBC               0x0EBC
-#define IMAGE_FILE_MACHINE_AMD64             0x8664
-#define IMAGE_FILE_MACHINE_M32R              0x9041
-#define IMAGE_FILE_MACHINE_CEE               0xC0EE
-
-
 
 #define SECURITY_MANDATORY_UNTRUSTED_RID            (0x00000000L)
 #define SECURITY_MANDATORY_LOW_RID                  (0x00001000L)

ctypes_generation/definitions/defines/windef_pe.txt

@@ -47,3 +47,57 @@
 #define IMAGE_REL_BASED_MACHINE_SPECIFIC_8    8
 #define IMAGE_REL_BASED_MACHINE_SPECIFIC_9    9
 #define IMAGE_REL_BASED_DIR64                 10
+
+// Security Directory related
+
+#define WIN_CERT_REVISION_1_0               (0x0100)
+#define WIN_CERT_REVISION_2_0               (0x0200)
+
+#define WIN_CERT_TYPE_X509                  (0x0001)   // bCertificate contains an X.509 Certificate
+#define WIN_CERT_TYPE_PKCS_SIGNED_DATA      (0x0002)   // bCertificate contains a PKCS SignedData structure
+#define WIN_CERT_TYPE_RESERVED_1            (0x0003)   // Reserved
+#define WIN_CERT_TYPE_TS_STACK_SIGNED       (0x0004)   // Terminal Server Protocol Stack Certificate signing
+
+// Optional Header related
+
+#define IMAGE_SIZEOF_ROM_OPTIONAL_HEADER      56
+#define IMAGE_SIZEOF_STD_OPTIONAL_HEADER      28
+#define IMAGE_SIZEOF_NT_OPTIONAL32_HEADER    224
+#define IMAGE_SIZEOF_NT_OPTIONAL64_HEADER    240
+
+#define IMAGE_NT_OPTIONAL_HDR32_MAGIC      0x10b
+#define IMAGE_NT_OPTIONAL_HDR64_MAGIC      0x20b
+#define IMAGE_ROM_OPTIONAL_HDR_MAGIC       0x107
+
+
+#define IMAGE_FILE_MACHINE_UNKNOWN           0
+#define IMAGE_FILE_MACHINE_I386              0x014c
+#define IMAGE_FILE_MACHINE_R3000             0x0162
+#define IMAGE_FILE_MACHINE_R4000             0x0166
+#define IMAGE_FILE_MACHINE_R10000            0x0168
+#define IMAGE_FILE_MACHINE_WCEMIPSV2         0x0169
+#define IMAGE_FILE_MACHINE_ALPHA             0x0184
+#define IMAGE_FILE_MACHINE_SH3               0x01a2
+#define IMAGE_FILE_MACHINE_SH3DSP            0x01a3
+#define IMAGE_FILE_MACHINE_SH3E              0x01a4
+#define IMAGE_FILE_MACHINE_SH4               0x01a6
+#define IMAGE_FILE_MACHINE_SH5               0x01a8
+#define IMAGE_FILE_MACHINE_ARM               0x01c0
+#define IMAGE_FILE_MACHINE_THUMB             0x01c2
+#define IMAGE_FILE_MACHINE_ARMNT             0x01c4
+#define IMAGE_FILE_MACHINE_AM33              0x01d3
+#define IMAGE_FILE_MACHINE_POWERPC           0x01F0
+#define IMAGE_FILE_MACHINE_POWERPCFP         0x01f1
+#define IMAGE_FILE_MACHINE_IA64              0x0200
+#define IMAGE_FILE_MACHINE_MIPS16            0x0266
+#define IMAGE_FILE_MACHINE_ALPHA64           0x0284
+#define IMAGE_FILE_MACHINE_MIPSFPU           0x0366
+#define IMAGE_FILE_MACHINE_MIPSFPU16         0x0466
+#define IMAGE_FILE_MACHINE_AXP64             IMAGE_FILE_MACHINE_ALPHA64
+#define IMAGE_FILE_MACHINE_TRICORE           0x0520
+#define IMAGE_FILE_MACHINE_CEF               0x0CEF
+#define IMAGE_FILE_MACHINE_EBC               0x0EBC
+#define IMAGE_FILE_MACHINE_AMD64             0x8664
+#define IMAGE_FILE_MACHINE_M32R              0x9041
+#define IMAGE_FILE_MACHINE_CEE               0xC0EE
+#define IMAGE_FILE_MACHINE_ARM64             0xAA64

ctypes_generation/definitions/defines/wsocket.txt

@@ -0,0 +1,100 @@
+#define WSADESCRIPTION_LEN      256
+#define WSASYS_STATUS_LEN       128
+#define WSAPROTOCOL_LEN  255
+#define MAX_PROTOCOL_CHAIN 7
+#define BASE_PROTOCOL      1
+#define LAYERED_PROTOCOL   0
+
+
+// INVALID_SOCKET  (SOCKET)(~0) // will change in 32 & 64 bits..
+// The final INVALID_SOCKET is setuped in __init__.py of generated def
+#define INVALID_SOCKET32   (0xffffffff)
+#define INVALID_SOCKET64   (0xffffffffffffffff)
+
+#define SOCKET_ERROR            (-1)
+
+
+/*
+ * Constants and structures defined by the internet system,
+ * Per RFC 790, September 1981, taken from the BSD file netinet/in.h.
+ */
+
+
+/*
+ * Types
+ */
+#define SOCK_STREAM     1               /* stream socket */
+#define SOCK_DGRAM      2               /* datagram socket */
+#define SOCK_RAW        3               /* raw-protocol interface */
+#define SOCK_RDM        4               /* reliably-delivered message */
+#define SOCK_SEQPACKET  5               /* sequenced packet stream */
+
+/*
+ * Protocols
+ */
+#define IPPROTO_IP              0               /* dummy for IP */
+#define IPPROTO_ICMP            1               /* control message protocol */
+#define IPPROTO_IGMP            2               /* group management protocol */
+#define IPPROTO_GGP             3               /* gateway^2 (deprecated) */
+#define IPPROTO_TCP             6               /* tcp */
+#define IPPROTO_PUP             12              /* pup */
+#define IPPROTO_UDP             17              /* user datagram protocol */
+#define IPPROTO_IDP             22              /* xns idp */
+#define IPPROTO_ND              77              /* UNOFFICIAL net disk proto */
+
+#define IPPROTO_RAW             255             /* raw IP packet */
+#define IPPROTO_MAX             256
+
+
+/*
+ * Port/socket numbers: network standard functions
+ */
+#define IPPORT_ECHO             7
+#define IPPORT_DISCARD          9
+#define IPPORT_SYSTAT           11
+#define IPPORT_DAYTIME          13
+#define IPPORT_NETSTAT          15
+#define IPPORT_FTP              21
+#define IPPORT_TELNET           23
+#define IPPORT_SMTP             25
+#define IPPORT_TIMESERVER       37
+#define IPPORT_NAMESERVER       42
+#define IPPORT_WHOIS            43
+#define IPPORT_MTP              57
+
+
+/*
+ * Address families.
+ */
+#define AF_UNSPEC       0               /* unspecified */
+#define AF_UNIX         1               /* local to host (pipes, portals) */
+#define AF_INET         2               /* internetwork: UDP, TCP, etc. */
+#define AF_IMPLINK      3               /* arpanet imp addresses */
+#define AF_PUP          4               /* pup protocols: e.g. BSP */
+#define AF_CHAOS        5               /* mit CHAOS protocols */
+#define AF_IPX          6               /* IPX and SPX */
+#define AF_NS           6               /* XEROX NS protocols */
+#define AF_ISO          7               /* ISO protocols */
+#define AF_OSI          AF_ISO          /* OSI is ISO */
+#define AF_ECMA         8               /* european computer manufacturers */
+#define AF_DATAKIT      9               /* datakit protocols */
+#define AF_CCITT        10              /* CCITT protocols, X.25 etc */
+#define AF_SNA          11              /* IBM SNA */
+#define AF_DECnet       12              /* DECnet */
+#define AF_DLI          13              /* Direct data link interface */
+#define AF_LAT          14              /* LAT */
+#define AF_HYLINK       15              /* NSC Hyperchannel */
+#define AF_APPLETALK    16              /* AppleTalk */
+#define AF_NETBIOS      17              /* NetBios-style addresses */
+#define AF_VOICEVIEW    18              /* VoiceView */
+#define AF_FIREFOX      19              /* FireFox */
+#define AF_UNKNOWN1     20              /* Somebody is using this! */
+#define AF_BAN          21              /* Banyan */
+#define AF_ATM          22
+#define AF_INET6        23
+#define AF_CLUSTER      24
+#define AF_12844        25
+#define AF_IRDA         26
+#define AF_NETDES       28
+
+#define AF_MAX          22

ctypes_generation/definitions/functions/com.txt

@@ -57,3 +57,86 @@ HRESULT WINAPI CLSIDFromProgID(
 PVOID  CoTaskMemFree(
   LPVOID pv
 );
+
+
+LPSAFEARRAY SafeArrayCreate(
+  [in] VARTYPE        vt,
+  [in] UINT           cDims,
+  [in] SAFEARRAYBOUND *rgsabound
+);
+
+LPSAFEARRAY SafeArrayCreateVector(
+  [in] VARTYPE vt,
+  [in] LONG    lLbound,
+  [in] ULONG   cElements
+);
+
+
+HRESULT SafeArrayDestroy(
+  [in] SAFEARRAY *psa
+);
+
+
+HRESULT SafeArrayDestroyData(
+  [in] SAFEARRAY *psa
+);
+
+HRESULT SafeArrayGetElement(
+  [in]  SAFEARRAY *psa,
+  [in]  LONG      *rgIndices,
+  [out] VOID      *pv
+);
+
+UINT SafeArrayGetElemsize(
+  [in] SAFEARRAY *psa
+);
+
+HRESULT SafeArrayGetLBound(
+  [in]  SAFEARRAY *psa,
+  [in]  UINT      nDim,
+  [out] LONG      *plLbound
+);
+
+HRESULT SafeArrayGetUBound(
+  [in]  SAFEARRAY *psa,
+  [in]  UINT      nDim,
+  [out] LONG      *plUbound
+);
+
+UINT SafeArrayGetDim(
+  [in] SAFEARRAY *psa
+);
+
+HRESULT SafeArrayPutElement(
+  [in] SAFEARRAY *psa,
+  [in] LONG      *rgIndices,
+  [in] VOID      *pv
+);
+
+HRESULT SafeArrayGetVartype(
+  [in]  SAFEARRAY *psa,
+  [out] VARTYPE   *pvt
+);
+
+VOID SysFreeString(
+  [in, optional] BSTR bstrString
+);
+
+HRESULT SafeArrayCopy(
+  [in]  SAFEARRAY   *psa,
+  [out] LPSAFEARRAY *ppsaOut
+);
+
+HRESULT SafeArrayCopyData(
+  [in] SAFEARRAY *psaSource,
+  [in] SAFEARRAY *psaTarget
+);
+
+
+PVOID SysAllocString(
+  [in, optional] OLECHAR *psz
+);
+
+VOID SysFreeString(
+  [in, optional] BSTR bstrString
+);

ctypes_generation/definitions/functions/crypto_wintrust.txt

@@ -258,6 +258,98 @@ BOOL WINAPI CryptReleaseContext(
   _In_ DWORD      dwFlags
 );
 
+
+BOOL CryptCreateHash(
+  HCRYPTPROV hProv,
+  ALG_ID     Algid,
+  HCRYPTKEY  hKey,
+  DWORD      dwFlags,
+  HCRYPTHASH *phHash
+);
+
+BOOL CryptHashData(
+  HCRYPTHASH hHash,
+  BYTE *pbData,
+  DWORD      dwDataLen,
+  DWORD      dwFlags
+);
+
+BOOL CryptGetHashParam(
+  HCRYPTHASH hHash,
+  DWORD      dwParam,
+  BYTE       *pbData,
+  DWORD      *pdwDataLen,
+  DWORD      dwFlags
+);
+
+BOOL CryptVerifySignatureA(
+  HCRYPTHASH hHash,
+  BYTE *pbSignature,
+  DWORD      dwSigLen,
+  HCRYPTKEY  hPubKey,
+  LPCSTR     szDescription,
+  DWORD      dwFlags
+);
+
+BOOL CryptVerifySignatureW(
+  HCRYPTHASH hHash,
+  BYTE *pbSignature,
+  DWORD      dwSigLen,
+  HCRYPTKEY  hPubKey,
+  LPCWSTR    szDescription,
+  DWORD      dwFlags
+);
+
+BOOL CryptSignHashA(
+  HCRYPTHASH hHash,
+  DWORD      dwKeySpec,
+  LPCSTR     szDescription,
+  DWORD      dwFlags,
+  BYTE       *pbSignature,
+  DWORD      *pdwSigLen
+);
+
+
+BOOL CryptSignHashW(
+  HCRYPTHASH hHash,
+  DWORD      dwKeySpec,
+  LPCWSTR    szDescription,
+  DWORD      dwFlags,
+  BYTE       *pbSignature,
+  DWORD      *pdwSigLen
+);
+
+BOOL CryptDestroyHash(
+  HCRYPTHASH hHash
+);
+
+BOOL CryptEncrypt(
+  HCRYPTKEY  hKey,
+  HCRYPTHASH hHash,
+  BOOL       Final,
+  DWORD      dwFlags,
+  BYTE       *pbData,
+  DWORD      *pdwDataLen,
+  DWORD      dwBufLen
+);
+
+BOOL CryptDecrypt(
+  HCRYPTKEY  hKey,
+  HCRYPTHASH hHash,
+  BOOL       Final,
+  DWORD      dwFlags,
+  BYTE       *pbData,
+  DWORD      *pdwDataLen
+);
+
+BOOL CryptDeriveKey(
+  HCRYPTPROV hProv,
+  ALG_ID     Algid,
+  HCRYPTHASH hBaseData,
+  DWORD      dwFlags,
+  HCRYPTKEY  *phKey
+);
+
 BOOL WINAPI CryptExportKey(
   _In_    HCRYPTKEY hKey,
   _In_    HCRYPTKEY hExpKey,
@@ -267,6 +359,14 @@ BOOL WINAPI CryptExportKey(
   _Inout_ DWORD     *pdwDataLen
 );
 
+BOOL CryptImportKey(
+  HCRYPTPROV hProv,
+  BYTE *pbData,
+  DWORD      dwDataLen,
+  HCRYPTKEY  hPubKey,
+  DWORD      dwFlags,
+  HCRYPTKEY  *phKey
+);
 
 BOOL WINAPI CertGetCertificateContextProperty(
   _In_    PCCERT_CONTEXT pCertContext,

ctypes_generation/definitions/functions/dpapi.txt

@@ -0,0 +1,31 @@
+BOOL CryptProtectData(
+  DATA_BLOB                 *pDataIn,
+  LPCWSTR                   szDataDescr,
+  DATA_BLOB                 *pOptionalEntropy,
+  PVOID                     pvReserved,
+  CRYPTPROTECT_PROMPTSTRUCT *pPromptStruct,
+  DWORD                     dwFlags,
+  DATA_BLOB                 *pDataOut
+);
+
+BOOL CryptUnprotectData(
+  DATA_BLOB                 *pDataIn,
+  LPWSTR                    *ppszDataDescr,
+  DATA_BLOB                 *pOptionalEntropy,
+  PVOID                     pvReserved,
+  CRYPTPROTECT_PROMPTSTRUCT *pPromptStruct,
+  DWORD                     dwFlags,
+  DATA_BLOB                 *pDataOut
+);
+
+BOOL CryptProtectMemory(
+  LPVOID pDataIn,
+  DWORD  cbDataIn,
+  DWORD  dwFlags
+);
+
+BOOL CryptUnprotectMemory(
+  LPVOID pDataIn,
+  DWORD  cbDataIn,
+  DWORD  dwFlags
+);

ctypes_generation/definitions/functions/environ.txt

@@ -0,0 +1,38 @@
+DWORD GetEnvironmentVariableA(
+  [in, optional]  LPCSTR lpName,
+  [out, optional] LPSTR  lpBuffer,
+  [in]            DWORD  nSize
+);
+
+DWORD GetEnvironmentVariableW(
+  [in, optional]  LPCWSTR lpName,
+  [out, optional] LPWSTR  lpBuffer,
+  [in]            DWORD   nSize
+);
+
+
+BOOL SetEnvironmentVariableA(
+  [in]           LPCSTR lpName,
+  [in, optional] LPCSTR lpValue
+);
+
+BOOL SetEnvironmentVariableW(
+  [in]           LPCWSTR lpName,
+  [in, optional] LPCWSTR lpValue
+);
+
+PVOID GetEnvironmentStringsA();
+
+PVOID GetEnvironmentStringsW();
+
+BOOL SetEnvironmentStringsW(
+  LPWCH NewEnvironment
+);
+
+BOOL FreeEnvironmentStringsA(
+  PVOID penv
+);
+
+BOOL FreeEnvironmentStringsW(
+  PVOID penv
+);

ctypes_generation/definitions/functions/file.txt

@@ -24,3 +24,67 @@ BOOL FindNextFileW(
 BOOL FindClose(
   HANDLE hFindFile
 );
+
+HANDLE FindFirstChangeNotificationA(
+  LPCSTR lpPathName,
+  BOOL   bWatchSubtree,
+  DWORD  dwNotifyFilter
+);
+
+HANDLE FindFirstChangeNotificationW(
+  LPCWSTR lpPathName,
+  BOOL    bWatchSubtree,
+  DWORD   dwNotifyFilter
+);
+
+BOOL FindNextChangeNotification(
+  HANDLE hChangeHandle
+);
+
+BOOL FindCloseChangeNotification(
+  HANDLE hChangeHandle
+);
+
+BOOL FindNextChangeNotification(
+  HANDLE hChangeHandle
+);
+
+BOOL ReadDirectoryChangesW(
+  HANDLE                          hDirectory,
+  LPVOID                          lpBuffer,
+  DWORD                           nBufferLength,
+  BOOL                            bWatchSubtree,
+  DWORD                           dwNotifyFilter,
+  LPDWORD                         lpBytesReturned,
+  LPOVERLAPPED                    lpOverlapped,
+  LPOVERLAPPED_COMPLETION_ROUTINE lpCompletionRoutine
+);
+
+BOOL ReadDirectoryChangesExW(
+  HANDLE                                  hDirectory,
+  LPVOID                                  lpBuffer,
+  DWORD                                   nBufferLength,
+  BOOL                                    bWatchSubtree,
+  DWORD                                   dwNotifyFilter,
+  LPDWORD                                 lpBytesReturned,
+  LPOVERLAPPED                            lpOverlapped,
+  LPOVERLAPPED_COMPLETION_ROUTINE         lpCompletionRoutine,
+  READ_DIRECTORY_NOTIFY_INFORMATION_CLASS ReadDirectoryNotifyInformationClass
+);
+
+BOOL LockFile(
+  [in] HANDLE hFile,
+  [in] DWORD  dwFileOffsetLow,
+  [in] DWORD  dwFileOffsetHigh,
+  [in] DWORD  nNumberOfBytesToLockLow,
+  [in] DWORD  nNumberOfBytesToLockHigh
+);
+
+BOOL LockFileEx(
+  [in]      HANDLE       hFile,
+  [in]      DWORD        dwFlags,
+            DWORD        dwReserved,
+  [in]      DWORD        nNumberOfBytesToLockLow,
+  [in]      DWORD        nNumberOfBytesToLockHigh,
+  [in, out] LPOVERLAPPED lpOverlapped
+);

ctypes_generation/definitions/functions/internet.txt

@@ -0,0 +1,253 @@
+BOOL InternetCheckConnectionA(
+  LPCSTR lpszUrl,
+  DWORD  dwFlags,
+  DWORD  dwReserved
+);
+
+BOOL InternetCheckConnectionW(
+  LPCWSTR lpszUrl,
+  DWORD   dwFlags,
+  DWORD   dwReserved
+);
+
+
+HINTERNET InternetOpenA(
+  LPCSTR lpszAgent,
+  DWORD  dwAccessType,
+  LPCSTR lpszProxy,
+  LPCSTR lpszProxyBypass,
+  DWORD  dwFlags
+);
+
+HINTERNET InternetOpenW(
+  LPCWSTR lpszAgent,
+  DWORD   dwAccessType,
+  LPCWSTR lpszProxy,
+  LPCWSTR lpszProxyBypass,
+  DWORD   dwFlags
+);
+
+HINTERNET InternetOpenUrlA(
+  HINTERNET hInternet,
+  LPCSTR    lpszUrl,
+  LPCSTR    lpszHeaders,
+  DWORD     dwHeadersLength,
+  DWORD     dwFlags,
+  DWORD_PTR dwContext
+);
+
+HINTERNET InternetOpenUrlW(
+  HINTERNET hInternet,
+  LPCWSTR   lpszUrl,
+  LPCWSTR   lpszHeaders,
+  DWORD     dwHeadersLength,
+  DWORD     dwFlags,
+  DWORD_PTR dwContext
+);
+
+HINTERNET InternetConnectA(
+  HINTERNET     hInternet,
+  LPCSTR        lpszServerName,
+  INTERNET_PORT nServerPort,
+  LPCSTR        lpszUserName,
+  LPCSTR        lpszPassword,
+  DWORD         dwService,
+  DWORD         dwFlags,
+  DWORD_PTR     dwContext
+);
+
+
+HINTERNET InternetConnectW(
+  HINTERNET     hInternet,
+  LPCWSTR       lpszServerName,
+  INTERNET_PORT nServerPort,
+  LPCWSTR       lpszUserName,
+  LPCWSTR       lpszPassword,
+  DWORD         dwService,
+  DWORD         dwFlags,
+  DWORD_PTR     dwContext
+);
+
+HINTERNET HttpOpenRequestA(
+  HINTERNET hConnect,
+  LPCSTR    lpszVerb,
+  LPCSTR    lpszObjectName,
+  LPCSTR    lpszVersion,
+  LPCSTR    lpszReferrer,
+  LPCSTR    *lplpszAcceptTypes,
+  DWORD     dwFlags,
+  DWORD_PTR dwContext
+);
+
+HINTERNET HttpOpenRequestW(
+  HINTERNET hConnect,
+  LPCWSTR   lpszVerb,
+  LPCWSTR   lpszObjectName,
+  LPCWSTR   lpszVersion,
+  LPCWSTR   lpszReferrer,
+  LPCWSTR   *lplpszAcceptTypes,
+  DWORD     dwFlags,
+  DWORD_PTR dwContext
+);
+
+BOOL InternetSetOptionA(
+  HINTERNET hInternet,
+  DWORD     dwOption,
+  LPVOID    lpBuffer,
+  DWORD     dwBufferLength
+);
+
+BOOL InternetSetOptionW(
+  HINTERNET hInternet,
+  DWORD     dwOption,
+  LPVOID    lpBuffer,
+  DWORD     dwBufferLength
+);
+
+BOOL HttpSendRequestA(
+  HINTERNET hRequest,
+  LPCSTR    lpszHeaders,
+  DWORD     dwHeadersLength,
+  LPVOID    lpOptional,
+  DWORD     dwOptionalLength
+);
+
+BOOL HttpSendRequestW(
+  HINTERNET hRequest,
+  LPCWSTR   lpszHeaders,
+  DWORD     dwHeadersLength,
+  LPVOID    lpOptional,
+  DWORD     dwOptionalLength
+);
+
+BOOL InternetReadFile(
+  HINTERNET hFile,
+  LPVOID    lpBuffer,
+  DWORD     dwNumberOfBytesToRead,
+  LPDWORD   lpdwNumberOfBytesRead
+);
+
+
+BOOL InternetReadFileExA(
+  HINTERNET           hFile,
+  LPINTERNET_BUFFERSA lpBuffersOut,
+  DWORD               dwFlags,
+  DWORD_PTR           dwContext
+);
+
+BOOL InternetReadFileExW(
+  HINTERNET           hFile,
+  LPINTERNET_BUFFERSW lpBuffersOut,
+  DWORD               dwFlags,
+  DWORD_PTR           dwContext
+);
+
+BOOL HttpQueryInfoA(
+  HINTERNET hRequest,
+  DWORD     dwInfoLevel,
+  LPVOID    lpBuffer,
+  LPDWORD   lpdwBufferLength,
+  LPDWORD   lpdwIndex
+);
+
+BOOL HttpQueryInfoW(
+  HINTERNET hRequest,
+  DWORD     dwInfoLevel,
+  LPVOID    lpBuffer,
+  LPDWORD   lpdwBufferLength,
+  LPDWORD   lpdwIndex
+);
+
+BOOL HttpSendRequestA(
+  HINTERNET hRequest,
+  LPCSTR    lpszHeaders,
+  DWORD     dwHeadersLength,
+  LPVOID    lpOptional,
+  DWORD     dwOptionalLength
+);
+
+BOOL HttpSendRequestW(
+  HINTERNET hRequest,
+  LPCWSTR   lpszHeaders,
+  DWORD     dwHeadersLength,
+  LPVOID    lpOptional,
+  DWORD     dwOptionalLength
+);
+
+
+/// WinHTTP
+
+HINTERNET WinHttpOpen(
+  LPCWSTR pszAgentW,
+  DWORD   dwAccessType,
+  LPCWSTR pszProxyW,
+  LPCWSTR pszProxyBypassW,
+  DWORD   dwFlags
+);
+
+BOOL WinHttpCloseHandle(
+  HINTERNET hInternet
+);
+
+
+HINTERNET WinHttpConnect(
+  HINTERNET     hSession,
+  LPCWSTR       pswzServerName,
+  INTERNET_PORT nServerPort,
+  DWORD         dwReserved
+);
+
+
+BOOL WinHttpQueryDataAvailable(
+  HINTERNET hRequest,
+  LPDWORD   lpdwNumberOfBytesAvailable
+);
+
+BOOL WinHttpReadData(
+  HINTERNET hRequest,
+  LPVOID    lpBuffer,
+  DWORD     dwNumberOfBytesToRead,
+  LPDWORD   lpdwNumberOfBytesRead
+);
+
+HINTERNET WinHttpOpenRequest(
+  HINTERNET hConnect,
+  LPCWSTR   pwszVerb,
+  LPCWSTR   pwszObjectName,
+  LPCWSTR   pwszVersion,
+  LPCWSTR   pwszReferrer,
+  LPCWSTR   *ppwszAcceptTypes,
+  DWORD     dwFlags
+);
+
+
+BOOL WinHttpSendRequest(
+  HINTERNET hRequest,
+  LPCWSTR   lpszHeaders,
+  DWORD     dwHeadersLength,
+  LPVOID    lpOptional,
+  DWORD     dwOptionalLength,
+  DWORD     dwTotalLength,
+  DWORD_PTR dwContext
+);
+
+BOOL WinHttpReceiveResponse(
+  HINTERNET hRequest,
+  LPVOID    lpReserved
+);
+
+BOOL WinHttpAddRequestHeaders(
+  HINTERNET hRequest,
+  LPCWSTR   lpszHeaders,
+  DWORD     dwHeadersLength,
+  DWORD     dwModifiers
+);
+
+BOOL WinHttpQueryHeaders(
+  HINTERNET hRequest,
+  DWORD     dwInfoLevel,
+  LPCWSTR   pwszName,
+  LPVOID    lpBuffer,
+  LPDWORD   lpdwBufferLength,
+  LPDWORD   lpdwIndex
+);

ctypes_generation/definitions/functions/memoryapi.txt

@@ -0,0 +1,18 @@
+
+HANDLE OpenFileMappingW(
+  DWORD   dwDesiredAccess,
+  BOOL    bInheritHandle,
+  LPCWSTR lpName
+);
+
+HANDLE OpenFileMappingA(
+  DWORD  dwDesiredAccess,
+  BOOL   bInheritHandle,
+  LPCSTR lpName
+);
+
+BOOL UnmapViewOfFile(
+  LPCVOID lpBaseAddress
+);
+
+

ctypes_generation/definitions/functions/netapi.txt

@@ -0,0 +1,109 @@
+NET_API_STATUS NetLocalGroupGetMembers(
+  [in]      LPCWSTR    servername,
+  [in]      LPCWSTR    localgroupname,
+  [in]      DWORD      level,
+  [out]     LPBYTE     *bufptr,
+  [in]      DWORD      prefmaxlen,
+  [out]     LPDWORD    entriesread,
+  [out]     LPDWORD    totalentries,
+  [in, out] PDWORD_PTR resumehandle
+);
+
+NET_API_STATUS NetQueryDisplayInformation(
+  [in]  LPCWSTR ServerName,
+  [in]  DWORD   Level,
+  [in]  DWORD   Index,
+  [in]  DWORD   EntriesRequested,
+  [in]  DWORD   PreferredMaximumLength,
+  [out] LPDWORD ReturnedEntryCount,
+  [out] PVOID   *SortedBuffer
+);
+
+NET_API_STATUS NetUserEnum(
+  [in]      LPCWSTR servername,
+  [in]      DWORD   level,
+  [in]      DWORD   filter,
+  [out]     LPBYTE  *bufptr,
+  [in]      DWORD   prefmaxlen,
+  [out]     LPDWORD entriesread,
+  [out]     LPDWORD totalentries,
+  [in, out] PDWORD  resume_handle
+);
+
+NET_API_STATUS NetGroupEnum(
+  [in]      LPCWSTR    servername,
+  [in]      DWORD      level,
+  [out]     LPBYTE     *bufptr,
+  [in]      DWORD      prefmaxlen,
+  [out]     LPDWORD    entriesread,
+  [out]     LPDWORD    totalentries,
+  [in, out] PDWORD_PTR resume_handle
+);
+
+NET_API_STATUS NetGroupGetInfo(
+  [in]  LPCWSTR servername,
+  [in]  LPCWSTR groupname,
+  [in]  DWORD   level,
+  [out] LPBYTE  *bufptr
+);
+
+NET_API_STATUS NetGroupGetUsers(
+  [in]      LPCWSTR    servername,
+  [in]      LPCWSTR    groupname,
+  [in]      DWORD      level,
+  [out]     LPBYTE     *bufptr,
+  [in]      DWORD      prefmaxlen,
+  [out]     LPDWORD    entriesread,
+  [out]     LPDWORD    totalentries,
+  [in, out] PDWORD_PTR ResumeHandle
+);
+
+NET_API_STATUS NetLocalGroupEnum(
+  [in]      LPCWSTR    servername,
+  [in]      DWORD      level,
+  [out]     LPBYTE     *bufptr,
+  [in]      DWORD      prefmaxlen,
+  [out]     LPDWORD    entriesread,
+  [out]     LPDWORD    totalentries,
+  [in, out] PDWORD_PTR resumehandle
+);
+
+NET_API_STATUS NetLocalGroupGetInfo(
+  [in]  LPCWSTR servername,
+  [in]  LPCWSTR groupname,
+  [in]  DWORD   level,
+  [out] LPBYTE  *bufptr
+);
+
+NET_API_STATUS NetLocalGroupGetMembers(
+  [in]      LPCWSTR    servername,
+  [in]      LPCWSTR    localgroupname,
+  [in]      DWORD      level,
+  [out]     LPBYTE     *bufptr,
+  [in]      DWORD      prefmaxlen,
+  [out]     LPDWORD    entriesread,
+  [out]     LPDWORD    totalentries,
+  [in, out] PDWORD_PTR resumehandle
+);
+
+NET_API_STATUS NetLocalGroupGetInfo(
+  [in]  LPCWSTR servername,
+  [in]  LPCWSTR groupname,
+  [in]  DWORD   level,
+  [out] LPBYTE  *bufptr
+);
+
+NET_API_STATUS NetLocalGroupEnum(
+  [in]      LPCWSTR    servername,
+  [in]      DWORD      level,
+  [out]     LPBYTE     *bufptr,
+  [in]      DWORD      prefmaxlen,
+  [out]     LPDWORD    entriesread,
+  [out]     LPDWORD    totalentries,
+  [in, out] PDWORD_PTR resumehandle
+);
+
+
+NET_API_STATUS NetApiBufferFree(
+  [in] LPVOID Buffer
+);

ctypes_generation/definitions/functions/netip.txt

@@ -0,0 +1,5 @@
+ULONG GetIpNetTable(
+  PMIB_IPNETTABLE IpNetTable,
+  PULONG          SizePointer,
+  BOOL            Order
+);

ctypes_generation/definitions/functions/network.txt

@@ -60,3 +60,21 @@ DNS_STATUS DnsQuery_W(
 //   PDNS_RECORD *ppQueryResults,
 //   PVOID       *pReserved
 // );
+
+
+DNS_STATUS DnsQueryEx(
+  PDNS_QUERY_REQUEST pQueryRequest,
+  PDNS_QUERY_RESULT  pQueryResults,
+  PDNS_QUERY_CANCEL  pCancelHandle
+);
+
+ULONG GetAdaptersInfo(
+  [out]     PIP_ADAPTER_INFO AdapterInfo,
+  [in, out] PULONG           SizePointer
+);
+
+DWORD GetPerAdapterInfo(
+  [in]  ULONG                IfIndex,
+  [out] PIP_PER_ADAPTER_INFO pPerAdapterInfo,
+  [in]  PULONG               pOutBufLen
+);

ctypes_generation/definitions/functions/process.txt

@@ -0,0 +1,66 @@
+
+HANDLE WINAPI CreateToolhelp32Snapshot(
+  _In_  DWORD dwFlags,
+  _In_  DWORD th32ProcessID
+);
+
+BOOL WINAPI Thread32First(
+  _In_     HANDLE hSnapshot,
+  _Inout_  LPTHREADENTRY32 lpte
+);
+
+BOOL WINAPI Thread32Next(
+  _In_   HANDLE hSnapshot,
+  _Out_  LPTHREADENTRY32 lpte
+);
+
+BOOL WINAPI Process32First(
+  _In_     HANDLE hSnapshot,
+  _Inout_  LPPROCESSENTRY32 lppe
+);
+
+BOOL WINAPI Process32Next(
+  _In_   HANDLE hSnapshot,
+  _Out_  LPPROCESSENTRY32 lppe
+);
+
+BOOL Process32FirstW(
+    HANDLE hSnapshot,
+    LPPROCESSENTRY32W lppe
+);
+
+BOOL Process32NextW(
+    HANDLE hSnapshot,
+    LPPROCESSENTRY32W lppe
+);
+
+
+FARPROC WINAPI GetProcAddress(
+  _In_  HMODULE hModule,
+  _In_  LPCSTR lpProcName
+);
+
+
+HMODULE WINAPI LoadLibraryA(
+    __in LPCSTR lpFileName
+);
+
+HMODULE WINAPI LoadLibraryW(
+    __in LPCWSTR lpFileName
+);
+
+HMODULE LoadLibraryExA(
+  LPCSTR lpLibFileName,
+  HANDLE hFile,
+  DWORD  dwFlags
+);
+
+HMODULE LoadLibraryExW(
+  LPCWSTR lpLibFileName,
+  HANDLE  hFile,
+  DWORD   dwFlags
+);
+
+BOOL FreeLibrary(
+  HMODULE hLibModule
+);

ctypes_generation/definitions/functions/registry.txt

@@ -254,3 +254,56 @@ LSTATUS RegDeleteTreeW(
   HKEY    hKey,
   LPCWSTR lpSubKey
 );
+
+
+LSTATUS RegSaveKeyA(
+  HKEY                        hKey,
+  LPCSTR                      lpFile,
+  LPSECURITY_ATTRIBUTES lpSecurityAttributes
+);
+
+LSTATUS RegSaveKeyW(
+  HKEY                        hKey,
+  LPCWSTR                     lpFile,
+  LPSECURITY_ATTRIBUTES lpSecurityAttributes
+);
+
+
+LSTATUS RegSaveKeyExA(
+  HKEY                        hKey,
+  LPCSTR                      lpFile,
+  LPSECURITY_ATTRIBUTES lpSecurityAttributes,
+  DWORD                       Flags
+);
+
+
+LSTATUS RegSaveKeyExW(
+  HKEY                        hKey,
+  LPCWSTR                     lpFile,
+  LPSECURITY_ATTRIBUTES lpSecurityAttributes,
+  DWORD                       Flags
+);
+
+
+LSTATUS RegLoadKeyA(
+  [in]           HKEY   hKey,
+  [in, optional] LPCSTR lpSubKey,
+  [in]           LPCSTR lpFile
+);
+
+
+LSTATUS RegLoadKeyW(
+  [in]           HKEY    hKey,
+  [in, optional] LPCWSTR lpSubKey,
+  [in]           LPCWSTR lpFile
+);
+
+LSTATUS RegUnLoadKeyA(
+  [in]           HKEY   hKey,
+  [in, optional] LPCSTR lpSubKey
+);
+
+LSTATUS RegUnLoadKeyW(
+  [in]           HKEY    hKey,
+  [in, optional] LPCWSTR lpSubKey
+);

ctypes_generation/definitions/functions/security.txt

@@ -71,6 +71,11 @@ BOOL WINAPI GetSecurityDescriptorOwner(
     _Out_ LPBOOL lpbOwnerDefaulted
     );
 
+BOOL WINAPI SetSecurityDescriptorOwner(
+  [in, out]      PSECURITY_DESCRIPTOR pSecurityDescriptor,
+  [in, optional] PSID                 pOwner,
+  [in]           BOOL                 bOwnerDefaulted
+);
 
 DWORD WINAPI GetSecurityDescriptorRMControl(
     _In_ PSECURITY_DESCRIPTOR SecurityDescriptor,
@@ -308,3 +313,29 @@ DWORD BuildSecurityDescriptorW(
   PULONG               pSizeNewSD,
   PSECURITY_DESCRIPTOR *pNewSD
 );
+
+
+BOOL WINAPI MakeAbsoluteSD(
+  [in]            PSECURITY_DESCRIPTOR pSelfRelativeSecurityDescriptor,
+  [out, optional] PSECURITY_DESCRIPTOR pAbsoluteSecurityDescriptor,
+  [in, out]       LPDWORD              lpdwAbsoluteSecurityDescriptorSize,
+  [out, optional] PACL                 pDacl,
+  [in, out]       LPDWORD              lpdwDaclSize,
+  [out, optional] PACL                 pSacl,
+  [in, out]       LPDWORD              lpdwSaclSize,
+  [out, optional] PSID                 pOwner,
+  [in, out]       LPDWORD              lpdwOwnerSize,
+  [out, optional] PSID                 pPrimaryGroup,
+  [in, out]       LPDWORD              lpdwPrimaryGroupSize
+);
+
+BOOL WINAPI MakeSelfRelativeSD(
+  [in]            PSECURITY_DESCRIPTOR pAbsoluteSecurityDescriptor,
+  [out, optional] PSECURITY_DESCRIPTOR pSelfRelativeSecurityDescriptor,
+  [in, out]       LPDWORD              lpdwBufferLength
+);
+
+BOOL WINAPI InitializeSecurityDescriptor(
+  [out] PSECURITY_DESCRIPTOR pSecurityDescriptor,
+  [in]  DWORD                dwRevision
+);

ctypes_generation/definitions/functions/service.txt

@@ -265,3 +265,11 @@ SC_HANDLE CreateServiceW(
 BOOL DeleteService(
   SC_HANDLE hService
 );
+
+BOOL StartServiceCtrlDispatcherA(
+  SERVICE_TABLE_ENTRYA *lpServiceStartTable
+);
+
+BOOL StartServiceCtrlDispatcherW(
+  SERVICE_TABLE_ENTRYW *lpServiceStartTable
+);

ctypes_generation/definitions/functions/shell32.txt

@@ -27,3 +27,7 @@ BOOL SHGetPathFromIDListW(
   PCIDLIST_ABSOLUTE pidl,
   LPWSTR             pszPath
 );
+
+INT SHFileOperationA(
+  LPSHFILEOPSTRUCTA lpFileOp
+);

ctypes_generation/definitions/functions/synchapi.txt

@@ -0,0 +1,40 @@
+HANDLE CreateEventA(
+  LPSECURITY_ATTRIBUTES lpEventAttributes,
+  BOOL                  bManualReset,
+  BOOL                  bInitialState,
+  LPCSTR                lpName
+);
+
+HANDLE CreateEventW(
+  LPSECURITY_ATTRIBUTES lpEventAttributes,
+  BOOL                  bManualReset,
+  BOOL                  bInitialState,
+  LPCWSTR               lpName
+);
+
+HANDLE CreateEventExA(
+  LPSECURITY_ATTRIBUTES lpEventAttributes,
+  LPCSTR                lpName,
+  DWORD                 dwFlags,
+  DWORD                 dwDesiredAccess
+);
+
+HANDLE CreateEventExW(
+  LPSECURITY_ATTRIBUTES lpEventAttributes,
+  LPCWSTR               lpName,
+  DWORD                 dwFlags,
+  DWORD                 dwDesiredAccess
+);
+
+HANDLE WINAPI OpenEventA(
+    __in DWORD dwDesiredAccess,
+    __in BOOL bInheritHandle,
+    __in LPCSTR lpName
+);
+
+HANDLE WINAPI OpenEventW(
+    __in DWORD dwDesiredAccess,
+    __in BOOL bInheritHandle,
+    __in LPCWSTR lpName
+);
+

ctypes_generation/definitions/functions/syscall.txt

@@ -351,3 +351,22 @@ NTSTATUS NtUnmapViewOfSection(
     PVOID  BaseAddress
 );
 
+
+NTSTATUS NtOpenProcess(
+  PHANDLE            ProcessHandle,
+  ACCESS_MASK        DesiredAccess,
+  POBJECT_ATTRIBUTES ObjectAttributes,
+  PCLIENT_ID         ClientId
+);
+
+
+NTSTATUS WINAPI NtDelayExecution(
+    _In_ BOOLEAN Alertable,
+    _In_opt_ PLARGE_INTEGER DelayInterval
+);
+
+
+NTSTATUS NtTerminateProcess(
+  HANDLE   ProcessHandle,
+  NTSTATUS ExitStatus
+);

ctypes_generation/definitions/functions/sysinfo.txt

@@ -0,0 +1,62 @@
+BOOL GetComputerNameExA(
+  [in]      COMPUTER_NAME_FORMAT NameType,
+  [out]     LPSTR                lpBuffer,
+  [in, out] LPDWORD              nSize
+);
+
+BOOL GetComputerNameExW(
+  [in]      COMPUTER_NAME_FORMAT NameType,
+  [out]     LPWSTR               lpBuffer,
+  [in, out] LPDWORD              nSize
+);
+
+
+BOOL WINAPI GetComputerNameA(
+  _Out_   LPCSTR  lpBuffer,
+  _Inout_ LPDWORD lpnSize
+);
+
+BOOL WINAPI GetComputerNameW(
+  _Out_   LPWSTR  lpBuffer,
+  _Inout_ LPDWORD lpnSize
+);
+
+BOOL WINAPI LookupAccountSidA(
+  _In_opt_  LPCSTR        lpSystemName,
+  _In_      PSID          lpSid,
+  _Out_opt_ LPCSTR        lpName,
+  _Inout_   LPDWORD       cchName,
+  _Out_opt_ LPCSTR        lpReferencedDomainName,
+  _Inout_   LPDWORD       cchReferencedDomainName,
+  _Out_     PSID_NAME_USE peUse
+);
+
+BOOL WINAPI LookupAccountSidW(
+  _In_opt_  LPWSTR       lpSystemName,
+  _In_      PSID          lpSid,
+  _Out_opt_ LPWSTR        lpName,
+  _Inout_   LPDWORD       cchName,
+  _Out_opt_ LPWSTR        lpReferencedDomainName,
+  _Inout_   LPDWORD       cchReferencedDomainName,
+  _Out_     PSID_NAME_USE peUse
+);
+
+BOOL LookupAccountNameA(
+  LPCSTR        lpSystemName,
+  LPCSTR        lpAccountName,
+  PSID          Sid,
+  LPDWORD       cbSid,
+  LPSTR         ReferencedDomainName,
+  LPDWORD       cchReferencedDomainName,
+  PSID_NAME_USE peUse
+);
+
+BOOL LookupAccountNameW(
+  LPCWSTR       lpSystemName,
+  LPCWSTR       lpAccountName,
+  PSID          Sid,
+  LPDWORD       cbSid,
+  LPWSTR        ReferencedDomainName,
+  LPDWORD       cchReferencedDomainName,
+  PSID_NAME_USE peUse
+);

ctypes_generation/definitions/functions/time.txt

@@ -13,7 +13,22 @@ PVOID GetSystemTime(
   LPSYSTEMTIME lpSystemTime
 );
 
+BOOL GetSystemTimes(
+  PFILETIME lpIdleTime,
+  PFILETIME lpKernelTime,
+  PFILETIME lpUserTime
+);
+
 // void
 PVOID GetSystemTimeAsFileTime(
   LPFILETIME lpSystemTimeAsFileTime
 );
+
+// void
+PVOID GetLocalTime(
+  LPSYSTEMTIME lpSystemTime
+);
+
+DWORD GetTickCount();
+
+ULONGLONG GetTickCount64();

ctypes_generation/definitions/functions/winfunc.txt

@@ -9,30 +9,6 @@ BOOL WINAPI TerminateProcess(
 
 DWORD WINAPI GetLastError();
 
-HANDLE WINAPI GetCurrentProcess();
-
-HANDLE WINAPI CreateFileA(
-    __in     LPCSTR lpFileName,
-    __in     DWORD dwDesiredAccess,
-    __in     DWORD dwShareMode,
-    __in_opt LPSECURITY_ATTRIBUTES lpSecurityAttributes,
-    __in     DWORD dwCreationDisposition,
-    __in     DWORD dwFlagsAndAttributes,
-    __in_opt HANDLE hTemplateFile
-    );
-
-HANDLE WINAPI CreateFileW(
-    __in     LPCWSTR lpFileName,
-    __in     DWORD dwDesiredAccess,
-    __in     DWORD dwShareMode,
-    __in_opt LPSECURITY_ATTRIBUTES lpSecurityAttributes,
-    __in     DWORD dwCreationDisposition,
-    __in     DWORD dwFlagsAndAttributes,
-    __in_opt HANDLE hTemplateFile
-    );
-
-
-
 /*
 Flags is directly dereferenced if non-null on windows 10
 Let's assert it's a PVOID for now on
@@ -282,8 +258,6 @@ NTSTATUS WINAPI NtWow64ReadVirtualMemory64(
 );
 
 
-
-
 BOOL WINAPI WriteProcessMemory(
   _In_   HANDLE     hProcess,
   _In_   LPVOID     lpBaseAddress,
@@ -303,71 +277,31 @@ NTSTATUS WINAPI NtWow64WriteVirtualMemory64(
 
 
 
+HANDLE WINAPI GetCurrentProcess();
 
-HANDLE WINAPI CreateToolhelp32Snapshot(
-  _In_  DWORD dwFlags,
-  _In_  DWORD th32ProcessID
-);
+HANDLE WINAPI CreateFileA(
+    __in     LPCSTR lpFileName,
+    __in     DWORD dwDesiredAccess,
+    __in     DWORD dwShareMode,
+    __in_opt LPSECURITY_ATTRIBUTES lpSecurityAttributes,
+    __in     DWORD dwCreationDisposition,
+    __in     DWORD dwFlagsAndAttributes,
+    __in_opt HANDLE hTemplateFile
+    );
 
-BOOL WINAPI Thread32First(
-  _In_     HANDLE hSnapshot,
-  _Inout_  LPTHREADENTRY32 lpte
-);
-
-BOOL WINAPI Thread32Next(
-  _In_   HANDLE hSnapshot,
-  _Out_  LPTHREADENTRY32 lpte
-);
-
-BOOL WINAPI Process32First(
-  _In_     HANDLE hSnapshot,
-  _Inout_  LPPROCESSENTRY32 lppe
-);
-
-BOOL WINAPI Process32Next(
-  _In_   HANDLE hSnapshot,
-  _Out_  LPPROCESSENTRY32 lppe
-);
-
-BOOL Process32FirstW(
-    HANDLE hSnapshot,
-    LPPROCESSENTRY32W lppe
-);
-
-BOOL Process32NextW(
-    HANDLE hSnapshot,
-    LPPROCESSENTRY32W lppe
-);
-
-FARPROC WINAPI GetProcAddress(
-  _In_  HMODULE hModule,
-  _In_  LPCSTR lpProcName
-);
+HANDLE WINAPI CreateFileW(
+    __in     LPCWSTR lpFileName,
+    __in     DWORD dwDesiredAccess,
+    __in     DWORD dwShareMode,
+    __in_opt LPSECURITY_ATTRIBUTES lpSecurityAttributes,
+    __in     DWORD dwCreationDisposition,
+    __in     DWORD dwFlagsAndAttributes,
+    __in_opt HANDLE hTemplateFile
+    );
 
 
-HMODULE WINAPI LoadLibraryA(
-    __in LPCSTR lpFileName
-);
 
-HMODULE WINAPI LoadLibraryW(
-    __in LPCWSTR lpFileName
-);
 
-HMODULE LoadLibraryExA(
-  LPCSTR lpLibFileName,
-  HANDLE hFile,
-  DWORD  dwFlags
-);
-
-HMODULE LoadLibraryExW(
-  LPCWSTR lpLibFileName,
-  HANDLE  hFile,
-  DWORD   dwFlags
-);
-
-BOOL FreeLibrary(
-  HMODULE hLibModule
-);
 
 BOOL WINAPI OpenProcessToken(
   _In_   HANDLE ProcessHandle,
@@ -465,6 +399,37 @@ LPVOID WINAPI LockResource(
   _In_  HGLOBAL hResData
 );
 
+BOOL FreeResource(
+  HGLOBAL hResData
+);
+
+BOOL EnumResourceTypesA(
+  HMODULE          hModule,
+  ENUMRESTYPEPROCA lpEnumFunc,
+  LONG_PTR         lParam
+);
+
+
+BOOL EnumResourceTypesW(
+  HMODULE          hModule,
+  ENUMRESTYPEPROCW lpEnumFunc,
+  LONG_PTR         lParam
+);
+
+BOOL EnumResourceNamesA(
+  HMODULE          hModule,
+  LPCSTR           lpType,
+  ENUMRESNAMEPROCA lpEnumFunc,
+  LONG_PTR         lParam
+);
+
+BOOL EnumResourceNamesW(
+  HMODULE          hModule,
+  LPCWSTR          lpType,
+  ENUMRESNAMEPROCW lpEnumFunc,
+  LONG_PTR         lParam
+);
+
 BOOL WINAPI GetVersionExA(
     __inout LPOSVERSIONINFOA lpVersionInformation
 );
@@ -559,18 +524,6 @@ DWORD WINAPI GetThreadId(
  _In_ HANDLE Thread
  );
 
-HMODULE WINAPI LoadLibraryExA(
-  _In_       LPCSTR lpFileName,
-  _Reserved_ HANDLE  hFile,
-  _In_       DWORD   dwFlags
-);
-
-HMODULE WINAPI LoadLibraryExW(
-  _In_       LPCWSTR lpFileName,
-  _Reserved_ HANDLE  hFile,
-  _In_       DWORD   dwFlags
-);
-
 
 
 BOOL WINAPI DeviceIoControl(
@@ -795,6 +748,17 @@ NTSTATUS RtlDecompressBuffer(
     PULONG FinalUncompressedSize
 );
 
+NTSTATUS RtlCompressBuffer(
+  USHORT CompressionFormatAndEngine,
+  PUCHAR UncompressedBuffer,
+  ULONG  UncompressedBufferSize,
+  PUCHAR CompressedBuffer,
+  ULONG  CompressedBufferSize,
+  ULONG  UncompressedChunkSize,
+  PULONG FinalCompressedSize,
+  PVOID  WorkSpace
+);
+
 NTSTATUS RtlDecompressBufferEx(
    USHORT CompressionFormat,
    PUCHAR UncompressedBuffer,
@@ -812,21 +776,12 @@ NTSTATUS RtlGetCompressionWorkSpaceSize(
 );
 
 
-HANDLE WINAPI OpenEventA(
-    __in DWORD dwDesiredAccess,
-    __in BOOL bInheritHandle,
-    __in LPCSTR lpName
+VOID WINAPI RtlMoveMemory(
+  _Out_       PVOID     Destination,
+  _In_        PVOID     Source,
+  _In_        SIZE_T         Length
 );
 
-
-HANDLE WINAPI OpenEventW(
-    __in DWORD dwDesiredAccess,
-    __in BOOL bInheritHandle,
-    __in LPCWSTR lpName
-);
-
-
-
 INT WINAPI lstrcmpA(
     __in LPCSTR lpString1,
     __in LPCSTR lpString2
@@ -1012,36 +967,6 @@ INT WINAPI GetSystemMetrics(
   _In_ INT nIndex
 );
 
-BOOL WINAPI GetComputerNameA(
-  _Out_   LPCSTR  lpBuffer,
-  _Inout_ LPDWORD lpnSize
-);
-
-BOOL WINAPI GetComputerNameW(
-  _Out_   LPWSTR  lpBuffer,
-  _Inout_ LPDWORD lpnSize
-);
-
-BOOL WINAPI LookupAccountSidA(
-  _In_opt_  LPCSTR        lpSystemName,
-  _In_      PSID          lpSid,
-  _Out_opt_ LPCSTR        lpName,
-  _Inout_   LPDWORD       cchName,
-  _Out_opt_ LPCSTR        lpReferencedDomainName,
-  _Inout_   LPDWORD       cchReferencedDomainName,
-  _Out_     PSID_NAME_USE peUse
-);
-
-BOOL WINAPI LookupAccountSidW(
-  _In_opt_  LPWSTR       lpSystemName,
-  _In_      PSID          lpSid,
-  _Out_opt_ LPWSTR        lpName,
-  _Inout_   LPDWORD       cchName,
-  _Out_opt_ LPWSTR        lpReferencedDomainName,
-  _Inout_   LPDWORD       cchReferencedDomainName,
-  _Out_     PSID_NAME_USE peUse
-);
-
 
 DWORD WINAPI GetInterfaceInfo(
   _Out_   PIP_INTERFACE_INFO pIfTable,

ctypes_generation/definitions/functions/wsocket.txt

@@ -0,0 +1,81 @@
+INT WSAStartup(
+  [in]  WORD      wVersionRequested,
+  [out] LPWSADATA lpWSAData // structure depends on 32 / 64 bits..
+);
+
+
+INT WSACleanup();
+INT WSAGetLastError();
+
+
+INT getaddrinfo(
+  [in, optional] PCSTR           pNodeName,
+  [in, optional] PCSTR           pServiceName,
+  [in, optional] ADDRINFOA *pHints,
+  [out]          PADDRINFOA      *ppResult
+);
+
+
+INT GetAddrInfoW(
+  [in, optional] PCWSTR          pNodeName,
+  [in, optional] PCWSTR          pServiceName,
+  [in, optional] ADDRINFOW *pHints,
+  [out]          PADDRINFOW      *ppResult
+);
+
+
+SOCKET WSASocketA(
+  [in] INT                 af,
+  [in] INT                 type,
+  [in] INT                 protocol,
+  [in] LPWSAPROTOCOL_INFOA lpProtocolInfo,
+  [in] GROUP               g,
+  [in] DWORD               dwFlags
+);
+
+
+SOCKET WSASocketW(
+  [in] INT                 af,
+  [in] INT                 type,
+  [in] INT                 protocol,
+  [in] LPWSAPROTOCOL_INFOW lpProtocolInfo,
+  [in] GROUP               g,
+  [in] DWORD               dwFlags
+);
+
+
+SOCKET socket(
+  [in] INT af,
+  [in] INT type,
+  [in] INT protocol
+);
+
+INT connect(
+  [in] SOCKET         s,
+  [in] sockaddr       *name,
+  [in] INT            namelen
+);
+
+
+INT send(
+  [in] SOCKET     s,
+  [in] CHAR *buf,
+  [in] INT        len,
+  [in] INT        flags
+);
+
+INT recv(
+  [in]  SOCKET s,
+  [out] CHAR   *buf,
+  [in]  INT    len,
+  [in]  INT    flags
+);
+
+INT shutdown(
+  [in] SOCKET s,
+  [in] INT    how
+);
+
+INT closesocket(
+  [in] SOCKET s
+);

ctypes_generation/definitions/simple_types.txt

@@ -18,8 +18,10 @@ LPBYTE = POINTER(BYTE)
 ULONG_PTR = PVOID
 LONG_PTR = PVOID
 DWORD_PTR = ULONG_PTR
+PDWORD_PTR = POINTER(DWORD_PTR)
 KAFFINITY = ULONG_PTR
 KPRIORITY = LONG
+INTERNET_PORT = WORD
 
 CHAR = c_char
 PCHAR = POINTER(CHAR)
@@ -82,6 +84,8 @@ SPC_UUID = BYTE * 16
 DEVICE_TYPE = DWORD
 PWINDBG_EXTENSION_APIS32 = PVOID
 PWINDBG_EXTENSION_APIS64 = PVOID
+FILEOP_FLAGS = WORD
+NET_API_STATUS = DWORD
 
 
 NCRYPT_HANDLE = ULONG_PTR
@@ -139,6 +143,7 @@ PLSA_HANDLE = POINTER(LSA_HANDLE)
 HDSKSPC = HANDLE
 // Define type for reference to device information set
 HDEVINFO = HANDLE
+HINTERNET = PVOID
 
 /* Network */
 
@@ -199,6 +204,11 @@ RPCOLEDATAREP = ULONG
 HREFTYPE = DWORD
 SFGAOF = ULONG
 
+/* SOCKET STUFF */
+
+GROUP = UINT
+SOCKET = HANDLE
+
 /* Function PTR */
 
 WNDPROC = PVOID
@@ -229,6 +239,14 @@ PTRANSLATE_ADDRESS_ROUTINE64  = PVOID # StackWalk
 PSYMBOL_REGISTERED_CALLBACK64 = PVOID # Symbols
 PSYMBOL_REGISTERED_CALLBACK = PVOID # Symbols
 PSYM_ENUMPROCESSES_CALLBACK = PVOID # Symbols
+ENUMRESNAMEPROCA = PVOID # Resources
+ENUMRESNAMEPROCW = PVOID # Resources
+ENUMRESTYPEPROCA = PVOID # Resources
+ENUMRESTYPEPROCW = PVOID # Resources
+LPSERVICE_MAIN_FUNCTIONA = PVOID
+LPSERVICE_MAIN_FUNCTIONW = PVOID
+LPOVERLAPPED_COMPLETION_ROUTINE = PVOID
+PDNS_QUERY_COMPLETION_ROUTINE = PVOID
 
 
 // Will be changed at import time
@@ -238,3 +256,4 @@ HCERTSTORE = PVOID
 HCRYPTMSG = PVOID
 PALPC_PORT_ATTRIBUTES = PVOID
 PPORT_MESSAGE = PVOID
+LPWSADATA = PVOID

ctypes_generation/definitions/structures/com.txt

@@ -99,7 +99,7 @@ typedef struct tagSAFEARRAY
   ULONG cLocks;
   PVOID pvData;
   SAFEARRAYBOUND rgsabound[ 1 ];
-}   SAFEARRAY;
+}  SAFEARRAY, *LPSAFEARRAY;
 
 typedef struct __tagBRECORD {
     PVOID pvRecord;

ctypes_generation/definitions/structures/crypto.txt

@@ -712,3 +712,22 @@ typedef struct _SPC_INDIRECT_DATA_CONTENT
     CRYPT_HASH_BLOB             Digest;
 
 } SPC_INDIRECT_DATA_CONTENT, *PSPC_INDIRECT_DATA_CONTENT;
+
+typedef struct _PUBLICKEYSTRUC {
+  BYTE   bType;
+  BYTE   bVersion;
+  WORD   reserved;
+  ALG_ID aiKeyAlg;
+} BLOBHEADER, PUBLICKEYSTRUC;
+
+// The structure is described at https://docs.microsoft.com/en-us/previous-versions/windows/desktop/legacy/jj650836(v=vs.85)
+// But PLAINTEXTKEYBLOB is a define '#define PLAINTEXTKEYBLOB        0x8' in WinCrypt.h
+// So I guess this struct is reaaly defined no-where
+// So the sample for importing a plain key
+// https://docs.microsoft.com/en-us/windows/win32/seccrypto/example-c-program--importing-a-plaintext-key
+// The BLOB is in a BYTE DesKeyBlob[] & not a real struct :')
+typedef struct _STRUCT_PLAINTEXTKEYBLOB {
+  BLOBHEADER hdr;
+  DWORD      dwKeySize;
+  BYTE       rgbKeyData[0];
+} STRUCT_PLAINTEXTKEYBLOB, *PSTRUCT_PLAINTEXTKEYBLOB;

ctypes_generation/definitions/structures/dpapi.txt

@@ -0,0 +1,6 @@
+typedef struct _CRYPTPROTECT_PROMPTSTRUCT {
+  DWORD   cbSize;
+  DWORD   dwPromptFlags;
+  HWND    hwndApp;
+  LPCWSTR szPrompt;
+} CRYPTPROTECT_PROMPTSTRUCT, *PCRYPTPROTECT_PROMPTSTRUCT;

ctypes_generation/definitions/structures/file_info.txt

@@ -254,3 +254,50 @@ typedef struct _WIN32_FIND_DATAW {
   DWORD    dwCreatorType;
   WORD     wFinderFlags;
 } WIN32_FIND_DATAW, *PWIN32_FIND_DATAW, *LPWIN32_FIND_DATAW;
+
+
+typedef enum _READ_DIRECTORY_NOTIFY_INFORMATION_CLASS {
+  ReadDirectoryNotifyInformation,
+  ReadDirectoryNotifyExtendedInformation
+} READ_DIRECTORY_NOTIFY_INFORMATION_CLASS, *PREAD_DIRECTORY_NOTIFY_INFORMATION_CLASS;
+
+typedef struct _FILE_NOTIFY_INFORMATION {
+  DWORD NextEntryOffset;
+  DWORD Action;
+  DWORD FileNameLength;
+  WCHAR FileName[1];
+} FILE_NOTIFY_INFORMATION, *PFILE_NOTIFY_INFORMATION;
+
+typedef struct _FILE_NOTIFY_EXTENDED_INFORMATION {
+  DWORD         NextEntryOffset;
+  DWORD         Action;
+  LARGE_INTEGER CreationTime;
+  LARGE_INTEGER LastModificationTime;
+  LARGE_INTEGER LastChangeTime;
+  LARGE_INTEGER LastAccessTime;
+  LARGE_INTEGER AllocatedLength;
+  LARGE_INTEGER FileSize;
+  DWORD         FileAttributes;
+  DWORD         ReparsePointTag;
+  LARGE_INTEGER FileId;
+  LARGE_INTEGER ParentFileId;
+  DWORD         FileNameLength;
+  WCHAR         FileName[1];
+} FILE_NOTIFY_EXTENDED_INFORMATION, *PFILE_NOTIFY_EXTENDED_INFORMATION;
+
+
+/*
+    The sub union is new from _WIN32_WINNT_WIN10_RS1
+    But it does not change the struct size, so keep it like this
+    https://docs.microsoft.com/en-us/windows-hardware/drivers/ddi/ntifs/ns-ntifs-_file_rename_information
+*/
+
+typedef struct _FILE_RENAME_INFORMATION {
+    union {
+        BOOLEAN ReplaceIfExists;  // FileRenameInformation
+        ULONG Flags;              // FileRenameInformationEx
+    } __ANON_DUMMYUNIONNAME_FILE_RENAME_INFORMATION; /* */
+    HANDLE RootDirectory;
+    ULONG FileNameLength;
+    WCHAR FileName[1];
+} FILE_RENAME_INFORMATION, *PFILE_RENAME_INFORMATION;

ctypes_generation/definitions/structures/internet.txt

@@ -0,0 +1,26 @@
+typedef struct _INTERNET_BUFFERSA {
+  DWORD                     dwStructSize;
+  struct _INTERNET_BUFFERSA *Next;
+  LPCSTR                    lpcszHeader;
+  DWORD                     dwHeadersLength;
+  DWORD                     dwHeadersTotal;
+  LPVOID                    lpvBuffer;
+  DWORD                     dwBufferLength;
+  DWORD                     dwBufferTotal;
+  DWORD                     dwOffsetLow;
+  DWORD                     dwOffsetHigh;
+} INTERNET_BUFFERSA, *LPINTERNET_BUFFERSA;
+
+typedef struct _INTERNET_BUFFERSW {
+  DWORD                     dwStructSize;
+  struct _INTERNET_BUFFERSW *Next;
+  LPCWSTR                   lpcszHeader;
+  DWORD                     dwHeadersLength;
+  DWORD                     dwHeadersTotal;
+  LPVOID                    lpvBuffer;
+  DWORD                     dwBufferLength;
+  DWORD                     dwBufferTotal;
+  DWORD                     dwOffsetLow;
+  DWORD                     dwOffsetHigh;
+} INTERNET_BUFFERSW, *LPINTERNET_BUFFERSW;
+

ctypes_generation/definitions/structures/netapi.txt

@@ -0,0 +1,217 @@
+typedef struct _LOCALGROUP_INFO_0 {
+  LPWSTR lgrpi0_name;
+} LOCALGROUP_INFO_0, *PLOCALGROUP_INFO_0, *LPLOCALGROUP_INFO_0;
+
+typedef struct _LOCALGROUP_INFO_1 {
+  LPWSTR lgrpi1_name;
+  LPWSTR lgrpi1_comment;
+} LOCALGROUP_INFO_1, *PLOCALGROUP_INFO_1, *LPLOCALGROUP_INFO_1;
+
+typedef struct _LOCALGROUP_MEMBERS_INFO_0 {
+  PSID lgrmi0_sid;
+} LOCALGROUP_MEMBERS_INFO_0, *PLOCALGROUP_MEMBERS_INFO_0, *LPLOCALGROUP_MEMBERS_INFO_0;
+
+
+typedef struct _LOCALGROUP_MEMBERS_INFO_1 {
+  PSID         lgrmi1_sid;
+  SID_NAME_USE lgrmi1_sidusage;
+  LPWSTR       lgrmi1_name;
+} LOCALGROUP_MEMBERS_INFO_1, *PLOCALGROUP_MEMBERS_INFO_1, *LPLOCALGROUP_MEMBERS_INFO_1;
+
+
+typedef struct _LOCALGROUP_MEMBERS_INFO_2 {
+  PSID         lgrmi2_sid;
+  SID_NAME_USE lgrmi2_sidusage;
+  LPWSTR       lgrmi2_domainandname;
+} LOCALGROUP_MEMBERS_INFO_2, *PLOCALGROUP_MEMBERS_INFO_2, *LPLOCALGROUP_MEMBERS_INFO_2;
+
+
+typedef struct _LOCALGROUP_MEMBERS_INFO_3 {
+  LPWSTR lgrmi3_domainandname;
+} LOCALGROUP_MEMBERS_INFO_3, *PLOCALGROUP_MEMBERS_INFO_3, *LPLOCALGROUP_MEMBERS_INFO_3;
+
+
+typedef struct _NET_DISPLAY_USER {
+  LPWSTR usri1_name;
+  LPWSTR usri1_comment;
+  DWORD  usri1_flags;
+  LPWSTR usri1_full_name;
+  DWORD  usri1_user_id;
+  DWORD  usri1_next_index;
+} NET_DISPLAY_USER, *PNET_DISPLAY_USER;
+
+
+typedef struct _NET_DISPLAY_MACHINE {
+  LPWSTR usri2_name;
+  LPWSTR usri2_comment;
+  DWORD  usri2_flags;
+  DWORD  usri2_user_id;
+  DWORD  usri2_next_index;
+} NET_DISPLAY_MACHINE, *PNET_DISPLAY_MACHINE;
+
+
+typedef struct _NET_DISPLAY_GROUP {
+  LPWSTR grpi3_name;
+  LPWSTR grpi3_comment;
+  DWORD  grpi3_group_id;
+  DWORD  grpi3_attributes;
+  DWORD  grpi3_next_index;
+} NET_DISPLAY_GROUP, *PNET_DISPLAY_GROUP;
+
+
+typedef struct _USER_INFO_0 {
+  LPWSTR usri0_name;
+} USER_INFO_0, *PUSER_INFO_0, *LPUSER_INFO_0;
+
+
+typedef struct _USER_INFO_1 {
+  LPWSTR usri1_name;
+  LPWSTR usri1_password;
+  DWORD  usri1_password_age;
+  DWORD  usri1_priv;
+  LPWSTR usri1_home_dir;
+  LPWSTR usri1_comment;
+  DWORD  usri1_flags;
+  LPWSTR usri1_script_path;
+} USER_INFO_1, *PUSER_INFO_1, *LPUSER_INFO_1;
+
+typedef struct _USER_INFO_2 {
+  LPWSTR usri2_name;
+  LPWSTR usri2_password;
+  DWORD  usri2_password_age;
+  DWORD  usri2_priv;
+  LPWSTR usri2_home_dir;
+  LPWSTR usri2_comment;
+  DWORD  usri2_flags;
+  LPWSTR usri2_script_path;
+  DWORD  usri2_auth_flags;
+  LPWSTR usri2_full_name;
+  LPWSTR usri2_usr_comment;
+  LPWSTR usri2_parms;
+  LPWSTR usri2_workstations;
+  DWORD  usri2_last_logon;
+  DWORD  usri2_last_logoff;
+  DWORD  usri2_acct_expires;
+  DWORD  usri2_max_storage;
+  DWORD  usri2_units_per_week;
+  PBYTE  usri2_logon_hours;
+  DWORD  usri2_bad_pw_count;
+  DWORD  usri2_num_logons;
+  LPWSTR usri2_logon_server;
+  DWORD  usri2_country_code;
+  DWORD  usri2_code_page;
+} USER_INFO_2, *PUSER_INFO_2, *LPUSER_INFO_2;
+
+typedef struct _USER_INFO_3 {
+  LPWSTR usri3_name;
+  LPWSTR usri3_password;
+  DWORD  usri3_password_age;
+  DWORD  usri3_priv;
+  LPWSTR usri3_home_dir;
+  LPWSTR usri3_comment;
+  DWORD  usri3_flags;
+  LPWSTR usri3_script_path;
+  DWORD  usri3_auth_flags;
+  LPWSTR usri3_full_name;
+  LPWSTR usri3_usr_comment;
+  LPWSTR usri3_parms;
+  LPWSTR usri3_workstations;
+  DWORD  usri3_last_logon;
+  DWORD  usri3_last_logoff;
+  DWORD  usri3_acct_expires;
+  DWORD  usri3_max_storage;
+  DWORD  usri3_units_per_week;
+  PBYTE  usri3_logon_hours;
+  DWORD  usri3_bad_pw_count;
+  DWORD  usri3_num_logons;
+  LPWSTR usri3_logon_server;
+  DWORD  usri3_country_code;
+  DWORD  usri3_code_page;
+  DWORD  usri3_user_id;
+  DWORD  usri3_primary_group_id;
+  LPWSTR usri3_profile;
+  LPWSTR usri3_home_dir_drive;
+  DWORD  usri3_password_expired;
+} USER_INFO_3, *PUSER_INFO_3, *LPUSER_INFO_3;
+
+typedef struct _USER_INFO_10 {
+  LPWSTR usri10_name;
+  LPWSTR usri10_comment;
+  LPWSTR usri10_usr_comment;
+  LPWSTR usri10_full_name;
+} USER_INFO_10, *PUSER_INFO_10, *LPUSER_INFO_10;
+
+
+typedef struct _USER_INFO_11 {
+  LPWSTR usri11_name;
+  LPWSTR usri11_comment;
+  LPWSTR usri11_usr_comment;
+  LPWSTR usri11_full_name;
+  DWORD  usri11_priv;
+  DWORD  usri11_auth_flags;
+  DWORD  usri11_password_age;
+  LPWSTR usri11_home_dir;
+  LPWSTR usri11_parms;
+  DWORD  usri11_last_logon;
+  DWORD  usri11_last_logoff;
+  DWORD  usri11_bad_pw_count;
+  DWORD  usri11_num_logons;
+  LPWSTR usri11_logon_server;
+  DWORD  usri11_country_code;
+  LPWSTR usri11_workstations;
+  DWORD  usri11_max_storage;
+  DWORD  usri11_units_per_week;
+  PBYTE  usri11_logon_hours;
+  DWORD  usri11_code_page;
+} USER_INFO_11, *PUSER_INFO_11, *LPUSER_INFO_11;
+
+typedef struct _USER_INFO_20 {
+  LPWSTR usri20_name;
+  LPWSTR usri20_full_name;
+  LPWSTR usri20_comment;
+  DWORD  usri20_flags;
+  DWORD  usri20_user_id;
+} USER_INFO_20, *PUSER_INFO_20, *LPUSER_INFO_20;
+
+typedef struct _USER_INFO_23 {
+  LPWSTR usri23_name;
+  LPWSTR usri23_full_name;
+  LPWSTR usri23_comment;
+  DWORD  usri23_flags;
+  PSID   usri23_user_sid;
+} USER_INFO_23, *PUSER_INFO_23, *LPUSER_INFO_23;
+
+
+typedef struct _GROUP_INFO_0 {
+  LPWSTR grpi0_name;
+} GROUP_INFO_0, *PGROUP_INFO_0, *LPGROUP_INFO_0;
+
+typedef struct _GROUP_INFO_1 {
+  LPWSTR grpi1_name;
+  LPWSTR grpi1_comment;
+} GROUP_INFO_1, *PGROUP_INFO_1, *LPGROUP_INFO_1;
+
+typedef struct _GROUP_INFO_2 {
+  LPWSTR grpi2_name;
+  LPWSTR grpi2_comment;
+  DWORD  grpi2_group_id;
+  DWORD  grpi2_attributes;
+} GROUP_INFO_2, *PGROUP_INFO_2;
+
+typedef struct _GROUP_INFO_3 {
+  LPWSTR grpi3_name;
+  LPWSTR grpi3_comment;
+  PSID   grpi3_group_sid;
+  DWORD  grpi3_attributes;
+} GROUP_INFO_3, *PGROUP_INFO_3;
+
+
+typedef struct _GROUP_USERS_INFO_0 {
+  LPWSTR grui0_name;
+} GROUP_USERS_INFO_0, *PGROUP_USERS_INFO_0, *LPGROUP_USERS_INFO_0;
+
+
+typedef struct _GROUP_USERS_INFO_1 {
+  LPWSTR grui1_name;
+  DWORD  grui1_attributes;
+} GROUP_USERS_INFO_1, *PGROUP_USERS_INFO_1, *LPGROUP_USERS_INFO_1;

ctypes_generation/definitions/structures/netip.txt

@@ -0,0 +1,14 @@
+typedef struct _MIB_IPNETROW_LH {
+  IF_INDEX dwIndex;
+  DWORD    dwPhysAddrLen;
+  UCHAR    bPhysAddr[8];
+  DWORD    dwAddr;
+  union {
+    DWORD          dwType;
+  };
+} MIB_IPNETROW, *PMIB_IPNETROW;
+
+typedef struct _MIB_IPNETTABLE {
+  DWORD        dwNumEntries;
+  MIB_IPNETROW table[ANY_SIZE];
+} MIB_IPNETTABLE, *PMIB_IPNETTABLE;

ctypes_generation/definitions/structures/network.txt

@@ -819,3 +819,102 @@ typedef struct _DnsRecordW {
     PBYTE               pDataPtr;
   } Data;
 } DNS_RECORDW, *PDNS_RECORDW;
+
+
+typedef struct _DnsAddr
+{
+    CHAR        MaxSa[ DNS_ADDR_MAX_SOCKADDR_LENGTH ];
+    DWORD       DnsAddrUserDword[ 8 ];
+}
+DNS_ADDR, *PDNS_ADDR;
+
+typedef struct _DnsAddrArray
+{
+    DWORD           MaxCount;
+    DWORD           AddrCount;
+    DWORD           Tag;
+    WORD            Family;
+    WORD            WordReserved;
+    DWORD           Flags;
+    DWORD           MatchFlag;
+    DWORD           Reserved1;
+    DWORD           Reserved2;
+    DNS_ADDR        AddrArray[ANY_SIZE];
+}
+DNS_ADDR_ARRAY, *PDNS_ADDR_ARRAY;
+
+
+typedef struct _DNS_QUERY_REQUEST
+{
+    ULONG           Version;
+    PCWSTR          QueryName;
+    WORD            QueryType;
+    ULONG64         QueryOptions;
+    PDNS_ADDR_ARRAY pDnsServerList;
+    ULONG           InterfaceIndex;
+    PDNS_QUERY_COMPLETION_ROUTINE   pQueryCompletionCallback;
+    PVOID           pQueryContext;
+} DNS_QUERY_REQUEST, *PDNS_QUERY_REQUEST;
+
+typedef struct _DNS_QUERY_CANCEL
+{
+    CHAR            Reserved[32];
+} DNS_QUERY_CANCEL, *PDNS_QUERY_CANCEL;
+
+
+typedef struct _DNS_QUERY_RESULT
+{
+    ULONG           Version;
+    DNS_STATUS      QueryStatus;
+    ULONG64         QueryOptions;
+    // Might BE A or W record (don't know how to distinguish for now)
+    PVOID           pQueryRecords; // PDNS_RECORD pQueryRecords;
+    PVOID           Reserved;
+} DNS_QUERY_RESULT, *PDNS_QUERY_RESULT;
+
+
+typedef struct {
+    CHAR String[4 * 4];
+} IP_ADDRESS_STRING, *PIP_ADDRESS_STRING, IP_MASK_STRING, *PIP_MASK_STRING;
+
+typedef struct _IP_ADDR_STRING {
+    struct _IP_ADDR_STRING* Next;
+    IP_ADDRESS_STRING IpAddress;
+    IP_MASK_STRING IpMask;
+    DWORD Context;
+} IP_ADDR_STRING, *PIP_ADDR_STRING;
+
+typedef struct _IP_ADAPTER_INFO {
+  struct _IP_ADAPTER_INFO *Next;
+  DWORD                   ComboIndex;
+  CHAR                    AdapterName[MAX_ADAPTER_NAME_LENGTH + 4];
+  CHAR                    Description[MAX_ADAPTER_DESCRIPTION_LENGTH + 4];
+  UINT                    AddressLength;
+  BYTE                    Address[MAX_ADAPTER_ADDRESS_LENGTH];
+  DWORD                   Index;
+  UINT                    Type;
+  UINT                    DhcpEnabled;
+  PIP_ADDR_STRING         CurrentIpAddress;
+  IP_ADDR_STRING          IpAddressList;
+  IP_ADDR_STRING          GatewayList;
+  IP_ADDR_STRING          DhcpServer;
+  BOOL                    HaveWins;
+  IP_ADDR_STRING          PrimaryWinsServer;
+  IP_ADDR_STRING          SecondaryWinsServer;
+  ULONGLONG                  LeaseObtained; // time_t ?
+  ULONGLONG                  LeaseExpires; // time_t ?
+} IP_ADAPTER_INFO, *PIP_ADAPTER_INFO;
+
+
+// #if (NTDDI_VERSION >= NTDDI_WIN2KSP1)
+// typedef  IP_PER_ADAPTER_INFO_W2KSP1 IP_PER_ADAPTER_INFO;
+// typedef  IP_PER_ADAPTER_INFO_W2KSP1 *PIP_PER_ADAPTER_INFO;
+// #endif
+
+typedef struct _IP_PER_ADAPTER_INFO_W2KSP1 {
+  UINT            AutoconfigEnabled;
+  UINT            AutoconfigActive;
+  PIP_ADDR_STRING CurrentDnsServer;
+  IP_ADDR_STRING  DnsServerList;
+} IP_PER_ADAPTER_INFO_W2KSP1, *PIP_PER_ADAPTER_INFO_W2KSP1, IP_PER_ADAPTER_INFO, *PIP_PER_ADAPTER_INFO;
+

ctypes_generation/definitions/structures/service.txt

@@ -83,3 +83,15 @@ typedef struct _QUERY_SERVICE_CONFIGW {
   LPWSTR lpServiceStartName;
   LPWSTR lpDisplayName;
 } QUERY_SERVICE_CONFIGW, *LPQUERY_SERVICE_CONFIGW;
+
+
+typedef struct _SERVICE_TABLE_ENTRYA {
+  LPSTR                    lpServiceName;
+  LPSERVICE_MAIN_FUNCTIONA lpServiceProc;
+} SERVICE_TABLE_ENTRYA, *LPSERVICE_TABLE_ENTRYA;
+
+
+typedef struct _SERVICE_TABLE_ENTRYW {
+  LPWSTR                   lpServiceName;
+  LPSERVICE_MAIN_FUNCTIONW lpServiceProc;
+} SERVICE_TABLE_ENTRYW, *LPSERVICE_TABLE_ENTRYW;

ctypes_generation/definitions/structures/shell.txt

@@ -30,3 +30,14 @@ enum PACKAGE_EXECUTION_STATE
     PES_SUSPENDED	= 3,
     PES_TERMINATED	= 4
 } 	PACKAGE_EXECUTION_STATE;
+
+typedef struct _SHFILEOPSTRUCTA {
+  HWND         hwnd;
+  UINT         wFunc;
+  PCSTR      pFrom;
+  PCSTR      pTo;
+  FILEOP_FLAGS fFlags;
+  BOOL         fAnyOperationsAborted;
+  LPVOID       hNameMappings;
+  PCSTR        lpszProgressTitle;
+} SHFILEOPSTRUCTA, *LPSHFILEOPSTRUCTA;

ctypes_generation/definitions/structures/system_info.txt

@@ -0,0 +1,69 @@
+/* Based on
+winternl.h
+&
+https://www.geoffchappell.com/studies/windows/km/ntoskrnl/api/ex/sysinfo/process.htm
+*/
+
+typedef struct _SYSTEM_PROCESS_INFORMATION {
+    ULONG NextEntryOffset;
+    ULONG NumberOfThreads;
+    BYTE Reserved1[24];
+    LARGE_INTEGER CreateTime;
+    LARGE_INTEGER UserTime;
+    LARGE_INTEGER KernelTime;
+    UNICODE_STRING ImageName;
+    LONG BasePriority;
+    HANDLE UniqueProcessId;
+    PVOID InheritedFromUniqueProcessId;
+    ULONG HandleCount;
+    BYTE Reserved4[4];
+    PVOID Reserved5[1];
+    PVOID PeakVirtualSize;
+    PVOID VirtualSize;
+    PVOID PageFaultCount;
+    PVOID PeakWorkingSetSize;
+    PVOID WorkingSetSize;
+    PVOID QuotaPeakPagedPoolUsage;
+    PVOID QuotaPagedPoolUsage;
+    PVOID QuotaPeakNonPagedPoolUsage;
+    PVOID QuotaNonPagedPoolUsage;
+    PVOID PagefileUsage;
+    SIZE_T PeakPagefileUsage;
+    SIZE_T PrivatePageCount;
+    LARGE_INTEGER Reserved6[6];
+} SYSTEM_PROCESS_INFORMATION, *PSYSTEM_PROCESS_INFORMATION;
+
+
+typedef struct _SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION {
+    LARGE_INTEGER IdleTime;
+    LARGE_INTEGER KernelTime;
+    LARGE_INTEGER UserTime;
+    LARGE_INTEGER Reserved1[2];
+    ULONG Reserved2;
+} SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION, *PSYSTEM_PROCESSOR_PERFORMANCE_INFORMATION;
+
+
+typedef struct _SYSTEM_REGISTRY_QUOTA_INFORMATION {
+    ULONG RegistryQuotaAllowed;
+    ULONG RegistryQuotaUsed;
+    PVOID Reserved1;
+} SYSTEM_REGISTRY_QUOTA_INFORMATION, *PSYSTEM_REGISTRY_QUOTA_INFORMATION;
+
+typedef struct _SYSTEM_BASIC_INFORMATION {
+    BYTE Reserved1[24];
+    PVOID Reserved2[4];
+    CHAR NumberOfProcessors;
+} SYSTEM_BASIC_INFORMATION, *PSYSTEM_BASIC_INFORMATION;
+
+
+typedef enum _COMPUTER_NAME_FORMAT {
+  ComputerNameNetBIOS,
+  ComputerNameDnsHostname,
+  ComputerNameDnsDomain,
+  ComputerNameDnsFullyQualified,
+  ComputerNamePhysicalNetBIOS,
+  ComputerNamePhysicalDnsHostname,
+  ComputerNamePhysicalDnsDomain,
+  ComputerNamePhysicalDnsFullyQualified,
+  ComputerNameMax
+} COMPUTER_NAME_FORMAT;

ctypes_generation/definitions/structures/winstruct.txt

@@ -226,91 +226,242 @@ typedef struct _SYSTEM_VERIFIER_INFORMATION {
 } SYSTEM_VERIFIER_INFORMATION, *PSYSTEM_VERIFIER_INFORMATION;
 
 typedef enum _SYSTEM_INFORMATION_CLASS {
-    SystemBasicInformation,
-    SystemProcessorInformation,
-    SystemPerformanceInformation,
-    SystemTimeOfDayInformation,
-    SystemPathInformation,
-    SystemProcessInformation,
-    SystemCallCountInformation,
-    SystemDeviceInformation,
-    SystemProcessorPerformanceInformation,
-    SystemFlagsInformation,
-    SystemCallTimeInformation,
-    SystemModuleInformation,
-    SystemLocksInformation,
-    SystemStackTraceInformation,
-    SystemPagedPoolInformation,
-    SystemNonPagedPoolInformation,
-    SystemHandleInformation,
-    SystemObjectInformation,
-    SystemPageFileInformation,
-    SystemVdmInstemulInformation,
-    SystemVdmBopInformation,
-    SystemFileCacheInformation,
-    SystemPoolTagInformation,
-    SystemInterruptInformation,
-    SystemDpcBehaviorInformation,
-    SystemFullMemoryInformation,
-    SystemLoadGdiDriverInformation,
-    SystemUnloadGdiDriverInformation,
-    SystemTimeAdjustmentInformation,
-    SystemSummaryMemoryInformation,
-    SystemMirrorMemoryInformation,
-    SystemPerformanceTraceInformation,
-    SystemObsolete0,
-    SystemExceptionInformation,
-    SystemCrashDumpStateInformation,
-    SystemKernelDebuggerInformation,
-    SystemContextSwitchInformation,
-    SystemRegistryQuotaInformation,
-    SystemExtendServiceTableInformation,
-    SystemPrioritySeperation,
-    SystemVerifierAddDriverInformation,
-    SystemVerifierRemoveDriverInformation,
-    SystemProcessorIdleInformation,
-    SystemLegacyDriverInformation,
-    SystemCurrentTimeZoneInformation,
-    SystemLookasideInformation,
-    SystemTimeSlipNotification,
-    SystemSessionCreate,
-    SystemSessionDetach,
-    SystemSessionInformation,
-    SystemRangeStartInformation,
-    SystemVerifierInformation,
-    SystemVerifierThunkExtend,
-    SystemSessionProcessInformation,
-    SystemLoadGdiDriverInSystemSpace,
-    SystemNumaProcessorMap,
-    SystemPrefetcherInformation,
-    SystemExtendedProcessInformation,
-    SystemRecommendedSharedDataAlignment,
-    SystemComPlusPackage,
-    SystemNumaAvailableMemory,
-    SystemProcessorPowerInformation,
-    SystemEmulationBasicInformation,
-    SystemEmulationProcessorInformation,
-    SystemExtendedHandleInformation,
-    SystemLostDelayedWriteInformation,
-    SystemBigPoolInformation,
-    SystemSessionPoolTagInformation,
-    SystemSessionMappedViewInformation,
-    SystemHotpatchInformation,
-    SystemObjectSecurityMode,
-    SystemWatchdogTimerHandler,
-    SystemWatchdogTimerInformation,
-    SystemLogicalProcessorInformation,
-    SystemWow64SharedInformation,
-    SystemRegisterFirmwareTableInformationHandler,
-    SystemFirmwareTableInformation,
-    SystemModuleInformationEx,
-    SystemVerifierTriageInformation,
-    SystemSuperfetchInformation,
-    SystemMemoryListInformation,
-    SystemFileCacheInformationEx,
-    MaxSystemInfoClass
+   SystemBasicInformation = 0,
+   SystemProcessorInformation = 1,
+   SystemPerformanceInformation = 2,
+   SystemTimeOfDayInformation = 3,
+   SystemPathInformation = 4,
+   SystemProcessInformation = 5,
+   SystemCallCountInformation = 6,
+   SystemDeviceInformation = 7,
+   SystemProcessorPerformanceInformation = 8,
+   SystemFlagsInformation = 9,
+   SystemCallTimeInformation = 10,
+   SystemModuleInformation = 11,
+   SystemLocksInformation = 12,
+   SystemStackTraceInformation = 13,
+   SystemPagedPoolInformation = 14,
+   SystemNonPagedPoolInformation = 15,
+   SystemHandleInformation = 16,
+   SystemObjectInformation = 17,
+   SystemPageFileInformation = 18,
+   SystemVdmInstemulInformation = 19,
+   SystemVdmBopInformation = 20,
+   SystemFileCacheInformation = 21,
+   SystemPoolTagInformation = 22,
+   SystemInterruptInformation = 23,
+   SystemDpcBehaviorInformation = 24,
+   SystemFullMemoryInformation = 25,
+   SystemLoadGdiDriverInformation = 26,
+   SystemUnloadGdiDriverInformation = 27,
+   SystemTimeAdjustmentInformation = 28,
+   SystemSummaryMemoryInformation = 29,
+   SystemMirrorMemoryInformation = 30,
+   SystemPerformanceTraceInformation = 31,
+   SystemObsolete0 = 32,
+   SystemExceptionInformation = 33,
+   SystemCrashDumpStateInformation = 34,
+   SystemKernelDebuggerInformation = 35,
+   SystemContextSwitchInformation = 36,
+   SystemRegistryQuotaInformation = 37,
+   SystemExtendServiceTableInformation = 38,
+   SystemPrioritySeperation = 39,
+   SystemVerifierAddDriverInformation = 40,
+   SystemVerifierRemoveDriverInformation = 41,
+   SystemProcessorIdleInformation = 42,
+   SystemLegacyDriverInformation = 43,
+   SystemCurrentTimeZoneInformation = 44,
+   SystemLookasideInformation = 45,
+   SystemTimeSlipNotification = 46,
+   SystemSessionCreate = 47,
+   SystemSessionDetach = 48,
+   SystemSessionInformation = 49,
+   SystemRangeStartInformation = 50,
+   SystemVerifierInformation = 51,
+   SystemVerifierThunkExtend = 52,
+   SystemSessionProcessInformation = 53,
+   SystemLoadGdiDriverInSystemSpace = 54,
+   SystemNumaProcessorMap = 55,
+   SystemPrefetcherInformation = 56,
+   SystemExtendedProcessInformation = 57,
+   SystemRecommendedSharedDataAlignment = 58,
+   SystemComPlusPackage = 59,
+   SystemNumaAvailableMemory = 60,
+   SystemProcessorPowerInformation = 61,
+   SystemEmulationBasicInformation = 62,
+   SystemEmulationProcessorInformation = 63,
+   SystemExtendedHandleInformation = 64,
+   SystemLostDelayedWriteInformation = 65,
+   SystemBigPoolInformation = 66,
+   SystemSessionPoolTagInformation = 67,
+   SystemSessionMappedViewInformation = 68,
+   SystemHotpatchInformation = 69,
+   SystemObjectSecurityMode = 70,
+   SystemWatchdogTimerHandler = 71,
+   SystemWatchdogTimerInformation = 72,
+   SystemLogicalProcessorInformation = 73,
+   SystemWow64SharedInformationObsolete = 74,
+   SystemRegisterFirmwareTableInformationHandler = 75,
+   SystemFirmwareTableInformation = 76,
+   SystemModuleInformationEx = 77,
+   SystemVerifierTriageInformation = 78,
+   SystemSuperfetchInformation = 79,
+   SystemMemoryListInformation = 80,
+   SystemFileCacheInformationEx = 81,
+   SystemThreadPriorityClientIdInformation = 82,
+   SystemProcessorIdleCycleTimeInformation = 83,
+   SystemVerifierCancellationInformation = 84,
+   SystemProcessorPowerInformationEx = 85,
+   SystemRefTraceInformation = 86,
+   SystemSpecialPoolInformation = 87,
+   SystemProcessIdInformation = 88,
+   SystemErrorPortInformation = 89,
+   SystemBootEnvironmentInformation = 90,
+   SystemHypervisorInformation = 91,
+   SystemVerifierInformationEx = 92,
+   SystemTimeZoneInformation = 93,
+   SystemImageFileExecutionOptionsInformation = 94,
+   SystemCoverageInformation = 95,
+   SystemPrefetchPatchInformation = 96,
+   SystemVerifierFaultsInformation = 97,
+   SystemSystemPartitionInformation = 98,
+   SystemSystemDiskInformation = 99,
+   SystemProcessorPerformanceDistribution = 100,
+   SystemNumaProximityNodeInformation = 101,
+   SystemDynamicTimeZoneInformation = 102,
+   SystemCodeIntegrityInformation = 103,
+   SystemProcessorMicrocodeUpdateInformation = 104,
+   SystemProcessorBrandString = 105,
+   SystemVirtualAddressInformation = 106,
+   SystemLogicalProcessorAndGroupInformation = 107,
+   SystemProcessorCycleTimeInformation = 108,
+   SystemStoreInformation = 109,
+   SystemRegistryAppendString = 110,
+   SystemAitSamplingValue = 111,
+   SystemVhdBootInformation = 112,
+   SystemCpuQuotaInformation = 113,
+   SystemNativeBasicInformation = 114,
+   SystemErrorPortTimeouts = 115,
+   SystemLowPriorityIoInformation = 116,
+   SystemBootEntropyInformation = 117,
+   SystemVerifierCountersInformation = 118,
+   SystemPagedPoolInformationEx = 119,
+   SystemSystemPtesInformationEx = 120,
+   SystemNodeDistanceInformation = 121,
+   SystemAcpiAuditInformation = 122,
+   SystemBasicPerformanceInformation = 123,
+   SystemQueryPerformanceCounterInformation = 124,
+   SystemSessionBigPoolInformation = 125,
+   SystemBootGraphicsInformation = 126,
+   SystemScrubPhysicalMemoryInformation = 127,
+   SystemBadPageInformation = 128,
+   SystemProcessorProfileControlArea = 129,
+   SystemCombinePhysicalMemoryInformation = 130,
+   SystemEntropyInterruptTimingInformation = 131,
+   SystemConsoleInformation = 132,
+   SystemPlatformBinaryInformation = 133,
+   SystemPolicyInformation = 134,
+   SystemHypervisorProcessorCountInformation = 135,
+   SystemDeviceDataInformation = 136,
+   SystemDeviceDataEnumerationInformation = 137,
+   SystemMemoryTopologyInformation = 138,
+   SystemMemoryChannelInformation = 139,
+   SystemBootLogoInformation = 140,
+   SystemProcessorPerformanceInformationEx = 141,
+   SystemCriticalProcessErrorLogInformation = 142,
+   SystemSecureBootPolicyInformation = 143,
+   SystemPageFileInformationEx = 144,
+   SystemSecureBootInformation = 145,
+   SystemEntropyInterruptTimingRawInformation = 146,
+   SystemPortableWorkspaceEfiLauncherInformation = 147,
+   SystemFullProcessInformation = 148,
+   SystemKernelDebuggerInformationEx = 149,
+   SystemBootMetadataInformation = 150,
+   SystemSoftRebootInformation = 151,
+   SystemElamCertificateInformation = 152,
+   SystemOfflineDumpConfigInformation = 153,
+   SystemProcessorFeaturesInformation = 154,
+   SystemRegistryReconciliationInformation = 155,
+   SystemEdidInformation = 156,
+   SystemManufacturingInformation = 157,
+   SystemEnergyEstimationConfigInformation = 158,
+   SystemHypervisorDetailInformation = 159,
+   SystemProcessorCycleStatsInformation = 160,
+   SystemVmGenerationCountInformation = 161,
+   SystemTrustedPlatformModuleInformation = 162,
+   SystemKernelDebuggerFlags = 163,
+   SystemCodeIntegrityPolicyInformation = 164,
+   SystemIsolatedUserModeInformation = 165,
+   SystemHardwareSecurityTestInterfaceResultsInformation = 166,
+   SystemSingleModuleInformation = 167,
+   SystemAllowedCpuSetsInformation = 168,
+   SystemVsmProtectionInformation = 169,
+   SystemInterruptCpuSetsInformation = 170,
+   SystemSecureBootPolicyFullInformation = 171,
+   SystemCodeIntegrityPolicyFullInformation = 172,
+   SystemAffinitizedInterruptProcessorInformation = 173,
+   SystemRootSiloInformation = 174,
+   SystemCpuSetInformation = 175,
+   SystemCpuSetTagInformation = 176,
+   SystemWin32WerStartCallout = 177,
+   SystemSecureKernelProfileInformation = 178,
+   SystemCodeIntegrityPlatformManifestInformation = 179,
+   SystemInterruptSteeringInformation = 180,
+   SystemSupportedProcessorArchitectures = 181,
+   SystemMemoryUsageInformation = 182,
+   SystemCodeIntegrityCertificateInformation = 183,
+   SystemPhysicalMemoryInformation = 184,
+   SystemControlFlowTransition = 185,
+   SystemKernelDebuggingAllowed = 186,
+   SystemActivityModerationExeState = 187,
+   SystemActivityModerationUserSettings = 188,
+   SystemCodeIntegrityPoliciesFullInformation = 189,
+   SystemCodeIntegrityUnlockInformation = 190,
+   SystemIntegrityQuotaInformation = 191,
+   SystemFlushInformation = 192,
+   SystemProcessorIdleMaskInformation = 193,
+   SystemSecureDumpEncryptionInformation = 194,
+   SystemWriteConstraintInformation = 195,
+   SystemKernelVaShadowInformation = 196,
+   SystemHypervisorSharedPageInformation = 197,
+   SystemFirmwareBootPerformanceInformation = 198,
+   SystemCodeIntegrityVerificationInformation = 199,
+   SystemFirmwarePartitionInformation = 200,
+   SystemSpeculationControlInformation = 201,
+   SystemDmaGuardPolicyInformation = 202,
+   SystemEnclaveLaunchControlInformation = 203,
+   SystemWorkloadAllowedCpuSetsInformation = 204,
+   SystemCodeIntegrityUnlockModeInformation = 205,
+   SystemLeapSecondInformation = 206,
+   SystemFlags2Information = 207,
+   SystemSecurityModelInformation = 208,
+   SystemCodeIntegritySyntheticCacheInformation = 209,
+   SystemFeatureConfigurationInformation = 210,
+   SystemFeatureConfigurationSectionInformation = 211,
+   SystemFeatureUsageSubscriptionInformation = 212,
+   SystemSecureSpeculationControlInformation = 213,
+   SystemSpacesBootInformation = 214,
+   SystemFwRamdiskInformation = 215,
+   SystemWheaIpmiHardwareInformation = 216,
+   SystemDifSetRuleClassInformation = 217,
+   SystemDifClearRuleClassInformation = 218,
+   SystemDifApplyPluginVerificationOnDriver = 219,
+   SystemDifRemovePluginVerificationOnDriver = 220,
+   SystemShadowStackInformation = 221,
+   SystemBuildVersionInformation = 222,
+   SystemPoolLimitInformation = 223,
+   SystemCodeIntegrityAddDynamicStore = 224,
+   SystemCodeIntegrityClearDynamicStores = 225,
+   SystemPoolZeroingInformation = 227,
+   MaxSystemInfoClass = 228,
 } SYSTEM_INFORMATION_CLASS;
 
+
+typedef struct _SYSTEM_PROCESS_ID_INFORMATION {
+    HANDLE ProcessId;
+    UNICODE_STRING ImageName;
+} SYSTEM_PROCESS_ID_INFORMATION, *PSYSTEM_PROCESS_ID_INFORMATION;
+
 typedef enum  _WELL_KNOWN_SID_TYPE{
   WinNullSid                                   = 0,
   WinWorldSid                                  = 1,
@@ -719,17 +870,17 @@ typedef enum _SECTION_INHERIT {
 typedef struct _CLIENT_ID{
    HANDLE UniqueProcess;
    HANDLE UniqueThread;
-} CLIENT_ID;
+} CLIENT_ID, *PCLIENT_ID;
 
 typedef struct _CLIENT_ID64{
    ULONG64 UniqueProcess;
    ULONG64 UniqueThread;
-} CLIENT_ID64;
+} CLIENT_ID64, *PCLIENT_ID64;
 
 typedef struct _CLIENT_ID32{
    ULONG UniqueProcess;
    ULONG UniqueThread;
-} CLIENT_ID32;
+} CLIENT_ID32, *PCLIENT_ID32;
 
 typedef struct _LDR_DATA_TABLE_ENTRY {
     PVOID Reserved1[2];
@@ -882,6 +1033,17 @@ typedef struct _IMAGE_EXPORT_DIRECTORY {
     DWORD   AddressOfNameOrdinals;
 } IMAGE_EXPORT_DIRECTORY, *PIMAGE_EXPORT_DIRECTORY;
 
+typedef struct _IMAGE_DEBUG_DIRECTORY {
+    DWORD   Characteristics;
+    DWORD   TimeDateStamp;
+    WORD    MajorVersion;
+    WORD    MinorVersion;
+    DWORD   Type;
+    DWORD   SizeOfData;
+    DWORD   AddressOfRawData;
+    DWORD   PointerToRawData;
+} IMAGE_DEBUG_DIRECTORY, *PIMAGE_DEBUG_DIRECTORY;
+
 typedef struct _IMAGE_BASE_RELOCATION {
     DWORD   VirtualAddress;
     DWORD   SizeOfBlock;
@@ -1380,7 +1542,13 @@ typedef struct _OSVERSIONINFOEXW {
 typedef struct _OVERLAPPED {
   ULONG_PTR Internal;
   ULONG_PTR InternalHigh;
-  PVOID  Pointer;
+  union {
+    struct {
+      DWORD Offset;
+      DWORD OffsetHigh;
+    } _ANON_OVERLAPPED_DUMMYSTRUCTNAME;
+    PVOID Pointer;
+  } _ANON_OVERLAPPED_DUMMYUNIONNAME;
   HANDLE    hEvent;
 } OVERLAPPED, *LPOVERLAPPED;
 

ctypes_generation/definitions/structures/wsocket.txt

@@ -0,0 +1,122 @@
+typedef struct WSAData64 {
+        WORD                    wVersion;
+        WORD                    wHighVersion;
+        USHORT                  iMaxSockets;
+        USHORT                  iMaxUdpDg;
+        CHAR *                  lpVendorInfo;
+        CHAR                    szDescription[WSADESCRIPTION_LEN+1];
+        CHAR                    szSystemStatus[WSASYS_STATUS_LEN+1];
+} WSADATA64, *LPWSADATA64;
+
+typedef struct WSAData32 {
+        WORD                    wVersion;
+        WORD                    wHighVersion;
+        CHAR                    szDescription[WSADESCRIPTION_LEN+1];
+        CHAR                    szSystemStatus[WSASYS_STATUS_LEN+1];
+        USHORT                  iMaxSockets;
+        USHORT                  iMaxUdpDg;
+        CHAR *                  lpVendorInfo;
+} WSADATA32, *LPWSADATA32;
+
+struct in_addr {
+  union {
+    struct {
+      UCHAR s_b1;
+      UCHAR s_b2;
+      UCHAR s_b3;
+      UCHAR s_b4;
+    } S_un_b;
+    struct {
+      USHORT s_w1;
+      USHORT s_w2;
+    } S_un_w;
+    ULONG S_addr;
+  } S_un;
+};
+
+struct sockaddr {
+        USHORT  sa_family;
+        CHAR    sa_data[14];
+};
+
+struct sockaddr_in {
+        SHORT   sin_family;
+        USHORT  sin_port;
+        struct  in_addr sin_addr;
+        CHAR    sin_zero[8];
+};
+
+
+typedef struct addrinfoW {
+  INT              ai_flags;
+  INT              ai_family;
+  INT              ai_socktype;
+  INT              ai_protocol;
+  SIZE_T           ai_addrlen;
+  PWSTR            ai_canonname;
+  struct sockaddr  *ai_addr;
+  struct addrinfoW *ai_next;
+} ADDRINFOW, *PADDRINFOW;
+
+typedef struct _WSAPROTOCOLCHAIN {
+  INT   ChainLen;
+  DWORD ChainEntries[MAX_PROTOCOL_CHAIN];
+} WSAPROTOCOLCHAIN, *LPWSAPROTOCOLCHAIN;
+
+typedef struct _WSAPROTOCOL_INFOA {
+  DWORD            dwServiceFlags1;
+  DWORD            dwServiceFlags2;
+  DWORD            dwServiceFlags3;
+  DWORD            dwServiceFlags4;
+  DWORD            dwProviderFlags;
+  GUID             ProviderId;
+  DWORD            dwCatalogEntryId;
+  WSAPROTOCOLCHAIN ProtocolChain;
+  INT              iVersion;
+  INT              iAddressFamily;
+  INT              iMaxSockAddr;
+  INT              iMinSockAddr;
+  INT              iSocketType;
+  INT              iProtocol;
+  INT              iProtocolMaxOffset;
+  INT              iNetworkByteOrder;
+  INT              iSecurityScheme;
+  DWORD            dwMessageSize;
+  DWORD            dwProviderReserved;
+  CHAR             szProtocol[WSAPROTOCOL_LEN + 1];
+} WSAPROTOCOL_INFOA, *LPWSAPROTOCOL_INFOA;
+
+typedef struct _WSAPROTOCOL_INFOW {
+  DWORD            dwServiceFlags1;
+  DWORD            dwServiceFlags2;
+  DWORD            dwServiceFlags3;
+  DWORD            dwServiceFlags4;
+  DWORD            dwProviderFlags;
+  GUID             ProviderId;
+  DWORD            dwCatalogEntryId;
+  WSAPROTOCOLCHAIN ProtocolChain;
+  INT              iVersion;
+  INT              iAddressFamily;
+  INT              iMaxSockAddr;
+  INT              iMinSockAddr;
+  INT              iSocketType;
+  INT              iProtocol;
+  INT              iProtocolMaxOffset;
+  INT              iNetworkByteOrder;
+  INT              iSecurityScheme;
+  DWORD            dwMessageSize;
+  DWORD            dwProviderReserved;
+  WCHAR            szProtocol[WSAPROTOCOL_LEN + 1];
+} WSAPROTOCOL_INFOW, *LPWSAPROTOCOL_INFOW;
+
+
+typedef struct addrinfo {
+  INT             ai_flags;
+  INT             ai_family;
+  INT             ai_socktype;
+  INT             ai_protocol;
+  SIZE_T          ai_addrlen;
+  CHAR            *ai_canonname;
+  struct sockaddr *ai_addr;
+  struct addrinfo *ai_next;
+} ADDRINFOA, *PADDRINFOA;

ctypes_generation/extended_structs/_FILE_RENAME_INFORMATION.py

@@ -0,0 +1,11 @@
+INITIAL_FILE_RENAME_INFORMATION = _FILE_RENAME_INFORMATION
+
+class _FILE_RENAME_INFORMATION(INITIAL_FILE_RENAME_INFORMATION):
+    @property
+    def filename(self):
+        filename_addr = ctypes.addressof(self) + type(self).FileName.offset
+        if getattr(self, "_target", None) is not None: #remote ctypes :D -> TRICKS OF THE YEAR
+            raw_data = self._target.read_memory(filename_addr, self.FileNameLength)
+            return raw_data.decode("utf16")
+        size = int(self.FileNameLength / 2)
+        return (ctypes.c_wchar * size).from_address(filename_addr)[:]

ctypes_generation/extended_structs/_OBJECT_ATTRIBUTES.py

@@ -13,4 +13,5 @@ class _OBJECT_ATTRIBUTES(_OBJECT_ATTRIBUTES):
     def __repr__(self):
         if not self.ObjectName:
             return super(_OBJECT_ATTRIBUTES, self).__repr__()
-        return """<{0} ObjectName="{1}">""".format(type(self).__name__, self.ObjectName[0].str)
+        # .contents allow compatibility with remotectypes
+        return """<{0} ObjectName="{1}">""".format(type(self).__name__, self.ObjectName.contents.str)

ctypes_generation/func_parser.py

@@ -53,20 +53,33 @@ class WinFuncParser(Parser):
     default_calling_convention = "WINFUNCTYPE"
 
     def assert_argument_io_info(self):
-        io_info = self.assert_token_type(NameToken)
-        if io_info.value not in self.known_io_info_type:
-            if io_info.value not in self.known_io_info_with_param:
-                raise ParsingError("Was expection IO_INFO got {0} instead".format(io_info))
-            # Ignore IO infos params.
-            self.assert_token_type(OpenParenthesisToken)
-            while type(self.peek()) is not CloseParenthesisToken:
-                self.next_token()
-            self.assert_token_type(CloseParenthesisToken)
-        return io_info
+        if type(self.peek()) == NameToken:
+            # Old IO infos format based on known_io_info_type & co
+            io_info = self.assert_token_type(NameToken)
+            if io_info.value not in self.known_io_info_type:
+                if io_info.value not in self.known_io_info_with_param:
+                    raise ParsingError("Was expection IO_INFO got {0} instead".format(io_info))
+                # Ignore IO infos params.
+                self.assert_token_type(OpenParenthesisToken)
+                while type(self.peek()) is not CloseParenthesisToken:
+                    self.next_token()
+                self.assert_token_type(CloseParenthesisToken)
+        else:
+            # New format: [xxx, yyy, xxx]
+            self.assert_token_type(OpenSquareBracketToken)
+            while type(self.peek()) is not CloseSquareBracketToken:
+                self.next_token() # Assert Name/Comma & co ?
+            self.assert_token_type(CloseSquareBracketToken)
+        return None
 
     def parse_func_arg(self, has_winapi):
         type_ptr = False
-        if has_winapi:
+        next_token = self.peek()
+        # Try to guess if IO type info are present
+        # New MSDN format that [in, out] info without any WINAPI indicator
+        if (has_winapi or
+            type(next_token) == OpenSquareBracketToken or
+            type(next_token) == NameToken and (next_token.value in self.known_io_info_type + self.known_io_info_with_param)):
             self.assert_argument_io_info()
         arg_type = self.assert_token_type(NameToken)
         if arg_type.value.upper() == "CONST":

ctypes_generation/generate.py

@@ -5,6 +5,7 @@ import re
 import glob
 import textwrap
 import StringIO
+import pprint
 
 import shutil
 
@@ -14,6 +15,7 @@ import func_parser
 import def_parser
 import com_parser
 
+from winstruct import BitFieldValue, ComplexArrayExpression
 from simpleparser import ParsingError
 
 pjoin = os.path.join
@@ -182,7 +184,7 @@ class ParsedFileGraph(object):
         self.build_depandance_database()
 
     def build_dependancy_graph(self):
-        todo = set(self.nodes)
+        todo = sorted(set(self.nodes), key=lambda x: x.filename) # Sorting help determinism
         if not todo:
             return []
         start = self.find_starting_node()
@@ -295,7 +297,7 @@ class CtypesGenerator(object):
         pass
 
     def emit_import_dependancies(self):
-        for name in self.imported_name:
+        for name in sorted(self.imported_name):
             self.emitline("from .{0} import *".format(name))
 
     def copy_template(self):
@@ -573,7 +575,19 @@ class StructureDocGenerator(NoTemplatedGenerator):
             # Emit struct Definition
             self.emitline(".. class:: {0}".format(struct.name))
             for ftype, fname, nb in struct.fields:
-                array_str = " ``[{nb}]``".format(nb=nb) if nb > 1 else ""
+                if isinstance(nb, int):
+                    array_str = " ``[{nb}]``".format(nb=nb) if nb > 1 else ""
+                elif isinstance(nb, BitFieldValue):
+                    array_str = " ``(BitField of size {nb}``".format(nb=int(nb))
+                elif isinstance(nb, ComplexArrayExpression):
+                    values = nb.values
+                    if len(values) == 1 and values[0] == "1":
+                            array_str = ""
+                    else:
+                        array_str = " ``[{nb}]``".format(nb=" ".join(nb.values))
+                else:
+                    raise TypeError("Unknown type for array expression: {0}".format(nb))
+
                 self.emitline("")
                 self.emitline("    .. attribute:: {fname}".format(fname=fname))
                 self.emitline("")
@@ -625,7 +639,7 @@ class MetaFileGenerator(NoTemplatedGenerator):
     def generate(self):
 
         for name, modname, exports in self.modules:
-            self.emitline("{0} = {1}".format(name, exports))
+            self.emitline("{0} = {1}".format(name, pprint.pformat(exports)))
 
         self.emitline(META_WALKER)
 

docs/build/html/_modules/windows/debug/symbols.html

@@ -232,6 +232,10 @@
     <span class="k">def</span> <span class="nf">basetype</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
         <span class="k">return</span> <span class="n">gdef</span><span class="o">.</span><span class="n">BasicType</span><span class="o">.</span><span class="n">mapper</span><span class="p">[</span><span class="bp">self</span><span class="o">.</span><span class="n">_get_type_info</span><span class="p">(</span><span class="n">gdef</span><span class="o">.</span><span class="n">TI_GET_BASETYPE</span><span class="p">)]</span>
 
+    <span class="nd">@property</span>
+    <span class="k">def</span> <span class="nf">parent</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
+        <span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">new_typeid</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">_get_type_info</span><span class="p">(</span><span class="n">gdef</span><span class="o">.</span><span class="n">TI_GET_CLASSPARENTID</span><span class="p">))</span>
+
     <span class="nd">@property</span>
     <span class="k">def</span> <span class="nf">datakind</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
         <span class="k">return</span> <span class="n">gdef</span><span class="o">.</span><span class="n">DataKind</span><span class="o">.</span><span class="n">mapper</span><span class="p">[</span><span class="bp">self</span><span class="o">.</span><span class="n">_get_type_info</span><span class="p">(</span><span class="n">gdef</span><span class="o">.</span><span class="n">TI_GET_DATAKIND</span><span class="p">)]</span>
@@ -248,6 +252,10 @@
     <span class="k">def</span> <span class="nf">nb_children</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
         <span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">_get_type_info</span><span class="p">(</span><span class="n">gdef</span><span class="o">.</span><span class="n">TI_GET_CHILDRENCOUNT</span><span class="p">)</span>
 
+    <span class="nd">@property</span>
+    <span class="k">def</span> <span class="nf">value</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
+        <span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">_get_type_info</span><span class="p">(</span><span class="n">gdef</span><span class="o">.</span><span class="n">TI_GET_VALUE</span><span class="p">)</span>
+
     <span class="nd">@property</span>
     <span class="k">def</span> <span class="nf">children</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
         <span class="n">count</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">nb_children</span>
@@ -270,7 +278,10 @@
 
     <span class="k">def</span> <span class="fm">__repr__</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
         <span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">tag</span> <span class="o">==</span> <span class="n">gdef</span><span class="o">.</span><span class="n">SymTagBaseType</span><span class="p">:</span>
-            <span class="k">return</span> <span class="s1">&#39;&lt;</span><span class="si">{0}</span><span class="s1"> &lt;basetype&gt; </span><span class="si">{1}</span><span class="s1">&gt;&#39;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="nb">type</span><span class="p">(</span><span class="bp">self</span><span class="p">)</span><span class="o">.</span><span class="vm">__name__</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">basetype</span><span class="p">)</span>
+            <span class="k">return</span> <span class="s1">&#39;&lt;</span><span class="si">{0}</span><span class="s1"> &lt;basetype&gt; </span><span class="si">{1!r}</span><span class="s1">&gt;&#39;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="nb">type</span><span class="p">(</span><span class="bp">self</span><span class="p">)</span><span class="o">.</span><span class="vm">__name__</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">basetype</span><span class="p">)</span>
+        <span class="k">elif</span> <span class="bp">self</span><span class="o">.</span><span class="n">tag</span> <span class="o">==</span> <span class="n">gdef</span><span class="o">.</span><span class="n">SymTagPointerType</span><span class="p">:</span>
+            <span class="n">target_type</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">type</span><span class="o">.</span><span class="n">name</span>
+            <span class="k">return</span> <span class="s1">&#39;&lt;</span><span class="si">{0}</span><span class="s1"> PTR TO &quot;</span><span class="si">{1}</span><span class="s1">&quot; tag=</span><span class="si">{2}</span><span class="s1">&gt;&#39;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="nb">type</span><span class="p">(</span><span class="bp">self</span><span class="p">)</span><span class="o">.</span><span class="vm">__name__</span><span class="p">,</span> <span class="n">target_type</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">tag</span><span class="p">)</span>
         <span class="k">return</span> <span class="s1">&#39;&lt;</span><span class="si">{0}</span><span class="s1"> name=&quot;</span><span class="si">{1}</span><span class="s1">&quot; tag=</span><span class="si">{2}</span><span class="s1">&gt;&#39;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="nb">type</span><span class="p">(</span><span class="bp">self</span><span class="p">)</span><span class="o">.</span><span class="vm">__name__</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">name</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">tag</span><span class="p">)</span>
 
 
@@ -771,6 +782,7 @@
     <span class="n">gdef</span><span class="o">.</span><span class="n">TI_GET_ADDRESS</span><span class="p">:</span> <span class="n">gdef</span><span class="o">.</span><span class="n">ULONG64</span><span class="p">,</span>
     <span class="n">gdef</span><span class="o">.</span><span class="n">TI_GTIEX_REQS_VALID</span><span class="p">:</span> <span class="n">gdef</span><span class="o">.</span><span class="n">ULONG64</span><span class="p">,</span>
     <span class="n">gdef</span><span class="o">.</span><span class="n">TI_GET_SYMTAG</span><span class="p">:</span> <span class="n">gdef</span><span class="o">.</span><span class="n">SymTagEnum</span><span class="p">,</span>
+    <span class="n">gdef</span><span class="o">.</span><span class="n">TI_GET_VALUE</span><span class="p">:</span> <span class="n">windows</span><span class="o">.</span><span class="n">com</span><span class="o">.</span><span class="n">Variant</span><span class="p">,</span>
 <span class="p">}</span>
 </pre></div>
 

docs/build/html/_modules/windows/native_exec/native_function.html

@@ -47,59 +47,12 @@
 
 <span class="kn">import</span> <span class="nn">windows</span>
 <span class="kn">import</span> <span class="nn">windows.winproxy</span>
+<span class="kn">import</span> <span class="nn">windows.generated_def</span> <span class="k">as</span> <span class="nn">gdef</span>
 
 <span class="kn">from</span> <span class="nn">.</span> <span class="kn">import</span> <span class="n">simple_x86</span> <span class="k">as</span> <span class="n">x86</span>
 <span class="kn">from</span> <span class="nn">.</span> <span class="kn">import</span> <span class="n">simple_x64</span> <span class="k">as</span> <span class="n">x64</span>
 
 
-<span class="k">class</span> <span class="nc">PyObj</span><span class="p">(</span><span class="n">ctypes</span><span class="o">.</span><span class="n">Structure</span><span class="p">):</span>
-    <span class="n">_fields_</span> <span class="o">=</span> <span class="p">[(</span><span class="s2">&quot;ob_refcnt&quot;</span><span class="p">,</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">c_size_t</span><span class="p">),</span>
-                <span class="p">(</span><span class="s2">&quot;ob_type&quot;</span><span class="p">,</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">c_void_p</span><span class="p">)]</span>  <span class="c1"># must be cast</span>
-
-
-<span class="k">class</span> <span class="nc">PyMmap</span><span class="p">(</span><span class="n">PyObj</span><span class="p">):</span>
-    <span class="n">_fields_</span> <span class="o">=</span> <span class="p">[(</span><span class="s2">&quot;ob_addr&quot;</span><span class="p">,</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">c_size_t</span><span class="p">),</span> <span class="p">(</span><span class="s2">&quot;ob_size&quot;</span><span class="p">,</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">c_size_t</span><span class="p">)]</span>
-
-
-<span class="c1"># Specific mmap class for code injection</span>
-<span class="k">class</span> <span class="nc">MyMap</span><span class="p">(</span><span class="n">mmap</span><span class="o">.</span><span class="n">mmap</span><span class="p">):</span>
-    <span class="sd">&quot;&quot;&quot; A mmap that is never unmapped and that contains the page address &quot;&quot;&quot;</span>
-    <span class="k">def</span> <span class="fm">__init__</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="o">*</span><span class="n">args</span><span class="p">,</span> <span class="o">**</span><span class="n">kwarg</span><span class="p">):</span>
-        <span class="c1"># Get the page address by &#39;introspection&#39; of the C struct</span>
-        <span class="n">m</span> <span class="o">=</span> <span class="n">PyMmap</span><span class="o">.</span><span class="n">from_address</span><span class="p">(</span><span class="nb">id</span><span class="p">(</span><span class="bp">self</span><span class="p">))</span>
-        <span class="bp">self</span><span class="o">.</span><span class="n">addr</span> <span class="o">=</span> <span class="n">m</span><span class="o">.</span><span class="n">ob_addr</span>
-        <span class="c1"># Prevent garbage collection (so unmaping) of the page</span>
-        <span class="n">m</span><span class="o">.</span><span class="n">ob_refcnt</span> <span class="o">+=</span> <span class="mi">1</span>
-
-    <span class="nd">@classmethod</span>
-    <span class="k">def</span> <span class="nf">get_map</span><span class="p">(</span><span class="bp">cls</span><span class="p">,</span> <span class="n">size</span><span class="p">):</span>
-        <span class="sd">&quot;&quot;&quot; Dispatch to the good mmap implem depending on the current system &quot;&quot;&quot;</span>
-        <span class="n">systems</span> <span class="o">=</span> <span class="p">{</span><span class="s1">&#39;windows&#39;</span><span class="p">:</span> <span class="n">Win32MyMap</span><span class="p">,</span>
-                   <span class="s1">&#39;linux&#39;</span><span class="p">:</span> <span class="n">UnixMyMap</span><span class="p">}</span>
-        <span class="n">x</span> <span class="o">=</span> <span class="n">platform</span><span class="o">.</span><span class="n">system</span><span class="p">()</span><span class="o">.</span><span class="n">lower</span><span class="p">()</span>
-        <span class="k">if</span> <span class="n">x</span> <span class="ow">not</span> <span class="ow">in</span> <span class="n">systems</span><span class="p">:</span>
-            <span class="k">raise</span> <span class="ne">ValueError</span><span class="p">(</span><span class="s2">&quot;Unknow system </span><span class="si">{0}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">x</span><span class="p">))</span>
-        <span class="k">return</span> <span class="n">systems</span><span class="p">[</span><span class="n">x</span><span class="p">]</span><span class="o">.</span><span class="n">get_map</span><span class="p">(</span><span class="n">size</span><span class="p">)</span>
-
-
-<span class="k">class</span> <span class="nc">Win32MyMap</span><span class="p">(</span><span class="n">MyMap</span><span class="p">):</span>
-    <span class="nd">@classmethod</span>
-    <span class="k">def</span> <span class="nf">get_map</span><span class="p">(</span><span class="bp">cls</span><span class="p">,</span> <span class="n">size</span><span class="p">):</span>
-        <span class="n">addr</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">VirtualAlloc</span><span class="p">(</span><span class="mi">0</span><span class="p">,</span> <span class="n">size</span><span class="p">,</span> <span class="mh">0x1000</span><span class="p">,</span> <span class="mh">0x40</span><span class="p">)</span>
-        <span class="n">new_map</span> <span class="o">=</span> <span class="p">(</span><span class="n">ctypes</span><span class="o">.</span><span class="n">c_char</span> <span class="o">*</span> <span class="n">size</span><span class="p">)</span><span class="o">.</span><span class="n">from_address</span><span class="p">(</span><span class="n">addr</span><span class="p">)</span>
-        <span class="n">new_map</span><span class="o">.</span><span class="n">addr</span> <span class="o">=</span> <span class="n">addr</span>
-        <span class="k">if</span> <span class="n">new_map</span><span class="o">.</span><span class="n">addr</span> <span class="o">==</span> <span class="mi">0</span><span class="p">:</span>
-            <span class="k">raise</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">WinError</span><span class="p">()</span>
-        <span class="k">return</span> <span class="n">new_map</span>
-
-
-<span class="k">class</span> <span class="nc">UnixMyMap</span><span class="p">(</span><span class="n">MyMap</span><span class="p">):</span>
-    <span class="nd">@classmethod</span>
-    <span class="k">def</span> <span class="nf">get_map</span><span class="p">(</span><span class="bp">cls</span><span class="p">,</span> <span class="n">size</span><span class="p">):</span>
-        <span class="n">prot</span> <span class="o">=</span> <span class="n">mmap</span><span class="o">.</span><span class="n">PROT_EXEC</span> <span class="o">|</span> <span class="n">mmap</span><span class="o">.</span><span class="n">PROT_WRITE</span> <span class="o">|</span> <span class="n">mmap</span><span class="o">.</span><span class="n">PROT_READ</span>
-        <span class="k">return</span> <span class="bp">cls</span><span class="p">(</span><span class="o">-</span><span class="mi">1</span><span class="p">,</span> <span class="n">size</span><span class="p">,</span> <span class="n">prot</span><span class="o">=</span><span class="n">prot</span><span class="p">)</span>
-
-
 <span class="k">class</span> <span class="nc">CustomAllocator</span><span class="p">(</span><span class="nb">object</span><span class="p">):</span>
     <span class="n">int_size</span> <span class="o">=</span> <span class="p">{</span><span class="s1">&#39;32bit&#39;</span><span class="p">:</span> <span class="mi">4</span><span class="p">,</span> <span class="s1">&#39;64bit&#39;</span><span class="p">:</span> <span class="mi">8</span><span class="p">}</span>
 
@@ -117,7 +70,10 @@
         <span class="k">return</span> <span class="bp">cls</span><span class="o">.</span><span class="n">int_size</span><span class="p">[</span><span class="n">bits</span><span class="p">]</span>
 
     <span class="k">def</span> <span class="nf">get_new_page</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">size</span><span class="p">):</span>
-        <span class="bp">self</span><span class="o">.</span><span class="n">maps</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">MyMap</span><span class="o">.</span><span class="n">get_map</span><span class="p">(</span><span class="n">size</span><span class="p">))</span>
+        <span class="n">addr</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">VirtualAlloc</span><span class="p">(</span><span class="mi">0</span><span class="p">,</span> <span class="n">size</span><span class="p">,</span> <span class="mh">0x1000</span><span class="p">,</span> <span class="n">gdef</span><span class="o">.</span><span class="n">PAGE_EXECUTE_READWRITE</span><span class="p">)</span>
+        <span class="n">mymap</span> <span class="o">=</span> <span class="p">(</span><span class="n">ctypes</span><span class="o">.</span><span class="n">c_char</span> <span class="o">*</span> <span class="n">size</span><span class="p">)</span><span class="o">.</span><span class="n">from_address</span><span class="p">(</span><span class="n">addr</span><span class="p">)</span>
+        <span class="n">mymap</span><span class="o">.</span><span class="n">addr</span> <span class="o">=</span> <span class="n">addr</span>
+        <span class="bp">self</span><span class="o">.</span><span class="n">maps</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">mymap</span><span class="p">)</span>
         <span class="bp">self</span><span class="o">.</span><span class="n">cur_offset</span> <span class="o">=</span> <span class="mi">0</span>
         <span class="bp">self</span><span class="o">.</span><span class="n">cur_page_size</span> <span class="o">=</span> <span class="n">size</span>
 
@@ -141,6 +97,20 @@
         <span class="bp">self</span><span class="o">.</span><span class="n">cur_offset</span> <span class="o">+=</span> <span class="n">size</span>
         <span class="k">return</span> <span class="n">addr</span>
 
+    <span class="k">def</span> <span class="nf">close</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
+        <span class="n">maps</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">maps</span>
+        <span class="bp">self</span><span class="o">.</span><span class="n">maps</span> <span class="o">=</span> <span class="p">[]</span>
+        <span class="bp">self</span><span class="o">.</span><span class="n">cur_offset</span> <span class="o">=</span> <span class="mi">0</span>
+        <span class="bp">self</span><span class="o">.</span><span class="n">cur_page_size</span> <span class="o">=</span> <span class="mi">0</span>
+        <span class="k">if</span> <span class="nb">getattr</span><span class="p">(</span><span class="n">sys</span><span class="p">,</span> <span class="s2">&quot;path&quot;</span><span class="p">,</span> <span class="kc">None</span><span class="p">)</span> <span class="ow">is</span> <span class="kc">None</span><span class="p">:</span>
+            <span class="c1"># Path is None -&gt; Python shutdown</span>
+            <span class="k">return</span>
+        <span class="k">for</span> <span class="n">mymap</span> <span class="ow">in</span> <span class="n">maps</span><span class="p">:</span>
+            <span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">VirtualFree</span><span class="p">(</span><span class="n">mymap</span><span class="o">.</span><span class="n">addr</span><span class="p">,</span> <span class="n">dwFreeType</span><span class="o">=</span><span class="n">gdef</span><span class="o">.</span><span class="n">MEM_RELEASE</span><span class="p">)</span>
+
+    <span class="k">def</span> <span class="fm">__del__</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
+        <span class="bp">self</span><span class="o">.</span><span class="n">close</span><span class="p">()</span>
+
 <span class="n">allocator</span> <span class="o">=</span> <span class="n">CustomAllocator</span><span class="p">()</span>
 
 

docs/build/html/_modules/windows/native_exec/simple_x86.html

@@ -70,6 +70,12 @@
         <span class="k">if</span> <span class="n">size</span> <span class="o">&gt;</span> <span class="nb">len</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">array</span><span class="p">):</span>
             <span class="bp">self</span><span class="o">.</span><span class="n">array</span> <span class="o">=</span> <span class="p">([</span><span class="mi">0</span><span class="p">]</span> <span class="o">*</span> <span class="p">(</span><span class="n">size</span> <span class="o">-</span> <span class="nb">len</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">array</span><span class="p">)))</span> <span class="o">+</span> <span class="bp">self</span><span class="o">.</span><span class="n">array</span>
 
+    <span class="k">def</span> <span class="nf">copy</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
+        <span class="n">new</span> <span class="o">=</span> <span class="nb">type</span><span class="p">(</span><span class="bp">self</span><span class="p">)(</span><span class="mi">0</span><span class="p">,</span> <span class="s2">&quot;&quot;</span><span class="p">)</span>
+        <span class="n">new</span><span class="o">.</span><span class="n">size</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">size</span>
+        <span class="n">new</span><span class="o">.</span><span class="n">array</span> <span class="o">=</span> <span class="nb">list</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">array</span><span class="p">)</span>
+        <span class="k">return</span> <span class="n">new</span>
+
     <span class="k">def</span> <span class="nf">dump</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
         <span class="n">res</span> <span class="o">=</span> <span class="p">[]</span>
         <span class="k">for</span> <span class="n">i</span> <span class="ow">in</span> <span class="nb">range</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">size</span> <span class="o">//</span> <span class="mi">8</span><span class="p">):</span>
@@ -325,7 +331,7 @@
 
 <span class="k">class</span> <span class="nc">RawBits</span><span class="p">(</span><span class="n">BitArray</span><span class="p">):</span>
     <span class="k">def</span> <span class="nf">accept_arg</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">args</span><span class="p">,</span> <span class="n">instr_state</span><span class="p">):</span>
-        <span class="k">return</span> <span class="p">(</span><span class="mi">0</span><span class="p">,</span> <span class="bp">self</span><span class="p">)</span>
+        <span class="k">return</span> <span class="p">(</span><span class="mi">0</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">copy</span><span class="p">())</span>
 
 
 <span class="c1"># Immediat value logic</span>
@@ -446,8 +452,6 @@
 
 
 
-
-
 <span class="k">class</span> <span class="nc">ModRM</span><span class="p">(</span><span class="nb">object</span><span class="p">):</span>
     <span class="k">def</span> <span class="fm">__init__</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">sub_modrm</span><span class="p">,</span> <span class="n">accept_reverse</span><span class="o">=</span><span class="kc">True</span><span class="p">,</span> <span class="n">has_direction_bit</span><span class="o">=</span><span class="kc">True</span><span class="p">):</span>
         <span class="bp">self</span><span class="o">.</span><span class="n">accept_reverse</span> <span class="o">=</span> <span class="n">accept_reverse</span>
@@ -480,7 +484,6 @@
     <span class="k">def</span> <span class="nf">match</span><span class="p">(</span><span class="bp">cls</span><span class="p">,</span> <span class="n">arg1</span><span class="p">,</span> <span class="n">arg2</span><span class="p">):</span>
         <span class="k">return</span> <span class="n">X86</span><span class="o">.</span><span class="n">is_reg</span><span class="p">(</span><span class="n">arg1</span><span class="p">)</span> <span class="ow">and</span> <span class="n">X86</span><span class="o">.</span><span class="n">is_reg</span><span class="p">(</span><span class="n">arg2</span><span class="p">)</span>
 
-
     <span class="k">def</span> <span class="fm">__init__</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">arg1</span><span class="p">,</span> <span class="n">arg2</span><span class="p">,</span> <span class="nb">reversed</span><span class="p">,</span> <span class="n">instr_state</span><span class="p">):</span>
         <span class="bp">self</span><span class="o">.</span><span class="n">mod</span> <span class="o">=</span> <span class="n">BitArray</span><span class="p">(</span><span class="mi">2</span><span class="p">,</span> <span class="s2">&quot;11&quot;</span><span class="p">)</span>
         <span class="k">if</span> <span class="n">X86</span><span class="o">.</span><span class="n">reg_size</span><span class="p">(</span><span class="n">arg1</span><span class="p">)</span> <span class="o">!=</span> <span class="n">X86</span><span class="o">.</span><span class="n">reg_size</span><span class="p">(</span><span class="n">arg2</span><span class="p">):</span>
@@ -643,6 +646,7 @@
     <span class="n">encoding</span> <span class="o">=</span> <span class="p">[]</span>
 
     <span class="k">def</span> <span class="fm">__init__</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="o">*</span><span class="n">initial_args</span><span class="p">):</span>
+        <span class="c1"># print(self, initial_args)</span>
         <span class="k">for</span> <span class="n">type_encoding</span> <span class="ow">in</span> <span class="bp">self</span><span class="o">.</span><span class="n">encoding</span><span class="p">:</span>
             <span class="n">args</span> <span class="o">=</span> <span class="nb">list</span><span class="p">(</span><span class="n">initial_args</span><span class="p">)</span>
             <span class="n">prefix</span> <span class="o">=</span> <span class="p">[]</span>
@@ -662,6 +666,7 @@
         <span class="k">raise</span> <span class="ne">ValueError</span><span class="p">(</span><span class="s2">&quot;Cannot encode &lt;</span><span class="si">{0}</span><span class="s2"> </span><span class="si">{1}</span><span class="s2">&gt;:(&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="nb">type</span><span class="p">(</span><span class="bp">self</span><span class="p">)</span><span class="o">.</span><span class="vm">__name__</span><span class="p">,</span> <span class="n">initial_args</span><span class="p">))</span>
 
     <span class="k">def</span> <span class="nf">get_code</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
+        <span class="c1"># print(self.value)</span>
         <span class="n">prefix_opcode</span> <span class="o">=</span> <span class="sa">b</span><span class="s2">&quot;&quot;</span><span class="o">.</span><span class="n">join</span><span class="p">(</span><span class="nb">chr</span><span class="p">(</span><span class="n">p</span><span class="o">.</span><span class="n">PREFIX_VALUE</span><span class="p">)</span> <span class="k">for</span> <span class="n">p</span> <span class="ow">in</span> <span class="bp">self</span><span class="o">.</span><span class="n">prefix</span><span class="p">)</span>
         <span class="k">return</span> <span class="n">prefix_opcode</span> <span class="o">+</span> <span class="nb">bytes</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">value</span><span class="o">.</span><span class="n">dump</span><span class="p">())</span>
 
@@ -743,10 +748,10 @@
                 <span class="p">(</span><span class="n">RawBits</span><span class="o">.</span><span class="n">from_int</span><span class="p">(</span><span class="mi">8</span><span class="p">,</span> <span class="mh">0xff</span><span class="p">),</span> <span class="n">Slash</span><span class="p">(</span><span class="mi">2</span><span class="p">)),</span>
                 <span class="p">(</span><span class="n">RawBits</span><span class="o">.</span><span class="n">from_int</span><span class="p">(</span><span class="mi">8</span><span class="p">,</span> <span class="mh">0x9a</span><span class="p">),</span> <span class="n">SegmentSelectorAbsoluteAddr</span><span class="p">())]</span>
 
-<span class="k">class</span> <span class="nc">Jmp</span><span class="p">(</span><span class="n">JmpType</span><span class="p">):</span>
+<div class="viewcode-block" id="Jmp"><a class="viewcode-back" href="../../../native_exec.html#windows.native_exec.simple_x86.Jmp">[docs]</a><span class="k">class</span> <span class="nc">Jmp</span><span class="p">(</span><span class="n">JmpType</span><span class="p">):</span>
     <span class="n">encoding</span> <span class="o">=</span> <span class="p">[(</span><span class="n">RawBits</span><span class="o">.</span><span class="n">from_int</span><span class="p">(</span><span class="mi">8</span><span class="p">,</span> <span class="mh">0xeb</span><span class="p">),</span> <span class="n">JmpImm8</span><span class="p">(</span><span class="mi">2</span><span class="p">)),</span>
                 <span class="p">(</span><span class="n">RawBits</span><span class="o">.</span><span class="n">from_int</span><span class="p">(</span><span class="mi">8</span><span class="p">,</span> <span class="mh">0xe9</span><span class="p">),</span> <span class="n">JmpImm32</span><span class="p">(</span><span class="mi">5</span><span class="p">)),</span>
-                <span class="p">(</span><span class="n">RawBits</span><span class="o">.</span><span class="n">from_int</span><span class="p">(</span><span class="mi">8</span><span class="p">,</span> <span class="mh">0xea</span><span class="p">),</span> <span class="n">SegmentSelectorAbsoluteAddr</span><span class="p">())]</span>
+                <span class="p">(</span><span class="n">RawBits</span><span class="o">.</span><span class="n">from_int</span><span class="p">(</span><span class="mi">8</span><span class="p">,</span> <span class="mh">0xea</span><span class="p">),</span> <span class="n">SegmentSelectorAbsoluteAddr</span><span class="p">())]</span></div>
 
 
 <span class="k">class</span> <span class="nc">Jz</span><span class="p">(</span><span class="n">JmpType</span><span class="p">):</span>
@@ -754,6 +759,9 @@
                 <span class="p">(</span><span class="n">RawBits</span><span class="o">.</span><span class="n">from_int</span><span class="p">(</span><span class="mi">16</span><span class="p">,</span> <span class="mh">0x0f84</span><span class="p">),</span> <span class="n">JmpImm32</span><span class="p">(</span><span class="mi">6</span><span class="p">))]</span>
 
 
+<span class="n">Je</span> <span class="o">=</span> <span class="n">Jz</span>
+
+
 <span class="k">class</span> <span class="nc">Jnz</span><span class="p">(</span><span class="n">JmpType</span><span class="p">):</span>
     <span class="n">encoding</span> <span class="o">=</span> <span class="p">[(</span><span class="n">RawBits</span><span class="o">.</span><span class="n">from_int</span><span class="p">(</span><span class="mi">8</span><span class="p">,</span> <span class="mh">0x75</span><span class="p">),</span> <span class="n">JmpImm8</span><span class="p">(</span><span class="mi">2</span><span class="p">)),</span>
                 <span class="p">(</span><span class="n">RawBits</span><span class="o">.</span><span class="n">from_int</span><span class="p">(</span><span class="mi">16</span><span class="p">,</span> <span class="mh">0x0f85</span><span class="p">),</span> <span class="n">JmpImm32</span><span class="p">(</span><span class="mi">6</span><span class="p">))]</span>
@@ -813,13 +821,13 @@
                 <span class="p">(</span><span class="n">RawBits</span><span class="o">.</span><span class="n">from_int</span><span class="p">(</span><span class="mi">8</span><span class="p">,</span> <span class="mh">0x29</span><span class="p">),</span> <span class="n">ModRM</span><span class="p">([</span><span class="n">ModRM_REG__REG</span><span class="p">,</span> <span class="n">ModRM_REG__MEM</span><span class="p">]))]</span>
 
 
-<span class="k">class</span> <span class="nc">Mov</span><span class="p">(</span><span class="n">Instruction</span><span class="p">):</span>
+<div class="viewcode-block" id="Mov"><a class="viewcode-back" href="../../../native_exec.html#windows.native_exec.simple_x86.Mov">[docs]</a><span class="k">class</span> <span class="nc">Mov</span><span class="p">(</span><span class="n">Instruction</span><span class="p">):</span>
     <span class="n">encoding</span> <span class="o">=</span> <span class="p">[(</span><span class="n">RawBits</span><span class="o">.</span><span class="n">from_int</span><span class="p">(</span><span class="mi">8</span><span class="p">,</span> <span class="mh">0x89</span><span class="p">),</span> <span class="n">ModRM</span><span class="p">([</span><span class="n">ModRM_REG__REG</span><span class="p">,</span> <span class="n">ModRM_REG__MEM</span><span class="p">])),</span>
                 <span class="p">(</span><span class="n">RawBits</span><span class="o">.</span><span class="n">from_int</span><span class="p">(</span><span class="mi">8</span><span class="p">,</span> <span class="mh">0xc7</span><span class="p">),</span> <span class="n">Slash</span><span class="p">(</span><span class="mi">0</span><span class="p">),</span> <span class="n">Imm32</span><span class="p">()),</span>
                 <span class="p">(</span><span class="n">RawBits</span><span class="o">.</span><span class="n">from_int</span><span class="p">(</span><span class="mi">5</span><span class="p">,</span> <span class="mh">0xB8</span> <span class="o">&gt;&gt;</span> <span class="mi">3</span><span class="p">),</span> <span class="n">X86RegisterSelector</span><span class="p">(),</span> <span class="n">Imm32</span><span class="p">()),</span>
                 <span class="p">(</span><span class="n">RawBits</span><span class="o">.</span><span class="n">from_int</span><span class="p">(</span><span class="mi">8</span><span class="p">,</span> <span class="mh">0x8C</span><span class="p">),</span> <span class="n">ModRM</span><span class="p">([</span><span class="n">ModRM_REG__SEGREG</span><span class="p">])),</span>
                 <span class="p">(</span><span class="n">RawBits</span><span class="o">.</span><span class="n">from_int</span><span class="p">(</span><span class="mi">16</span><span class="p">,</span> <span class="mh">0x0f20</span><span class="p">),</span> <span class="n">ControlRegisterModRM</span><span class="p">(</span><span class="n">writecr</span><span class="o">=</span><span class="kc">False</span><span class="p">)),</span>
-                <span class="p">(</span><span class="n">RawBits</span><span class="o">.</span><span class="n">from_int</span><span class="p">(</span><span class="mi">16</span><span class="p">,</span> <span class="mh">0x0f22</span><span class="p">),</span> <span class="n">ControlRegisterModRM</span><span class="p">(</span><span class="n">writecr</span><span class="o">=</span><span class="kc">True</span><span class="p">))]</span>
+                <span class="p">(</span><span class="n">RawBits</span><span class="o">.</span><span class="n">from_int</span><span class="p">(</span><span class="mi">16</span><span class="p">,</span> <span class="mh">0x0f22</span><span class="p">),</span> <span class="n">ControlRegisterModRM</span><span class="p">(</span><span class="n">writecr</span><span class="o">=</span><span class="kc">True</span><span class="p">))]</span></div>
 
 
 <span class="k">class</span> <span class="nc">Movsb</span><span class="p">(</span><span class="n">Instruction</span><span class="p">):</span>
@@ -830,6 +838,22 @@
     <span class="n">encoding</span> <span class="o">=</span> <span class="p">[(</span><span class="n">RawBits</span><span class="o">.</span><span class="n">from_int</span><span class="p">(</span><span class="mi">8</span><span class="p">,</span> <span class="mh">0xa5</span><span class="p">),)]</span>
 
 
+<span class="k">class</span> <span class="nc">Pushfd</span><span class="p">(</span><span class="n">Instruction</span><span class="p">):</span>
+    <span class="n">encoding</span> <span class="o">=</span> <span class="p">[(</span><span class="n">RawBits</span><span class="o">.</span><span class="n">from_int</span><span class="p">(</span><span class="mi">8</span><span class="p">,</span> <span class="mh">0x9c</span><span class="p">),)]</span>
+
+
+<span class="k">class</span> <span class="nc">Pushad</span><span class="p">(</span><span class="n">Instruction</span><span class="p">):</span>
+    <span class="n">encoding</span> <span class="o">=</span> <span class="p">[(</span><span class="n">RawBits</span><span class="o">.</span><span class="n">from_int</span><span class="p">(</span><span class="mi">8</span><span class="p">,</span> <span class="mh">0x60</span><span class="p">),)]</span>
+
+
+<span class="k">class</span> <span class="nc">Popfd</span><span class="p">(</span><span class="n">Instruction</span><span class="p">):</span>
+    <span class="n">encoding</span> <span class="o">=</span> <span class="p">[(</span><span class="n">RawBits</span><span class="o">.</span><span class="n">from_int</span><span class="p">(</span><span class="mi">8</span><span class="p">,</span> <span class="mh">0x9d</span><span class="p">),)]</span>
+
+
+<span class="k">class</span> <span class="nc">Popad</span><span class="p">(</span><span class="n">Instruction</span><span class="p">):</span>
+    <span class="n">encoding</span> <span class="o">=</span> <span class="p">[(</span><span class="n">RawBits</span><span class="o">.</span><span class="n">from_int</span><span class="p">(</span><span class="mi">8</span><span class="p">,</span> <span class="mh">0x61</span><span class="p">),)]</span>
+
+
 <span class="k">class</span> <span class="nc">Lea</span><span class="p">(</span><span class="n">Instruction</span><span class="p">):</span>
     <span class="n">encoding</span> <span class="o">=</span> <span class="p">[(</span><span class="n">RawBits</span><span class="o">.</span><span class="n">from_int</span><span class="p">(</span><span class="mi">8</span><span class="p">,</span> <span class="mh">0x8d</span><span class="p">),</span> <span class="n">ModRM</span><span class="p">([</span><span class="n">ModRM_REG__MEM</span><span class="p">],</span> <span class="n">accept_reverse</span><span class="o">=</span><span class="kc">False</span><span class="p">,</span> <span class="n">has_direction_bit</span><span class="o">=</span><span class="kc">False</span><span class="p">))]</span>
 
@@ -841,7 +865,7 @@
 
 
 <span class="k">class</span> <span class="nc">Test</span><span class="p">(</span><span class="n">Instruction</span><span class="p">):</span>
-    <span class="n">encoding</span> <span class="o">=</span> <span class="p">[(</span><span class="n">RawBits</span><span class="o">.</span><span class="n">from_int</span><span class="p">(</span><span class="mi">8</span><span class="p">,</span> <span class="mh">0xf7</span><span class="p">),</span> <span class="n">Slash</span><span class="p">(</span><span class="mi">7</span><span class="p">),</span> <span class="n">Imm32</span><span class="p">()),</span>
+    <span class="n">encoding</span> <span class="o">=</span> <span class="p">[(</span><span class="n">RawBits</span><span class="o">.</span><span class="n">from_int</span><span class="p">(</span><span class="mi">8</span><span class="p">,</span> <span class="mh">0xf7</span><span class="p">),</span> <span class="n">Slash</span><span class="p">(</span><span class="mi">0</span><span class="p">),</span> <span class="n">Imm32</span><span class="p">()),</span>
                 <span class="p">(</span><span class="n">RawBits</span><span class="o">.</span><span class="n">from_int</span><span class="p">(</span><span class="mi">8</span><span class="p">,</span> <span class="mh">0x85</span><span class="p">),</span> <span class="n">ModRM</span><span class="p">([</span><span class="n">ModRM_REG__REG</span><span class="p">,</span> <span class="n">ModRM_REG__MEM</span><span class="p">],</span> <span class="n">has_direction_bit</span><span class="o">=</span><span class="kc">False</span><span class="p">))]</span>
 
 

docs/build/html/_modules/windows/pe_parse.html

@@ -122,6 +122,14 @@
         <span class="p">(</span><span class="s2">&quot;AddressOfData&quot;</span><span class="p">,</span> <span class="n">PVOID</span><span class="p">)</span>
     <span class="p">]</span>
 
+<span class="c1"># Special case for .NET PE32 rewrite as 64b</span>
+<span class="c1"># We may have a PE in a 64b process with a 32b IAT</span>
+<span class="k">class</span> <span class="nc">THUNK_DATA_32</span><span class="p">(</span><span class="n">ctypes</span><span class="o">.</span><span class="n">Union</span><span class="p">):</span>
+    <span class="n">_fields_</span> <span class="o">=</span> <span class="p">[</span>
+        <span class="p">(</span><span class="s2">&quot;Ordinal&quot;</span><span class="p">,</span> <span class="n">DWORD</span><span class="p">),</span>
+        <span class="p">(</span><span class="s2">&quot;AddressOfData&quot;</span><span class="p">,</span> <span class="n">DWORD</span><span class="p">)</span>
+    <span class="p">]</span>
+
 <span class="k">class</span> <span class="nc">IMPORT_BY_NAME</span><span class="p">(</span><span class="n">ctypes</span><span class="o">.</span><span class="n">Structure</span><span class="p">):</span>
     <span class="n">_fields_</span> <span class="o">=</span> <span class="p">[</span>
         <span class="p">(</span><span class="s2">&quot;Hint&quot;</span><span class="p">,</span> <span class="n">WORD</span><span class="p">),</span>
@@ -224,7 +232,6 @@
     <span class="k">def</span> <span class="nf">on_destroy</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="o">*</span><span class="n">args</span><span class="p">):</span>
         <span class="c1"># We cannot know if the hook was enabled here..</span>
         <span class="nb">print</span><span class="p">(</span><span class="s2">&quot;DESTROY: </span><span class="si">{0}</span><span class="s2"> -&gt; &quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">args</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">enabled</span><span class="p">))</span>
-        <span class="c1"># import pdb;pdb.set_trace()</span>
         <span class="c1"># print(args[0]())</span>
 
 <div class="viewcode-block" id="IATEntry.remove_hook"><a class="viewcode-back" href="../../process.html#windows.pe_parse.IATEntry.remove_hook">[docs]</a>    <span class="k">def</span> <span class="nf">remove_hook</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
@@ -242,11 +249,16 @@
 
 
 <span class="k">class</span> <span class="nc">IMAGE_IMPORT_DESCRIPTOR</span><span class="p">(</span><span class="n">IMAGE_IMPORT_DESCRIPTOR</span><span class="p">):</span> <span class="c1"># TODO: use explicite name winstructs.IMAGE_IMPORT_DESCRIPTOR</span>
-    <span class="k">def</span> <span class="nf">get_INT</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
+    <span class="k">def</span> <span class="nf">get_INT</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">pe</span><span class="p">):</span>
+        <span class="n">THUNK_DATA_TYPE</span> <span class="o">=</span> <span class="n">THUNK_DATA</span>
         <span class="k">if</span> <span class="ow">not</span> <span class="bp">self</span><span class="o">.</span><span class="n">OriginalFirstThunk</span><span class="p">:</span>
             <span class="k">return</span> <span class="kc">None</span>
+        <span class="c1"># We may have 32bits PE mapped in 32bits process (thanks to .NET PE)</span>
+        <span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">target</span> <span class="ow">is</span> <span class="kc">None</span> <span class="ow">and</span> <span class="n">pe</span><span class="o">.</span><span class="n">bitness</span> <span class="o">!=</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">bitness</span><span class="p">:</span>
+            <span class="k">assert</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">64</span> <span class="ow">and</span> <span class="n">pe</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">32</span><span class="p">,</span> <span class="s2">&quot;Mapped 64b PE in current process 32b not handled&quot;</span>
+            <span class="n">THUNK_DATA_TYPE</span> <span class="o">=</span> <span class="n">THUNK_DATA_32</span>
         <span class="n">int_addr</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">OriginalFirstThunk</span> <span class="o">+</span> <span class="bp">self</span><span class="o">.</span><span class="n">baseaddr</span>
-        <span class="n">int_entry</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">transformers</span><span class="o">.</span><span class="n">create_structure_at</span><span class="p">(</span><span class="n">THUNK_DATA</span><span class="p">,</span> <span class="n">int_addr</span><span class="p">)</span>
+        <span class="n">int_entry</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">transformers</span><span class="o">.</span><span class="n">create_structure_at</span><span class="p">(</span><span class="n">THUNK_DATA_TYPE</span><span class="p">,</span> <span class="n">int_addr</span><span class="p">)</span>
         <span class="n">res</span> <span class="o">=</span> <span class="p">[]</span>
         <span class="k">while</span> <span class="n">int_entry</span><span class="o">.</span><span class="n">Ordinal</span><span class="p">:</span>
             <span class="k">if</span> <span class="n">int_entry</span><span class="o">.</span><span class="n">Ordinal</span> <span class="o">&amp;</span> <span class="bp">self</span><span class="o">.</span><span class="n">IMAGE_ORDINAL_FLAG</span><span class="p">:</span>
@@ -254,23 +266,24 @@
             <span class="k">else</span><span class="p">:</span>
                 <span class="n">import_by_name</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">transformers</span><span class="o">.</span><span class="n">create_structure_at</span><span class="p">(</span><span class="n">IMPORT_BY_NAME</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">baseaddr</span> <span class="o">+</span> <span class="n">int_entry</span><span class="o">.</span><span class="n">AddressOfData</span><span class="p">)</span>
                 <span class="n">name_address</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">baseaddr</span> <span class="o">+</span> <span class="n">int_entry</span><span class="o">.</span><span class="n">AddressOfData</span> <span class="o">+</span> <span class="nb">type</span><span class="p">(</span><span class="n">import_by_name</span><span class="p">)</span><span class="o">.</span><span class="n">Name</span><span class="o">.</span><span class="n">offset</span>
-                <span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">target</span> <span class="ow">is</span> <span class="kc">None</span><span class="p">:</span>
-                    <span class="n">name</span> <span class="o">=</span> <span class="n">get_string</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">target</span><span class="p">,</span> <span class="n">name_address</span><span class="p">)</span>
-                <span class="k">else</span><span class="p">:</span>
-                    <span class="n">name</span> <span class="o">=</span> <span class="n">get_string</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">target</span><span class="p">,</span> <span class="n">name_address</span><span class="p">)</span>
+                <span class="n">name</span> <span class="o">=</span> <span class="n">get_string</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">target</span><span class="p">,</span> <span class="n">name_address</span><span class="p">)</span>
                 <span class="n">res</span><span class="o">.</span><span class="n">append</span><span class="p">((</span><span class="n">import_by_name</span><span class="o">.</span><span class="n">Hint</span><span class="p">,</span> <span class="n">name</span><span class="p">))</span>
             <span class="n">int_addr</span> <span class="o">+=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="nb">type</span><span class="p">(</span><span class="n">int_entry</span><span class="p">))</span>
-            <span class="n">int_entry</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">transformers</span><span class="o">.</span><span class="n">create_structure_at</span><span class="p">(</span><span class="n">THUNK_DATA</span><span class="p">,</span> <span class="n">int_addr</span><span class="p">)</span>
+            <span class="n">int_entry</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">transformers</span><span class="o">.</span><span class="n">create_structure_at</span><span class="p">(</span><span class="n">THUNK_DATA_TYPE</span><span class="p">,</span> <span class="n">int_addr</span><span class="p">)</span>
         <span class="k">return</span> <span class="n">res</span>
 
-    <span class="k">def</span> <span class="nf">get_IAT</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
+    <span class="k">def</span> <span class="nf">get_IAT</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">pe</span><span class="p">):</span>
+        <span class="n">THUNK_DATA_TYPE</span> <span class="o">=</span> <span class="n">THUNK_DATA</span>
+        <span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">target</span> <span class="ow">is</span> <span class="kc">None</span> <span class="ow">and</span> <span class="n">pe</span><span class="o">.</span><span class="n">bitness</span> <span class="o">!=</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">bitness</span><span class="p">:</span>
+            <span class="k">assert</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">64</span> <span class="ow">and</span> <span class="n">pe</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">32</span><span class="p">,</span> <span class="s2">&quot;Mapped 64b PE in current process 32b not handled&quot;</span>
+            <span class="n">THUNK_DATA_TYPE</span> <span class="o">=</span> <span class="n">THUNK_DATA_32</span>
         <span class="n">iat_addr</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">FirstThunk</span> <span class="o">+</span> <span class="bp">self</span><span class="o">.</span><span class="n">baseaddr</span>
-        <span class="n">iat_entry</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">transformers</span><span class="o">.</span><span class="n">create_structure_at</span><span class="p">(</span><span class="n">THUNK_DATA</span><span class="p">,</span> <span class="n">iat_addr</span><span class="p">)</span>
+        <span class="n">iat_entry</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">transformers</span><span class="o">.</span><span class="n">create_structure_at</span><span class="p">(</span><span class="n">THUNK_DATA_TYPE</span><span class="p">,</span> <span class="n">iat_addr</span><span class="p">)</span>
         <span class="n">res</span> <span class="o">=</span> <span class="p">[]</span>
         <span class="k">while</span> <span class="n">iat_entry</span><span class="o">.</span><span class="n">Ordinal</span><span class="p">:</span>
             <span class="n">res</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">IATEntry</span><span class="o">.</span><span class="n">create</span><span class="p">(</span><span class="n">iat_addr</span><span class="p">,</span> <span class="o">-</span><span class="mi">1</span><span class="p">,</span> <span class="s2">&quot;??&quot;</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">target</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">transformers</span><span class="p">))</span>
             <span class="n">iat_addr</span> <span class="o">+=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="nb">type</span><span class="p">(</span><span class="n">iat_entry</span><span class="p">))</span>
-            <span class="n">iat_entry</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">transformers</span><span class="o">.</span><span class="n">create_structure_at</span><span class="p">(</span><span class="n">THUNK_DATA</span><span class="p">,</span> <span class="n">iat_addr</span><span class="p">)</span>
+            <span class="n">iat_entry</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">transformers</span><span class="o">.</span><span class="n">create_structure_at</span><span class="p">(</span><span class="n">THUNK_DATA_TYPE</span><span class="p">,</span> <span class="n">iat_addr</span><span class="p">)</span>
         <span class="k">return</span> <span class="n">res</span>
 
     <span class="nd">@classmethod</span>
@@ -356,21 +369,37 @@
             <span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">transformers</span><span class="o">.</span><span class="n">create_structure_at</span><span class="p">(</span><span class="n">IMAGE_NT_HEADERS32</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">baseaddr</span> <span class="o">+</span> <span class="n">offset</span><span class="p">)</span>
         <span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">transformers</span><span class="o">.</span><span class="n">create_structure_at</span><span class="p">(</span><span class="n">IMAGE_NT_HEADERS64</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">baseaddr</span> <span class="o">+</span> <span class="n">offset</span><span class="p">)</span>
 
+
+    <span class="n">STANDARD_OPTIONAL_HEADER_TYPE_PER_MAGIC</span> <span class="o">=</span> <span class="p">{</span>
+        <span class="n">IMAGE_NT_OPTIONAL_HDR32_MAGIC</span><span class="p">:</span> <span class="n">IMAGE_OPTIONAL_HEADER32</span><span class="p">,</span>
+        <span class="n">IMAGE_NT_OPTIONAL_HDR64_MAGIC</span><span class="p">:</span> <span class="n">IMAGE_OPTIONAL_HEADER64</span><span class="p">,</span>
+    <span class="p">}</span>
+
+    <span class="n">STANDARD_OPTIONAL_HEADER_SIZE_PER_MAGIC</span> <span class="o">=</span> <span class="p">(</span>
+        <span class="p">(</span><span class="n">IMAGE_NT_OPTIONAL_HDR32_MAGIC</span><span class="p">,</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">IMAGE_OPTIONAL_HEADER32</span><span class="p">)),</span>
+        <span class="p">(</span><span class="n">IMAGE_NT_OPTIONAL_HDR64_MAGIC</span><span class="p">,</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">IMAGE_OPTIONAL_HEADER64</span><span class="p">)),</span>
+    <span class="p">)</span>
+
     <span class="k">def</span> <span class="nf">get_OptionalHeader</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
-        <span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">get_NT_HEADER</span><span class="p">()</span><span class="o">.</span><span class="n">OptionalHeader</span>
+        <span class="c1"># We can have a 32bits PE with a 64 bits OptionalHeader</span>
+        <span class="c1"># Ex  : PE32 .NET that allow to be loaded in 64b process</span>
+        <span class="c1"># See: https://github.com/dotnet/runtime/blob/8bbe33819464216becffb7cf8b7ea8dd3bab5836/src/coreclr/src/vm/peimagelayout.cpp#L599</span>
+        <span class="c1"># In this case the OptionalHeader is transformed in 64bits &amp; OptionalHeader.Magic is changed accordingly</span>
+        <span class="c1"># So we cannot just rely on get_NT_HEADER() to give us the correct OptionalHeader type. some re-check are required</span>
+        <span class="n">default_opth</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">get_NT_HEADER</span><span class="p">()</span><span class="o">.</span><span class="n">OptionalHeader</span>
+        <span class="c1"># Cannot juste compare types with type(default_opth) as it may be a remoteType</span>
+        <span class="n">current_opth_infos</span> <span class="o">=</span> <span class="p">(</span><span class="n">default_opth</span><span class="o">.</span><span class="n">Magic</span><span class="p">,</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">default_opth</span><span class="p">))</span>
+        <span class="k">if</span> <span class="n">current_opth_infos</span> <span class="ow">in</span> <span class="bp">self</span><span class="o">.</span><span class="n">STANDARD_OPTIONAL_HEADER_SIZE_PER_MAGIC</span><span class="p">:</span>
+            <span class="c1"># The default OptionalHeader structure match what we expect based on the magic (most of the cases)</span>
+            <span class="k">return</span> <span class="n">default_opth</span>
+        <span class="c1"># Mismatch -&gt; PE32 remapped as 64b (with OptionalHeader rewrite)</span>
+        <span class="c1"># Remap the correct OptionalHeader</span>
+        <span class="n">opt_header_real_type</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">STANDARD_OPTIONAL_HEADER_TYPE_PER_MAGIC</span><span class="p">[</span><span class="n">default_opth</span><span class="o">.</span><span class="n">Magic</span><span class="p">]</span>
+        <span class="n">opt_header_addr</span> <span class="o">=</span> <span class="n">default_opth</span><span class="o">.</span><span class="n">_base_addr</span> <span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">target</span> <span class="k">else</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">addressof</span><span class="p">(</span><span class="n">default_opth</span><span class="p">)</span>
+        <span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">transformers</span><span class="o">.</span><span class="n">create_structure_at</span><span class="p">(</span><span class="n">opt_header_real_type</span><span class="p">,</span> <span class="n">opt_header_addr</span><span class="p">)</span>
 
     <span class="k">def</span> <span class="nf">get_DataDirectory</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
-        <span class="c1"># This won&#39;t work if we load a PE32 in a 64bit process</span>
-        <span class="c1"># PE32 .NET...</span>
-        <span class="c1"># return self.get_OptionalHeader().DataDirectory</span>
-        <span class="n">DataDirectory_type</span> <span class="o">=</span> <span class="n">IMAGE_DATA_DIRECTORY</span> <span class="o">*</span> <span class="n">IMAGE_NUMBEROF_DIRECTORY_ENTRIES</span>
-        <span class="n">SizeOfOptionalHeader</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">get_NT_HEADER</span><span class="p">()</span><span class="o">.</span><span class="n">FileHeader</span><span class="o">.</span><span class="n">SizeOfOptionalHeader</span>
-        <span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">target</span> <span class="ow">is</span> <span class="kc">None</span><span class="p">:</span>
-            <span class="n">opt_header_addr</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">addressof</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">get_NT_HEADER</span><span class="p">()</span><span class="o">.</span><span class="n">OptionalHeader</span><span class="p">)</span>
-        <span class="k">else</span><span class="p">:</span>
-            <span class="n">opt_header_addr</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">get_NT_HEADER</span><span class="p">()</span><span class="o">.</span><span class="n">OptionalHeader</span><span class="o">.</span><span class="n">_base_addr</span>
-        <span class="n">DataDirectory_addr</span> <span class="o">=</span> <span class="n">opt_header_addr</span> <span class="o">+</span> <span class="n">SizeOfOptionalHeader</span> <span class="o">-</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">DataDirectory_type</span><span class="p">)</span>
-        <span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">transformers</span><span class="o">.</span><span class="n">create_structure_at</span><span class="p">(</span><span class="n">DataDirectory_type</span><span class="p">,</span> <span class="n">DataDirectory_addr</span><span class="p">)</span>
+        <span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">get_OptionalHeader</span><span class="p">()</span><span class="o">.</span><span class="n">DataDirectory</span>
 
 
     <span class="k">def</span> <span class="nf">get_IMPORT_DESCRIPTORS</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
@@ -422,7 +451,6 @@
         <span class="n">export_end</span> <span class="o">=</span> <span class="n">export_start</span> <span class="o">+</span> <span class="n">export_datadir</span><span class="o">.</span><span class="n">Size</span>
         <span class="k">if</span> <span class="n">exp_dir</span> <span class="ow">is</span> <span class="kc">None</span><span class="p">:</span>
             <span class="k">return</span> <span class="n">res</span>
-        <span class="c1"># import pdb;pdb.set_trace()</span>
         <span class="n">raw_exports</span> <span class="o">=</span> <span class="n">exp_dir</span><span class="o">.</span><span class="n">get_exports</span><span class="p">()</span>
         <span class="k">for</span> <span class="nb">id</span><span class="p">,</span> <span class="n">rva_addr</span><span class="p">,</span> <span class="n">rva_name</span> <span class="ow">in</span> <span class="n">raw_exports</span><span class="p">:</span>
             <span class="k">if</span> <span class="n">export_start</span> <span class="o">&lt;=</span> <span class="n">rva_addr</span> <span class="o">&lt;</span> <span class="n">export_end</span><span class="p">:</span>
@@ -455,8 +483,8 @@
 <span class="sd">            :type: {:class:`str` : [:class:`IATEntry`]}&quot;&quot;&quot;</span>
         <span class="n">res</span> <span class="o">=</span> <span class="p">{}</span>
         <span class="k">for</span> <span class="n">import_descriptor</span> <span class="ow">in</span> <span class="bp">self</span><span class="o">.</span><span class="n">get_IMPORT_DESCRIPTORS</span><span class="p">():</span>
-            <span class="n">INT</span> <span class="o">=</span> <span class="n">import_descriptor</span><span class="o">.</span><span class="n">get_INT</span><span class="p">()</span>
-            <span class="n">IAT</span> <span class="o">=</span> <span class="n">import_descriptor</span><span class="o">.</span><span class="n">get_IAT</span><span class="p">()</span>
+            <span class="n">INT</span> <span class="o">=</span> <span class="n">import_descriptor</span><span class="o">.</span><span class="n">get_INT</span><span class="p">(</span><span class="bp">self</span><span class="p">)</span>
+            <span class="n">IAT</span> <span class="o">=</span> <span class="n">import_descriptor</span><span class="o">.</span><span class="n">get_IAT</span><span class="p">(</span><span class="bp">self</span><span class="p">)</span>
             <span class="k">if</span> <span class="n">INT</span> <span class="ow">is</span> <span class="ow">not</span> <span class="kc">None</span><span class="p">:</span>
                 <span class="k">for</span> <span class="n">iat_entry</span><span class="p">,</span> <span class="p">(</span><span class="nb">ord</span><span class="p">,</span> <span class="n">name</span><span class="p">)</span> <span class="ow">in</span> <span class="nb">zip</span><span class="p">(</span><span class="n">IAT</span><span class="p">,</span> <span class="n">INT</span><span class="p">):</span>
                     <span class="c1"># str(name.decode()) -&gt; python2 and python3 compatible for str result</span>

docs/build/html/_modules/windows/utils/winutils.html

@@ -133,16 +133,23 @@
     <span class="n">proc_info</span> <span class="o">=</span> <span class="n">PROCESS_INFORMATION</span><span class="p">()</span>
     <span class="n">lpStartupInfo</span> <span class="o">=</span> <span class="kc">None</span>
     <span class="k">if</span> <span class="n">show_windows</span><span class="p">:</span>
-        <span class="n">StartupInfo</span> <span class="o">=</span> <span class="n">STARTUPINFOA</span><span class="p">()</span>
+        <span class="n">StartupInfo</span> <span class="o">=</span> <span class="n">STARTUPINFOW</span><span class="p">()</span>
         <span class="n">StartupInfo</span><span class="o">.</span><span class="n">cb</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">StartupInfo</span><span class="p">)</span>
         <span class="n">StartupInfo</span><span class="o">.</span><span class="n">dwFlags</span> <span class="o">=</span> <span class="mi">0</span>
         <span class="n">lpStartupInfo</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">byref</span><span class="p">(</span><span class="n">StartupInfo</span><span class="p">)</span>
     <span class="n">lpCommandLine</span> <span class="o">=</span> <span class="kc">None</span>
+    <span class="k">if</span> <span class="nb">isinstance</span><span class="p">(</span><span class="n">path</span><span class="p">,</span> <span class="nb">bytes</span><span class="p">):</span>
+        <span class="n">path</span> <span class="o">=</span> <span class="n">path</span><span class="o">.</span><span class="n">decode</span><span class="p">()</span>
     <span class="k">if</span> <span class="n">args</span><span class="p">:</span>
-        <span class="n">lpCommandLine</span> <span class="o">=</span> <span class="p">(</span><span class="sa">b</span><span class="s2">&quot; &quot;</span><span class="o">.</span><span class="n">join</span><span class="p">([</span><span class="n">a</span> <span class="k">for</span> <span class="n">a</span> <span class="ow">in</span> <span class="n">args</span><span class="p">]))</span>
-    <span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">CreateProcessA</span><span class="p">(</span><span class="n">path</span><span class="p">,</span> <span class="n">lpCommandLine</span><span class="o">=</span><span class="n">lpCommandLine</span><span class="p">,</span> <span class="n">dwCreationFlags</span><span class="o">=</span><span class="n">dwCreationFlags</span><span class="p">,</span> <span class="n">lpProcessInformation</span><span class="o">=</span><span class="n">ctypes</span><span class="o">.</span><span class="n">byref</span><span class="p">(</span><span class="n">proc_info</span><span class="p">),</span> <span class="n">lpStartupInfo</span><span class="o">=</span><span class="n">lpStartupInfo</span><span class="p">)</span>
-    <span class="n">dbgprint</span><span class="p">(</span><span class="s2">&quot;CreateProcessA new process handle </span><span class="si">{:#x}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">proc_info</span><span class="o">.</span><span class="n">hProcess</span><span class="p">),</span> <span class="s2">&quot;HANDLE&quot;</span><span class="p">)</span>
-    <span class="n">dbgprint</span><span class="p">(</span><span class="s2">&quot;CreateProcessA new thread handle </span><span class="si">{:#x}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">proc_info</span><span class="o">.</span><span class="n">hThread</span><span class="p">),</span> <span class="s2">&quot;HANDLE&quot;</span><span class="p">)</span>
+        <span class="n">unicode_args</span> <span class="o">=</span> <span class="p">[]</span>
+        <span class="k">for</span> <span class="n">arg</span> <span class="ow">in</span> <span class="n">args</span><span class="p">:</span>
+            <span class="k">if</span> <span class="nb">isinstance</span><span class="p">(</span><span class="n">arg</span><span class="p">,</span> <span class="nb">bytes</span><span class="p">):</span>
+                <span class="n">arg</span> <span class="o">=</span> <span class="n">arg</span><span class="o">.</span><span class="n">decode</span><span class="p">()</span>
+            <span class="n">unicode_args</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">arg</span><span class="p">)</span>
+        <span class="n">lpCommandLine</span> <span class="o">=</span> <span class="p">(</span><span class="s2">&quot; &quot;</span><span class="o">.</span><span class="n">join</span><span class="p">(</span><span class="n">unicode_args</span><span class="p">))</span>
+    <span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">CreateProcessW</span><span class="p">(</span><span class="n">path</span><span class="p">,</span> <span class="n">lpCommandLine</span><span class="o">=</span><span class="n">lpCommandLine</span><span class="p">,</span> <span class="n">dwCreationFlags</span><span class="o">=</span><span class="n">dwCreationFlags</span><span class="p">,</span> <span class="n">lpProcessInformation</span><span class="o">=</span><span class="n">ctypes</span><span class="o">.</span><span class="n">byref</span><span class="p">(</span><span class="n">proc_info</span><span class="p">),</span> <span class="n">lpStartupInfo</span><span class="o">=</span><span class="n">lpStartupInfo</span><span class="p">)</span>
+    <span class="n">dbgprint</span><span class="p">(</span><span class="s2">&quot;CreateProcessW new process handle </span><span class="si">{:#x}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">proc_info</span><span class="o">.</span><span class="n">hProcess</span><span class="p">),</span> <span class="s2">&quot;HANDLE&quot;</span><span class="p">)</span>
+    <span class="n">dbgprint</span><span class="p">(</span><span class="s2">&quot;CreateProcessW new thread handle </span><span class="si">{:#x}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">proc_info</span><span class="o">.</span><span class="n">hThread</span><span class="p">),</span> <span class="s2">&quot;HANDLE&quot;</span><span class="p">)</span>
     <span class="n">dbgprint</span><span class="p">(</span><span class="s2">&quot;Automatic close of thread handle </span><span class="si">{:#x}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">proc_info</span><span class="o">.</span><span class="n">hThread</span><span class="p">),</span> <span class="s2">&quot;HANDLE&quot;</span><span class="p">)</span>
     <span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">CloseHandle</span><span class="p">(</span><span class="n">proc_info</span><span class="o">.</span><span class="n">hThread</span><span class="p">)</span>  <span class="c1"># Give access to a WinThread in addition of the WinProcess ?</span>
     <span class="k">return</span> <span class="n">windows</span><span class="o">.</span><span class="n">winobject</span><span class="o">.</span><span class="n">process</span><span class="o">.</span><span class="n">WinProcess</span><span class="p">(</span><span class="n">pid</span><span class="o">=</span><span class="n">proc_info</span><span class="o">.</span><span class="n">dwProcessId</span><span class="p">,</span> <span class="n">handle</span><span class="o">=</span><span class="n">proc_info</span><span class="o">.</span><span class="n">hProcess</span><span class="p">)</span></div>
@@ -234,15 +241,8 @@
 
 <span class="sd">       https://msdn.microsoft.com/en-us/library/windows/hardware/ff556253(v=vs.85).aspx#_______noumex______</span>
 <span class="sd">    &quot;&quot;&quot;</span>
-    <span class="n">hkresult</span> <span class="o">=</span> <span class="n">HKEY</span><span class="p">()</span>
-    <span class="n">cbsize</span> <span class="o">=</span> <span class="n">DWORD</span><span class="p">(</span><span class="mi">1024</span><span class="p">)</span>
-    <span class="n">bufferres</span> <span class="o">=</span> <span class="p">(</span><span class="n">c_char</span> <span class="o">*</span> <span class="n">cbsize</span><span class="o">.</span><span class="n">value</span><span class="p">)()</span>
-
-    <span class="n">winproxy</span><span class="o">.</span><span class="n">RegOpenKeyExA</span><span class="p">(</span><span class="n">HKEY_LOCAL_MACHINE</span><span class="p">,</span> <span class="s2">&quot;System</span><span class="se">\\</span><span class="s2">CurrentControlSet</span><span class="se">\\</span><span class="s2">Control&quot;</span><span class="p">,</span> <span class="mi">0</span><span class="p">,</span> <span class="n">KEY_READ</span><span class="p">,</span> <span class="n">byref</span><span class="p">(</span><span class="n">hkresult</span><span class="p">))</span>
-    <span class="n">winproxy</span><span class="o">.</span><span class="n">RegGetValueA</span><span class="p">(</span><span class="n">hkresult</span><span class="p">,</span> <span class="kc">None</span><span class="p">,</span> <span class="s2">&quot;SystemStartOptions&quot;</span><span class="p">,</span> <span class="n">RRF_RT_REG_SZ</span><span class="p">,</span> <span class="kc">None</span><span class="p">,</span> <span class="n">byref</span><span class="p">(</span><span class="n">bufferres</span><span class="p">),</span> <span class="n">byref</span><span class="p">(</span><span class="n">cbsize</span><span class="p">))</span>
-    <span class="n">winproxy</span><span class="o">.</span><span class="n">RegCloseKey</span><span class="p">(</span><span class="n">hkresult</span><span class="p">)</span>
-
-    <span class="n">control</span> <span class="o">=</span> <span class="n">bufferres</span><span class="p">[:]</span>
+    <span class="n">options</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">system</span><span class="o">.</span><span class="n">registry</span><span class="p">(</span><span class="sa">r</span><span class="s1">&#39;HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control&#39;</span><span class="p">)[</span><span class="s1">&#39;SystemStartOptions&#39;</span><span class="p">]</span>
+    <span class="n">control</span> <span class="o">=</span> <span class="n">options</span><span class="o">.</span><span class="n">value</span>
     <span class="k">if</span> <span class="s2">&quot;DEBUG&quot;</span> <span class="ow">not</span> <span class="ow">in</span> <span class="n">control</span><span class="p">:</span>
         <span class="c1"># print &quot;[-] Enable debug boot!&quot;</span>
         <span class="c1"># print &quot;&gt; bcdedit /debug on&quot;</span>
@@ -489,7 +489,8 @@
         <span class="k">if</span> <span class="n">volume_info_class</span> <span class="o">==</span> <span class="n">gdef</span><span class="o">.</span><span class="n">FileFsAttributeInformation</span><span class="p">:</span>
             <span class="n">file_name_length</span> <span class="o">=</span> <span class="n">pinfo</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span><span class="o">.</span><span class="n">FileSystemNameLength</span>
         <span class="k">elif</span> <span class="n">volume_info_class</span> <span class="o">==</span> <span class="n">gdef</span><span class="o">.</span><span class="n">FileFsVolumeInformation</span><span class="p">:</span>
-            <span class="n">file_name_length</span> <span class="o">=</span> <span class="n">pinfo</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span><span class="o">.</span><span class="n">VolumeLabelLength</span> <span class="o">+</span> <span class="mh">0x8</span> <span class="c1"># I have seen cases where the VolumeLabelLength is not even enough..</span>
+            <span class="c1"># Well VolumeLabelLength is clearly broken (after testing..) so we are adding some bytes to it..</span>
+            <span class="n">file_name_length</span> <span class="o">=</span> <span class="n">pinfo</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span><span class="o">.</span><span class="n">VolumeLabelLength</span> <span class="o">+</span> <span class="mh">0x100</span> <span class="c1"># I have seen cases where the VolumeLabelLength is not even enough..</span>
         <span class="k">else</span><span class="p">:</span>
             <span class="k">raise</span>
         <span class="n">full_size</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">info</span><span class="p">)</span> <span class="o">+</span> <span class="n">file_name_length</span> <span class="c1"># We add a little too much size for the sake of simplicity</span>
@@ -566,7 +567,7 @@
 <span class="c1">#    addr = windows.winproxy.MapViewOfFile(h, dwDesiredAccess=FILE_MAP_READ, dwNumberOfBytesToMap=1)</span>
 <span class="c1">#    return addr</span>
 
-<span class="k">def</span> <span class="nf">decompress_buffer</span><span class="p">(</span><span class="n">comptype</span><span class="p">,</span> <span class="n">buffer</span><span class="p">,</span> <span class="n">uncompress_size</span><span class="o">=</span><span class="kc">None</span><span class="p">):</span>
+<span class="k">def</span> <span class="nf">decompress_buffer</span><span class="p">(</span><span class="n">buffer</span><span class="p">,</span> <span class="n">comptype</span><span class="o">=</span><span class="n">gdef</span><span class="o">.</span><span class="n">COMPRESSION_FORMAT_LZNT1</span><span class="p">,</span> <span class="n">uncompress_size</span><span class="o">=</span><span class="kc">None</span><span class="p">):</span>
     <span class="k">if</span> <span class="n">uncompress_size</span> <span class="ow">is</span> <span class="kc">None</span><span class="p">:</span>
         <span class="n">uncompress_size</span> <span class="o">=</span> <span class="nb">len</span><span class="p">(</span><span class="n">buffer</span><span class="p">)</span> <span class="o">*</span> <span class="mi">10</span>
     <span class="n">result_size</span> <span class="o">=</span> <span class="n">DWORD</span><span class="p">()</span>
@@ -574,6 +575,20 @@
     <span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">RtlDecompressBuffer</span><span class="p">(</span><span class="n">comptype</span><span class="p">,</span> <span class="n">uncompressed</span><span class="p">,</span> <span class="n">uncompress_size</span><span class="p">,</span> <span class="n">buffer</span><span class="p">,</span> <span class="nb">len</span><span class="p">(</span><span class="n">buffer</span><span class="p">),</span> <span class="n">result_size</span><span class="p">)</span>
     <span class="k">return</span> <span class="n">uncompressed</span><span class="p">[:</span><span class="n">result_size</span><span class="o">.</span><span class="n">value</span><span class="p">]</span>
 
+<span class="k">def</span> <span class="nf">compress_buffer</span><span class="p">(</span><span class="n">buffer</span><span class="p">,</span> <span class="n">comptype</span><span class="o">=</span><span class="n">gdef</span><span class="o">.</span><span class="n">COMPRESSION_FORMAT_LZNT1</span><span class="p">):</span>
+    <span class="n">uncompress_size</span> <span class="o">=</span> <span class="nb">len</span><span class="p">(</span><span class="n">buffer</span><span class="p">)</span>
+    <span class="n">CompressedBufferSize</span> <span class="o">=</span> <span class="n">uncompress_size</span> <span class="o">+</span> <span class="mh">0x1000</span>
+    <span class="n">CompressedBuffer</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">c_buffer</span><span class="p">(</span><span class="n">CompressedBufferSize</span><span class="p">)</span>
+    <span class="n">chunk</span> <span class="o">=</span> <span class="mi">4096</span>
+    <span class="n">final_size</span> <span class="o">=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">DWORD</span><span class="p">()</span>
+    <span class="n">work_space_size</span> <span class="o">=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">ULONG</span><span class="p">()</span>
+    <span class="n">ignore_data</span> <span class="o">=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">ULONG</span><span class="p">()</span>
+
+    <span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">RtlGetCompressionWorkSpaceSize</span><span class="p">(</span><span class="n">comptype</span><span class="p">,</span> <span class="n">work_space_size</span><span class="p">,</span> <span class="n">ignore_data</span><span class="p">)</span>
+    <span class="n">work_space</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">c_buffer</span><span class="p">(</span><span class="n">work_space_size</span><span class="o">.</span><span class="n">value</span><span class="p">)</span>
+    <span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">RtlCompressBuffer</span><span class="p">(</span><span class="n">comptype</span><span class="p">,</span> <span class="n">buffer</span><span class="p">,</span> <span class="n">uncompress_size</span><span class="p">,</span> <span class="n">CompressedBuffer</span><span class="p">,</span> <span class="n">CompressedBufferSize</span><span class="p">,</span> <span class="n">chunk</span><span class="p">,</span> <span class="n">final_size</span><span class="p">,</span> <span class="n">work_space</span><span class="p">)</span>
+    <span class="k">return</span> <span class="n">CompressedBuffer</span><span class="p">[:</span><span class="n">final_size</span><span class="o">.</span><span class="n">value</span><span class="p">]</span>
+
 
 <span class="c1"># sid.py + real SID type ?</span>
 

docs/build/html/_modules/windows/winobject/event_log.html

@@ -53,6 +53,7 @@
 
 <span class="c1"># Helpers</span>
 
+
 <span class="nd">@contextmanager</span>
 <span class="k">def</span> <span class="nf">ClosingEvtHandle</span><span class="p">(</span><span class="n">handle</span><span class="p">):</span>
     <span class="k">try</span><span class="p">:</span>
@@ -225,17 +226,20 @@
         <span class="c1"># Each value wil return 1 node :)</span>
         <span class="n">ctx</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">EvtCreateRenderContext</span><span class="p">(</span><span class="n">nbelt</span><span class="p">,</span> <span class="n">pwstr_rarray</span><span class="p">,</span> <span class="n">gdef</span><span class="o">.</span><span class="n">EvtRenderContextValues</span><span class="p">)</span>
         <span class="n">result</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">render</span><span class="p">(</span><span class="n">ctx</span><span class="p">,</span> <span class="n">gdef</span><span class="o">.</span><span class="n">EvtRenderEventValues</span><span class="p">)</span>
+        <span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">EvtClose</span><span class="p">(</span><span class="n">ctx</span><span class="p">)</span>
         <span class="k">return</span> <span class="p">[</span><span class="n">r</span><span class="o">.</span><span class="n">value</span> <span class="k">for</span> <span class="n">r</span> <span class="ow">in</span> <span class="n">result</span><span class="p">]</span>
 
     <span class="k">def</span> <span class="nf">system_values</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span> <span class="c1"># POC: use this for all @property based on system data ?</span>
         <span class="n">ctx</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">EvtCreateRenderContext</span><span class="p">(</span><span class="mi">0</span><span class="p">,</span> <span class="kc">None</span><span class="p">,</span> <span class="n">gdef</span><span class="o">.</span><span class="n">EvtRenderContextSystem</span><span class="p">)</span>
         <span class="n">result</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">render</span><span class="p">(</span><span class="n">ctx</span><span class="p">,</span> <span class="n">gdef</span><span class="o">.</span><span class="n">EvtRenderEventValues</span><span class="p">)</span>
+        <span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">EvtClose</span><span class="p">(</span><span class="n">ctx</span><span class="p">)</span>
         <span class="k">return</span> <span class="p">[</span><span class="n">r</span><span class="o">.</span><span class="n">value</span> <span class="k">for</span> <span class="n">r</span> <span class="ow">in</span> <span class="n">result</span><span class="p">]</span>
 
 <div class="viewcode-block" id="EvtEvent.event_values"><a class="viewcode-back" href="../../../evtlog.html#windows.winobject.event_log.EvtEvent.event_values">[docs]</a>    <span class="k">def</span> <span class="nf">event_values</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
         <span class="sd">&quot;&quot;&quot;The values of the event in a list&quot;&quot;&quot;</span>
         <span class="n">ctx</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">EvtCreateRenderContext</span><span class="p">(</span><span class="mi">0</span><span class="p">,</span> <span class="kc">None</span><span class="p">,</span> <span class="n">gdef</span><span class="o">.</span><span class="n">EvtRenderContextUser</span><span class="p">)</span>
         <span class="n">result</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">render</span><span class="p">(</span><span class="n">ctx</span><span class="p">,</span> <span class="n">gdef</span><span class="o">.</span><span class="n">EvtRenderEventValues</span><span class="p">)</span>
+        <span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">EvtClose</span><span class="p">(</span><span class="n">ctx</span><span class="p">)</span>
         <span class="k">return</span> <span class="p">[</span><span class="n">r</span><span class="o">.</span><span class="n">value</span> <span class="k">for</span> <span class="n">r</span> <span class="ow">in</span> <span class="n">result</span><span class="p">]</span></div>
 
     <span class="k">def</span> <span class="nf">get_raw_values</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">values</span><span class="p">,</span> <span class="n">flags</span><span class="o">=</span><span class="n">gdef</span><span class="o">.</span><span class="n">EvtRenderContextValues</span><span class="p">):</span>
@@ -247,6 +251,7 @@
         <span class="c1"># Each value will return 1 node :)</span>
         <span class="n">ctx</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">EvtCreateRenderContext</span><span class="p">(</span><span class="n">nbelt</span><span class="p">,</span> <span class="n">pwstr_rarray</span><span class="p">,</span> <span class="n">gdef</span><span class="o">.</span><span class="n">EvtRenderContextValues</span><span class="p">)</span>
         <span class="n">result</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">render</span><span class="p">(</span><span class="n">ctx</span><span class="p">,</span> <span class="n">gdef</span><span class="o">.</span><span class="n">EvtRenderEventValues</span><span class="p">)</span>
+        <span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">EvtClose</span><span class="p">(</span><span class="n">ctx</span><span class="p">)</span>
         <span class="k">return</span> <span class="nb">list</span><span class="p">(</span><span class="n">result</span><span class="p">)</span>
 
 
@@ -490,6 +495,9 @@
 <span class="sd">            List all events with an EventID of 2006:</span>
 <span class="sd">                ``Event/System[EventID=2006]``</span>
 
+<span class="sd">            List all event with a given EventID while searching for a specific field value (Sysmon for the test here)</span>
+<span class="sd">                ``Event/System[EventID=3] and Event/EventData/Data[@Name=&#39;DestinationIp&#39;] and Event/EventData[Data=&#39;10.0.0.2&#39;]``</span>
+
 <span class="sd">        :rtype: :class:`EvtQuery`</span>
 <span class="sd">        &quot;&quot;&quot;</span>
         <span class="k">if</span> <span class="n">ids</span> <span class="ow">and</span> <span class="nb">filter</span><span class="p">:</span>

docs/build/html/_modules/windows/winobject/event_trace.html

@@ -228,17 +228,18 @@
             <span class="k">raise</span> <span class="c1"># Other error -&gt; reraise</span>
         <span class="k">return</span> <span class="kc">True</span></div>
 
-<div class="viewcode-block" id="EtwTrace.start"><a class="viewcode-back" href="../../../etw.html#windows.winobject.event_trace.EtwTrace.start">[docs]</a>    <span class="k">def</span> <span class="nf">start</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">flags</span><span class="o">=</span><span class="mi">0</span><span class="p">):</span>
+<div class="viewcode-block" id="EtwTrace.start"><a class="viewcode-back" href="../../../etw.html#windows.winobject.event_trace.EtwTrace.start">[docs]</a>    <span class="k">def</span> <span class="nf">start</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">flags</span><span class="o">=</span><span class="mi">0</span><span class="p">,</span> <span class="n">mode</span><span class="o">=</span><span class="mi">0</span><span class="p">):</span>
         <span class="sd">&quot;&quot;&quot;Start the tracing&quot;&quot;&quot;</span>
         <span class="n">prop</span> <span class="o">=</span> <span class="n">EventTraceProperties</span><span class="o">.</span><span class="n">create</span><span class="p">()</span>
         <span class="n">prop</span><span class="o">.</span><span class="n">NumberOfBuffers</span> <span class="o">=</span> <span class="mi">42</span>
         <span class="n">prop</span><span class="o">.</span><span class="n">EnableFlags</span> <span class="o">=</span> <span class="n">flags</span>
+        <span class="n">prop</span><span class="o">.</span><span class="n">LogFileMode</span> <span class="o">=</span> <span class="n">mode</span>
         <span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">guid</span><span class="p">:</span>
             <span class="n">prop</span><span class="o">.</span><span class="n">Wnode</span><span class="o">.</span><span class="n">Guid</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">guid</span>
         <span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">logfile</span><span class="p">:</span>
             <span class="n">prop</span><span class="o">.</span><span class="n">logfile</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">logfile</span>
         <span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">name</span><span class="p">:</span> <span class="c1"># Base REAL_TIME on option ? name presence ? logfile presence ?</span>
-            <span class="n">prop</span><span class="o">.</span><span class="n">LogFileMode</span> <span class="o">=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">EVENT_TRACE_REAL_TIME_MODE</span>
+            <span class="n">prop</span><span class="o">.</span><span class="n">LogFileMode</span> <span class="o">|=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">EVENT_TRACE_REAL_TIME_MODE</span>
         <span class="n">handle</span> <span class="o">=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">TRACEHANDLE</span><span class="p">()</span>
         <span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">StartTraceA</span><span class="p">(</span><span class="n">handle</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">name</span><span class="p">,</span> <span class="n">prop</span><span class="p">)</span>
         <span class="k">if</span> <span class="ow">not</span> <span class="bp">self</span><span class="o">.</span><span class="n">guid</span><span class="p">:</span>

docs/build/html/_modules/windows/winobject/process.html

@@ -145,13 +145,13 @@
             <span class="n">xtype</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">remotectypes</span><span class="o">.</span><span class="n">transform_type_to_remote64bits</span><span class="p">(</span><span class="n">PROCESS_BASIC_INFORMATION</span><span class="p">)</span>
             <span class="c1"># Fuck-it &lt;3</span>
             <span class="n">data</span> <span class="o">=</span> <span class="p">(</span><span class="n">ctypes</span><span class="o">.</span><span class="n">c_char</span> <span class="o">*</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">xtype</span><span class="p">))()</span>
-            <span class="n">windows</span><span class="o">.</span><span class="n">syswow64</span><span class="o">.</span><span class="n">NtQueryInformationProcess_32_to_64</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">ProcessInformation</span><span class="o">=</span><span class="n">data</span><span class="p">,</span> <span class="n">ProcessInformationLength</span><span class="o">=</span><span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">xtype</span><span class="p">))</span>
+            <span class="n">windows</span><span class="o">.</span><span class="n">syswow64</span><span class="o">.</span><span class="n">NtQueryInformationProcess_32_to_64</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">limited_handle</span><span class="p">,</span> <span class="n">ProcessInformation</span><span class="o">=</span><span class="n">data</span><span class="p">,</span> <span class="n">ProcessInformationLength</span><span class="o">=</span><span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">xtype</span><span class="p">))</span>
             <span class="c1"># Map a remote64bits(PROCESS_BASIC_INFORMATION) at the address of &#39;data&#39;</span>
             <span class="n">x</span> <span class="o">=</span> <span class="n">xtype</span><span class="p">(</span><span class="n">ctypes</span><span class="o">.</span><span class="n">addressof</span><span class="p">(</span><span class="n">data</span><span class="p">),</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="p">)</span>
         <span class="k">else</span><span class="p">:</span>
             <span class="n">information_type</span> <span class="o">=</span> <span class="mi">0</span>
             <span class="n">x</span> <span class="o">=</span> <span class="n">PROCESS_BASIC_INFORMATION</span><span class="p">()</span>
-            <span class="n">winproxy</span><span class="o">.</span><span class="n">NtQueryInformationProcess</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">information_type</span><span class="p">,</span> <span class="n">x</span><span class="p">)</span>
+            <span class="n">winproxy</span><span class="o">.</span><span class="n">NtQueryInformationProcess</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">limited_handle</span><span class="p">,</span> <span class="n">information_type</span><span class="p">,</span> <span class="n">x</span><span class="p">)</span>
         <span class="k">return</span> <span class="n">x</span><span class="o">.</span><span class="n">InheritedFromUniqueProcessId</span>
 
     <span class="nd">@property</span>
@@ -390,13 +390,13 @@
         <span class="k">for</span> <span class="n">i</span> <span class="ow">in</span> <span class="n">itertools</span><span class="o">.</span><span class="n">count</span><span class="p">():</span>
             <span class="k">try</span><span class="p">:</span>
                 <span class="n">x</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">read_memory</span><span class="p">(</span><span class="n">addr</span> <span class="o">+</span> <span class="n">readden</span><span class="p">,</span> <span class="n">read_size</span><span class="p">)</span>
-            <span class="k">except</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">WinproxyError</span> <span class="k">as</span> <span class="n">e</span><span class="p">:</span>
+            <span class="k">except</span> <span class="ne">WindowsError</span> <span class="k">as</span> <span class="n">e</span><span class="p">:</span>
                 <span class="k">if</span> <span class="n">read_size</span> <span class="o">==</span> <span class="mi">2</span><span class="p">:</span>
                     <span class="k">raise</span>
                 <span class="c1"># handle read_wstring at end of page</span>
                 <span class="c1"># Of read failed: read only the half of size</span>
                 <span class="c1"># read_size must remain a multiple of 2</span>
-                <span class="n">read_size</span> <span class="o">=</span> <span class="n">read_size</span> <span class="o">/</span> <span class="mi">2</span>
+                <span class="n">read_size</span> <span class="o">=</span> <span class="n">read_size</span> <span class="o">//</span> <span class="mi">2</span>
                 <span class="k">continue</span>
             <span class="n">readden</span> <span class="o">+=</span> <span class="n">read_size</span>
             <span class="k">if</span> <span class="sa">b</span><span class="s2">&quot;</span><span class="se">\x00</span><span class="s2">&quot;</span> <span class="ow">in</span> <span class="n">x</span><span class="p">:</span>
@@ -414,13 +414,13 @@
         <span class="k">while</span> <span class="kc">True</span><span class="p">:</span>
             <span class="k">try</span><span class="p">:</span>
                 <span class="n">x</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">read_memory</span><span class="p">(</span><span class="n">addr</span> <span class="o">+</span> <span class="n">readden</span><span class="p">,</span> <span class="n">read_size</span><span class="p">)</span>
-            <span class="k">except</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">WinproxyError</span> <span class="k">as</span> <span class="n">e</span><span class="p">:</span>
+            <span class="k">except</span> <span class="ne">WindowsError</span> <span class="k">as</span> <span class="n">e</span><span class="p">:</span>
                 <span class="k">if</span> <span class="n">read_size</span> <span class="o">==</span> <span class="mi">2</span><span class="p">:</span>
                     <span class="k">raise</span>
                 <span class="c1"># handle read_wstring at end of page</span>
                 <span class="c1"># Of read failed: read only the half of size</span>
                 <span class="c1"># read_size must remain a multiple of 2</span>
-                <span class="n">read_size</span> <span class="o">=</span> <span class="nb">int</span><span class="p">(</span><span class="n">read_size</span> <span class="o">/</span> <span class="mi">2</span><span class="p">)</span>
+                <span class="n">read_size</span> <span class="o">=</span> <span class="n">read_size</span> <span class="o">//</span> <span class="mi">2</span>
                 <span class="k">continue</span>
             <span class="n">readden</span> <span class="o">+=</span> <span class="n">read_size</span>
             <span class="c1"># Bytearray will work on py2 &amp; py3</span>
@@ -429,10 +429,10 @@
             <span class="n">utf16_chars</span> <span class="o">=</span> <span class="p">[</span><span class="nb">bytearray</span><span class="p">(</span><span class="n">c</span><span class="p">)</span> <span class="k">for</span> <span class="n">c</span> <span class="ow">in</span> <span class="nb">zip</span><span class="p">(</span><span class="o">*</span><span class="p">[</span><span class="nb">iter</span><span class="p">(</span><span class="n">x</span><span class="p">)]</span> <span class="o">*</span> <span class="mi">2</span><span class="p">)]</span>
             <span class="k">if</span> <span class="sa">b</span><span class="s2">&quot;</span><span class="se">\x00\x00</span><span class="s2">&quot;</span> <span class="ow">in</span> <span class="n">utf16_chars</span><span class="p">:</span>
                 <span class="c1"># Translate bytearray to str/bytes for both py2 &amp; py3</span>
-                <span class="n">res</span><span class="o">.</span><span class="n">extend</span><span class="p">(</span><span class="nb">bytes</span><span class="p">(</span><span class="n">x</span><span class="p">)</span> <span class="k">for</span> <span class="n">x</span> <span class="ow">in</span> <span class="n">utf16_chars</span><span class="p">[:</span><span class="n">utf16_chars</span><span class="o">.</span><span class="n">index</span><span class="p">(</span><span class="sa">b</span><span class="s2">&quot;</span><span class="se">\x00\x00</span><span class="s2">&quot;</span><span class="p">)])</span>
+                <span class="n">res</span><span class="o">.</span><span class="n">extend</span><span class="p">(</span><span class="n">x</span><span class="p">[:</span><span class="n">utf16_chars</span><span class="o">.</span><span class="n">index</span><span class="p">(</span><span class="sa">b</span><span class="s2">&quot;</span><span class="se">\x00\x00</span><span class="s2">&quot;</span><span class="p">)</span> <span class="o">*</span> <span class="mi">2</span><span class="p">])</span>
                 <span class="k">break</span>
             <span class="n">res</span><span class="o">.</span><span class="n">extend</span><span class="p">(</span><span class="n">x</span><span class="p">)</span>
-        <span class="k">return</span> <span class="sa">b</span><span class="s2">&quot;&quot;</span><span class="o">.</span><span class="n">join</span><span class="p">(</span><span class="n">res</span><span class="p">)</span><span class="o">.</span><span class="n">decode</span><span class="p">(</span><span class="s1">&#39;utf16&#39;</span><span class="p">)</span>
+        <span class="k">return</span> <span class="nb">bytearray</span><span class="p">(</span><span class="n">res</span><span class="p">)</span><span class="o">.</span><span class="n">decode</span><span class="p">(</span><span class="s2">&quot;utf-16&quot;</span><span class="p">)</span>
 
     <span class="k">def</span> <span class="nf">write_byte</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">addr</span><span class="p">,</span> <span class="n">byte</span><span class="p">):</span>
         <span class="sd">&quot;&quot;&quot;write a byte at ``addr``&quot;&quot;&quot;</span>
@@ -770,9 +770,15 @@
 <span class="sd">		&quot;&quot;&quot;</span>
         <span class="k">if</span> <span class="ow">not</span> <span class="bp">self</span><span class="o">.</span><span class="n">is_wow_64</span><span class="p">:</span>
             <span class="k">raise</span> <span class="ne">ValueError</span><span class="p">(</span><span class="s2">&quot;Not a syswow process&quot;</span><span class="p">)</span>
-        <span class="k">return</span> <span class="n">windows</span><span class="o">.</span><span class="n">syswow64</span><span class="o">.</span><span class="n">get_current_process_syswow_peb</span><span class="p">()</span></div>
+        <span class="k">return</span> <span class="n">windows</span><span class="o">.</span><span class="n">syswow64</span><span class="o">.</span><span class="n">get_current_process_syswow_peb</span><span class="p">()</span>
 
-    <span class="c1"># TODO: use ctypes.string_ad / ctypes.wstring_at for read_string / read_wstring ?</span>
+    <span class="c1"># TODO: use ctypes.string_at / ctypes.wstring_at for read_string / read_wstring ?</span>
+
+<div class="viewcode-block" id="CurrentProcess.read_string"><a class="viewcode-back" href="../../../process.html#windows.winobject.process.CurrentProcess.read_string">[docs]</a>    <span class="k">def</span> <span class="nf">read_string</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">addr</span><span class="p">):</span>
+        <span class="k">return</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">string_at</span><span class="p">(</span><span class="n">addr</span><span class="p">)</span> <span class="c1"># Raises WindowsError on fail</span></div>
+
+<div class="viewcode-block" id="CurrentProcess.read_wstring"><a class="viewcode-back" href="../../../process.html#windows.winobject.process.CurrentProcess.read_wstring">[docs]</a>    <span class="k">def</span> <span class="nf">read_wstring</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">addr</span><span class="p">):</span>
+        <span class="k">return</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">wstring_at</span><span class="p">(</span><span class="n">addr</span><span class="p">)</span> <span class="c1"># Raises WindowsError on fail</span></div></div>
 
 <div class="viewcode-block" id="WinThread"><a class="viewcode-back" href="../../../process.html#windows.winobject.process.WinThread">[docs]</a><span class="k">class</span> <span class="nc">WinThread</span><span class="p">(</span><span class="n">Thread</span><span class="p">):</span>
     <span class="sd">&quot;&quot;&quot;Represent a thread &quot;&quot;&quot;</span>
@@ -1023,7 +1029,7 @@
 <span class="sd">        :type: :class:`str`</span>
 <span class="sd">		&quot;&quot;&quot;</span>
         <span class="n">buffer</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">c_buffer</span><span class="p">(</span><span class="mh">0x1024</span><span class="p">)</span>
-        <span class="n">rsize</span> <span class="o">=</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">GetProcessImageFileNameA</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">limited_handle</span><span class="p">,</span> <span class="n">buffer</span><span class="p">)</span>
+        <span class="n">rsize</span> <span class="o">=</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">GetProcessImageFileNameA</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">limited_handle</span><span class="p">,</span> <span class="n">buffer</span><span class="p">)</span> <span class="c1"># Use a syscall and not some remote process reading</span>
         <span class="c1"># GetProcessImageFileNameA returns the fullpath</span>
         <span class="k">return</span> <span class="n">buffer</span><span class="p">[:</span><span class="n">rsize</span><span class="p">]</span><span class="o">.</span><span class="n">decode</span><span class="p">()</span><span class="o">.</span><span class="n">split</span><span class="p">(</span><span class="s2">&quot;</span><span class="se">\\</span><span class="s2">&quot;</span><span class="p">)[</span><span class="o">-</span><span class="mi">1</span><span class="p">]</span>
 

docs/build/html/_modules/windows/winobject/registry.html

@@ -200,7 +200,7 @@
 
     <span class="k">def</span> <span class="nf">_open_key</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">handle</span><span class="p">,</span> <span class="n">name</span><span class="p">,</span> <span class="n">sam</span><span class="p">):</span>
         <span class="n">result</span> <span class="o">=</span> <span class="n">WinRegistryKey</span><span class="p">()</span>
-        <span class="n">winproxy</span><span class="o">.</span><span class="n">RegOpenKeyExW</span><span class="p">(</span><span class="n">handle</span><span class="p">,</span> <span class="n">name</span><span class="p">,</span> <span class="mi">0</span><span class="p">,</span> <span class="n">sam</span><span class="p">,</span> <span class="n">result</span><span class="p">)</span>
+        <span class="n">winproxy</span><span class="o">.</span><span class="n">RegOpenKeyExW</span><span class="p">(</span><span class="n">handle</span><span class="p">,</span> <span class="n">name</span><span class="p">,</span> <span class="mi">0</span><span class="p">,</span> <span class="n">sam</span><span class="p">,</span> <span class="n">result</span><span class="p">)</span> <span class="c1"># TODO: options REG_OPTION_OPEN_LINK</span>
         <span class="n">dbgprint</span><span class="p">(</span><span class="sa">u</span><span class="s2">&quot;Opening registry key &lt;</span><span class="si">{0}</span><span class="s2">&gt; (handle=</span><span class="si">{1:#x}</span><span class="s2">)&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">name</span><span class="p">,</span> <span class="n">result</span><span class="o">.</span><span class="n">value</span><span class="p">),</span> <span class="s2">&quot;REGISTRY&quot;</span><span class="p">)</span>
         <span class="k">return</span> <span class="n">result</span>
 
@@ -283,21 +283,36 @@
                 <span class="n">databuffer</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">utils</span><span class="o">.</span><span class="n">BUFFER</span><span class="p">(</span><span class="n">gdef</span><span class="o">.</span><span class="n">BYTE</span><span class="p">,</span> <span class="n">nbelt</span><span class="o">=</span><span class="n">datasize</span><span class="o">.</span><span class="n">value</span><span class="p">)()</span>
                 <span class="c1"># A value can have been added in-between.</span>
                 <span class="c1"># So recheck the size given by get_key_size_info :)</span>
-                <span class="k">while</span> <span class="kc">True</span><span class="p">:</span>
+                <span class="c1"># But check 10 times max as RegEnumValueW may bug (seen) and always return  ERROR_MORE_DATA even with enought size</span>
+                <span class="k">for</span> <span class="n">_</span> <span class="ow">in</span> <span class="nb">range</span><span class="p">(</span><span class="mi">10</span><span class="p">):</span>
                     <span class="k">try</span><span class="p">:</span>
                         <span class="n">winproxy</span><span class="o">.</span><span class="n">RegEnumValueW</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">phkey</span><span class="p">,</span> <span class="n">i</span><span class="p">,</span> <span class="n">keyname</span><span class="p">,</span> <span class="n">namesize</span><span class="p">,</span> <span class="kc">None</span><span class="p">,</span> <span class="n">value_type</span><span class="p">,</span> <span class="n">databuffer</span><span class="p">,</span> <span class="n">datasize</span><span class="p">)</span>
                         <span class="k">break</span>
                     <span class="k">except</span> <span class="ne">WindowsError</span> <span class="k">as</span> <span class="n">e</span><span class="p">:</span>
                         <span class="k">if</span> <span class="n">e</span><span class="o">.</span><span class="n">winerror</span> <span class="o">!=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">ERROR_MORE_DATA</span><span class="p">:</span>
                             <span class="k">raise</span>
+                        <span class="c1"># I found some strange Windows where even with a big enought buffer:</span>
+                        <span class="c1"># - the data was filled</span>
+                        <span class="c1"># - ERROR_MORE_DATA was returned</span>
+                        <span class="c1">## To prevent such bug to trigger and infinite loop, two things</span>
+                        <span class="c1"># - If the retuned namesize &lt;= the passed keysize and keyname is not empty -&gt; return the data`</span>
+                        <span class="c1"># - Max 10 test to prevent Infinite loop</span>
+                        <span class="k">if</span> <span class="p">((</span><span class="n">namesize</span><span class="o">.</span><span class="n">value</span> <span class="o">&lt;=</span> <span class="n">max_name_size</span><span class="p">)</span>  <span class="ow">and</span> <span class="p">(</span><span class="n">datasize</span><span class="o">.</span><span class="n">value</span> <span class="o">&lt;=</span> <span class="n">max_data_size</span><span class="p">)</span> <span class="ow">and</span>
+                            <span class="p">(</span><span class="n">keyname</span><span class="p">[:</span><span class="n">namesize</span><span class="o">.</span><span class="n">value</span><span class="p">]</span><span class="o">.</span><span class="n">count</span><span class="p">(</span><span class="s2">&quot;</span><span class="se">\x00</span><span class="s2">&quot;</span><span class="p">)</span> <span class="o">&lt;</span> <span class="n">namesize</span><span class="o">.</span><span class="n">value</span><span class="p">)):</span> <span class="c1"># Not just 0 Zero ?</span>
+                            <span class="k">break</span>
+
                         <span class="c1"># Update the sizes / buffers &amp; try again :)</span>
                         <span class="n">max_name_size</span><span class="p">,</span> <span class="n">max_data_size</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">get_key_size_info</span><span class="p">()</span>
-                        <span class="n">max_name_size</span> <span class="o">+=</span> <span class="mi">1</span>
-                        <span class="n">max_data_size</span> <span class="o">+=</span> <span class="mi">2</span>
+                        <span class="n">max_name_size</span> <span class="o">=</span> <span class="nb">max</span><span class="p">(</span><span class="n">max_name_size</span> <span class="o">+</span> <span class="mi">1</span><span class="p">,</span> <span class="n">namesize</span><span class="o">.</span><span class="n">value</span> <span class="o">+</span> <span class="mi">1</span><span class="p">)</span> <span class="c1"># namesize.value may be &gt; to max_name_size apparently (guessed)</span>
+                        <span class="n">max_data_size</span> <span class="o">=</span> <span class="nb">max</span><span class="p">(</span><span class="n">max_data_size</span> <span class="o">+</span> <span class="mi">2</span><span class="p">,</span> <span class="n">datasize</span><span class="o">.</span><span class="n">value</span> <span class="o">+</span> <span class="mi">2</span><span class="p">)</span> <span class="c1"># datasize.value may be &gt; to max_data_size apparently (seen)</span>
                         <span class="n">namesize</span> <span class="o">=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">DWORD</span><span class="p">(</span><span class="n">max_name_size</span><span class="p">)</span>
                         <span class="n">keyname</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">create_unicode_buffer</span><span class="p">(</span><span class="n">namesize</span><span class="o">.</span><span class="n">value</span><span class="p">)</span>
                         <span class="n">datasize</span> <span class="o">=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">DWORD</span><span class="p">(</span><span class="n">max_data_size</span><span class="p">)</span>
                         <span class="n">databuffer</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">utils</span><span class="o">.</span><span class="n">BUFFER</span><span class="p">(</span><span class="n">gdef</span><span class="o">.</span><span class="n">BYTE</span><span class="p">,</span> <span class="n">nbelt</span><span class="o">=</span><span class="n">datasize</span><span class="o">.</span><span class="n">value</span><span class="p">)()</span>
+                <span class="k">else</span><span class="p">:</span>
+                    <span class="c1"># Probably a windows bug that prevent us from retrieving the data</span>
+                    <span class="c1"># Raise something (thus preventing getting the other values..) ? ignore it ?</span>
+                    <span class="k">raise</span> <span class="ne">ValueError</span><span class="p">(</span><span class="s2">&quot;Could not extract registry key values, problably a Windows/hook bug&quot;</span><span class="p">)</span>
                 <span class="n">vobj</span> <span class="o">=</span> <span class="n">decode_registry_buffer</span><span class="p">(</span><span class="n">value_type</span><span class="o">.</span><span class="n">value</span><span class="p">,</span> <span class="n">databuffer</span><span class="p">,</span> <span class="n">datasize</span><span class="o">.</span><span class="n">value</span><span class="p">)</span>
                 <span class="n">res</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">KeyValue</span><span class="p">(</span><span class="n">keyname</span><span class="o">.</span><span class="n">value</span><span class="p">,</span> <span class="n">vobj</span><span class="p">,</span> <span class="n">value_type</span><span class="o">.</span><span class="n">value</span><span class="p">))</span>
         <span class="k">return</span> <span class="n">res</span>

docs/build/html/_modules/windows/winobject/task_scheduler.html

@@ -254,12 +254,16 @@
 <span class="sd">    &quot;&quot;&quot;</span>
 
     <span class="n">name</span> <span class="o">=</span> <span class="n">generate_simple_getter</span><span class="p">(</span><span class="s2">&quot;get_DisplayName&quot;</span><span class="p">,</span> <span class="n">gdef</span><span class="o">.</span><span class="n">BSTR</span><span class="p">)</span>
+    <span class="n">name</span> <span class="o">=</span> <span class="n">add_simple_setter</span><span class="p">(</span><span class="n">name</span><span class="p">,</span> <span class="s2">&quot;put_DisplayName&quot;</span><span class="p">,</span> <span class="n">gdef</span><span class="o">.</span><span class="n">BSTR</span><span class="p">)</span>
     <span class="sd">&quot;&quot;&quot;The name of the principal&quot;&quot;&quot;</span>
     <span class="nb">id</span> <span class="o">=</span> <span class="n">generate_simple_getter</span><span class="p">(</span><span class="s2">&quot;get_Id&quot;</span><span class="p">,</span> <span class="n">gdef</span><span class="o">.</span><span class="n">BSTR</span><span class="p">)</span>
+    <span class="nb">id</span> <span class="o">=</span> <span class="n">add_simple_setter</span><span class="p">(</span><span class="nb">id</span><span class="p">,</span> <span class="s2">&quot;put_Id&quot;</span><span class="p">,</span> <span class="n">gdef</span><span class="o">.</span><span class="n">BSTR</span><span class="p">)</span>
     <span class="sd">&quot;&quot;&quot;the identifier of the principal.&quot;&quot;&quot;</span>
     <span class="n">user_id</span> <span class="o">=</span> <span class="n">generate_simple_getter</span><span class="p">(</span><span class="s2">&quot;get_UserId&quot;</span><span class="p">,</span> <span class="n">gdef</span><span class="o">.</span><span class="n">BSTR</span><span class="p">)</span>
+    <span class="n">user_id</span> <span class="o">=</span> <span class="n">add_simple_setter</span><span class="p">(</span><span class="n">user_id</span><span class="p">,</span> <span class="s2">&quot;put_UserId&quot;</span><span class="p">,</span> <span class="n">gdef</span><span class="o">.</span><span class="n">BSTR</span><span class="p">)</span>
     <span class="sd">&quot;&quot;&quot;the user identifier that is required to run the task&quot;&quot;&quot;</span>
     <span class="n">group_id</span> <span class="o">=</span> <span class="n">generate_simple_getter</span><span class="p">(</span><span class="s2">&quot;get_GroupId&quot;</span><span class="p">,</span> <span class="n">gdef</span><span class="o">.</span><span class="n">BSTR</span><span class="p">)</span>
+    <span class="n">group_id</span> <span class="o">=</span> <span class="n">add_simple_setter</span><span class="p">(</span><span class="n">group_id</span><span class="p">,</span> <span class="s2">&quot;put_GroupId&quot;</span><span class="p">,</span> <span class="n">gdef</span><span class="o">.</span><span class="n">BSTR</span><span class="p">)</span>
     <span class="sd">&quot;&quot;&quot;the user group that is required to run the task&quot;&quot;&quot;</span>
     <span class="n">run_level</span> <span class="o">=</span> <span class="n">generate_simple_getter</span><span class="p">(</span><span class="s2">&quot;get_RunLevel&quot;</span><span class="p">,</span> <span class="n">gdef</span><span class="o">.</span><span class="n">TASK_RUNLEVEL_TYPE</span><span class="p">)</span>
     <span class="sd">&quot;&quot;&quot;the privilege level that is required to run the tasks</span>

docs/build/html/_sources/encoding.rst.txt

@@ -0,0 +1,274 @@
+.. _py_windows_encoding:
+
+Python, Windows & encoding
+==========================
+
+This part is only the result of my experimentations and readings and might not reflect the full picture.
+
+My near-futur goal is to have PythonForWindows fully support unicode and use W (Wide) API.
+This will result in most of the strings handled by PFW being unicode strings.
+
+In python3 it should work as-is because Windows console handle Wide unicode and Py3 is using the ``ConsoleWriteW`` API directly.
+The fact that python3 :class:`str` type represent unicode string helps a lot.
+
+
+
+But, As I want to maintains Python2.7 compatibilty and easyness of use, things beging to become tricky.
+
+The main problem is the ability to print unicode (chinese / russian / ...) in the console and object repr.
+
+Example:
+    >>> windows.crypto.Certificate.from_file("omae.cer")
+    <Certificate "お前はもう死んでい" serial="19 da cc 2b a5 61 b6 98 4e 0d 6c 0c cb ce e6 99">
+
+To achieve this in Py2 the required additionnal configuration of the console should be::
+
+    set PYTHONIOENCODING=utf-8 # Set environnement variable PYTHONIOENCODING to utf-8. Allowing UTF8 encoding for python output (including sys.stdout).
+    chcp 65001 # Setting the console code page to 65001 (UTF-8) Allowing the console to print the correct chars when receiving UTF-8 data
+
+
+For it to work optimaly in Py2.7, it require some tricks in both the codebase, the python configuration and console configuration.
+
+My goal is to offer the better experience even without any Python/Console configuration.
+But with the additionnal configuration it should be able to print anything without trouble.
+
+What does this additional configuration does ?
+''''''''''''''''''''''''''''''''''''''''''''''
+
+
+PYTHONIOENCODING
+^^^^^^^^^^^^^^^^
+
+
+As the official `Python2 documentation <https://docs.python.org/2/using/cmdline.html#envvar-PYTHONIOENCODING>`_ says::
+
+    Overrides the encoding used for stdin/stdout/stderr, in the syntax encodingname:errorhandler. The :errorhandler part is optional and has the same meaning as in str.encode().
+
+The goal of setting this environnement variable is to have the stdout encoding set to ``utf-8``.
+This will allow a somewhat seamless encoding of any unicode string you try to print.
+
+
+By default, the ``sys.stdout.encoding`` is set according to the current console output codepage (`GetConsoleOutputCP <https://docs.microsoft.com/en-us/windows/console/getconsoleoutputcp>`_) at python initialisation.
+This can be seen in `Py_InitializeEx <https://github.com/python/cpython/blob/2.7/Python/pythonrun.c#L354>`_.
+
+Most of the default codepage (437 in my case) cannot encode all unicode character.
+These two elements together are the reason why priting an unicode string without any change in Python2 will lead to this type of problem::
+
+
+    $ chcp
+    Active code page: 437
+
+    $ python -s -E
+    Python 2.7.12 (v2.7.12:d33e0cf91556, Jun 27 2016, 15:19:22) [MSC v.1500 32 bit (Intel)] on win32
+    Type "help", "copyright", "credits" or "license" for more information.
+    >>> import sys
+    >>> sys.stdout.encoding
+    'cp437'
+    >>> print(u"\u304a\u524d\u306f\u3082\u3046\u6b7b\u3093\u3067\u3044")
+    Traceback (most recent call last):
+    File "<stdin>", line 1, in <module>
+    File "C:\Python27\lib\encodings\cp437.py", line 12, in encode
+        return codecs.charmap_encode(input,errors,encoding_map)
+    UnicodeEncodeError: 'charmap' codec can't encode characters in position 0-8: character maps to <undefined>
+
+
+.. note::
+
+    Note that the fails is in ``cp437.py`` directly linked to ``sys.stdout.encoding``
+
+
+By setting ``PYTHONIOENCODING`` you force the ``sys.stdout.encoding``::
+
+    $ chcp
+    Active code page: 437
+
+    $ set PYTHONIOENCODING=utf-8
+
+    $ python
+    Python 2.7.12 (v2.7.12:d33e0cf91556, Jun 27 2016, 15:19:22) [MSC v.1500 32 bit (Intel)] on win32
+    Type "help", "copyright", "credits" or "license" for more information.
+    >>> import sys
+    >>> sys.stdout.encoding
+    'utf-8'
+    >>> print(u"\u304a\u524d\u306f\u3082\u3046\u6b7b\u3093\u3067\u3044")
+    お前はもう死んでい # Gibberish due to bad codepage in console
+
+
+Well, it does not raise an exception anymore but it's printing gibberish.
+This is because, as-is the console still expects cp437 as an output.
+
+
+chcp 65001
+^^^^^^^^^^
+
+The `chcp <https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/chcp>`_ commande allow to display/change the active console code page.
+The codepage 65001 stand for UTF-8.
+
+Thus, setting the console code page to 65001 will tell it to expect UTF-8 as a program output. Which is perfect with our previous setup of ``PYTHONIOENCODING``::
+
+    $ set PYTHONIOENCODING=utf-8
+
+    $ chcp 65001
+    Active code page: 65001
+
+    $ python
+    Python 2.7.12 (v2.7.12:d33e0cf91556, Jun 27 2016, 15:19:22) [MSC v.1500 32 bit (Intel)] on win32
+    Type "help", "copyright", "credits" or "license" for more information.
+    >>> import sys
+    >>> sys.stdout.encoding
+    'utf-8'
+    >>> print(u"\u304a\u524d\u306f\u3082\u3046\u6b7b\u3093\u3067\u3044")
+    お前はもう死んでい
+
+
+.. warning:
+
+    Well, if ``chcp 65001`` stand for UTF-8 and that without ``PYTHONIOENCODING`` python use the code page has encoding. We do we even need to setup ``PYTHONIOENCODING`` ?
+
+    The response is quite sad..
+    Python setp stdout encoding to cp65001 but it does not recognize the cp65001 encoding as UTF-8. It does not know about it !
+
+    See::
+
+        $ set PYTHONIOENCODING=
+
+        $ chcp 65001
+        Active code page: 65001
+
+        $ python
+        Python 2.7.12 (v2.7.12:d33e0cf91556, Jun 27 2016, 15:19:22) [MSC v.1500 32 bit (Intel)] on win32
+        Type "help", "copyright", "credits" or "license" for more information.
+
+        >>> import sys
+
+        LookupError: unknown encoding: cp65001 # Broken Interactive console :(
+
+        $ python -c "import sys; print(sys.stdout.encoding);  print(u'\u304a\u524d\u306f\u3082\u3046\u6b7b\u3093\u3067\u3044')"
+        cp65001
+        Traceback (most recent call last):
+        File "<string>", line 1, in <module>
+        LookupError: unknown encoding: cp65001
+
+
+The case of __repr__
+''''''''''''''''''''
+
+The case of UTF-8 and __repr__ in Python2.7 is more tricky.
+I pay particular attention to this case because I am an heavy user of the interactive console and object ``__repr__`` to explore Windows.
+
+the ``__repr__`` function cannot return an ``unicode`` object and must return a ``str``.
+But as I want to be able to output repr for objects with unicode attributes (like a お前はもう死んでい certificate), I need to encode my unicode __repr__.
+
+In those cases, I encode the repr with the stdout encoding (with backslash escape for non-encodable error).
+This should assure that the result can always be written to stdout.
+
+But based on the encoding of stdout and the code page 3 case may appear.
+For exmple with an object having the following unicode repr:
+
+    * <Certificate "お前はもう死んでい" serial="19 da cc 2b a5 61 b6 98 4e 0d 6c 0c cb ce e6 99">
+
+The possibilities are:
+
+    * stdout encoding do not handle full unicode (like cp437)
+        * repr will be backslash escaped to allow printing
+        * <Certificate "\u304a\u524d\u306f\u3082\u3046\u6b7b\u3093\u3067\u3044" serial="19 da cc 2b a5 61 b6 98 4e 0d 6c 0c cb ce e6 99">
+
+    * stdout encoding is utf-8 but code page is not (like cp437)
+        * console will output gibberish by trying to interpret utf-8 as a custom CodePage
+        * <Certificate "お前はもう死んでい" serial="19 da cc 2b a5 61 b6 98 4e 0d 6c 0c cb ce e6 99">
+
+    * stdout encoding is utf-8 and code page is 65001
+        * it works !
+        * <Certificate "お前はもう死んでい" serial="19 da cc 2b a5 61 b6 98 4e 0d 6c 0c cb ce e6 99">
+
+
+
+Sample of test
+''''''''''''''
+
+I have created a sample ``samples\encoding\check_encoding_config.py`` that should help to understand and verify the current configuration of the console.
+The code check and display the values of ``PYTHONIOENCODING``, ``sys.stdout.encoding`` and the current console code page. It also tries to print an unicode string as well as an unicode object __repr__.
+
+
+No setup
+^^^^^^^^
+
+``PYTHONIOENCODING`` is not set and code page is something like 437.
+
+    * The printing of an unicode string will fail
+    * The printing of an unicode __repr__ will display escaped unicode values
+        * PFW make its best to not raise an encoding related exception on __repr__ by checking ``sys.stdout.encoding``
+
+Example::
+
+    $ chcp 437
+    Active code page: 437
+
+    $ set PYTHONIOENCODING=
+
+    $ python samples\encoding\check_encoding_config.py
+    Python version is <2.7.12 (v2.7.12:d33e0cf91556, Jun 27 2016, 15:19:22) [MSC v.1500 32 bit (Intel)]>
+    Py2 python/console configuration analysis:
+    [*] env[PYTHONIOENCODING] = None
+        [-] No env variable <PYTHONIOENCODING>.
+            sys.stdout encoding will only depends on your console codepage. Leading to high probability of EncodingError if printing unicode string
+    [*] sys.stdout.encoding = cp437
+        [-] Unoptimal stdout encoding
+            Recommended fix is setting PYTHONIOENCODING == utf-8
+    [*] Console Codepage = 437
+        [-] Non UTF-8 codepage for the current console
+            Setting codepage to UTF8 (chcp 65001) will ensure currect output with PYTHONIOENCODING UTF-8
+    [-] Error printing unicode string: 'charmap' codec can't encode characters in position 23-31: character maps to <undefined>
+    Unicode object repr: <MyUtf8Object name="\u304a\u524d\u306f\u3082\u3046\u6b7b\u3093\u3067\u3044-\u043a\u0430\u043a\u0438\u0435_\u0444\u0436\u044e\u0449\u0434\u0444\u044f">
+
+
+PYTHONIOENCODING only
+^^^^^^^^^^^^^^^^^^^^^
+
+``PYTHONIOENCODING`` is set to ``utf-8`` and code page is something like 437.
+
+    * The printing of an unicode string will work but display gibberish
+    * The printing of an unicode __repr__ will work but display gibberish
+
+This is due to a mis-match between python output encoding and the console expected output.
+
+Example::
+
+    $ chcp
+    Active code page: 437
+
+    $ set PYTHONIOENCODING=utf-8
+
+    $ python samples\encoding\check_encoding_config.py
+    Python version is <2.7.12 (v2.7.12:d33e0cf91556, Jun 27 2016, 15:19:22) [MSC v.1500 32 bit (Intel)]>
+    Py2 python/console configuration analysis:
+    [*] env[PYTHONIOENCODING] = utf-8
+        [+] Optimal PYTHONIOENCODING
+    [*] sys.stdout.encoding = utf-8
+    [*] Console Codepage = 437
+        [-] Non UTF-8 codepage for the current console
+            Setting codepage to UTF8 (chcp 65001) will ensure currect output with PYTHONIOENCODING UTF-8
+    Unicode string print: <お前はもう死んでい-какие_фжющдфя>
+    Unicode object repr: <MyUtf8Object name="お前はもう死んでい-какие_фжющдфя">
+
+
+Full setup
+^^^^^^^^^^
+
+``PYTHONIOENCODING`` is set to ``utf-8`` and code page is 65001.
+Everything should work::
+
+    $ set PYTHONIOENCODING=utf-8
+
+    $ chcp 65001
+    Active code page: 65001
+
+    $ python samples\encoding\check_encoding_config.py
+    Python version is <2.7.12 (v2.7.12:d33e0cf91556, Jun 27 2016, 15:19:22) [MSC v.1500 32 bit (Intel)]>
+    Py2 python/console configuration analysis:
+    [*] env[PYTHONIOENCODING] = utf-8
+        [+] Optimal PYTHONIOENCODING
+    [*] sys.stdout.encoding = utf-8
+    [*] Console Codepage = 65001
+    Unicode string print: <お前はもう死んでい-какие_фжющдфя>
+    Unicode object repr: <MyUtf8Object name="お前はもう死んでい-какие_фжющдфя">

docs/build/html/_sources/index.rst.txt

@@ -27,17 +27,22 @@ Examples are available on the `github page <https://github.com/hakril/pythonforw
 Installation
 ''''''''''''
 
+Installing from Pypi
+^^^^^^^^^^^^^^^^^^^^
+
+PythonForWindows is available on `Pypi <https://pypi.org/project/PythonForWindows/>`_ an this can be installed with::
+
+
+    python -m pip install PythonForWindows
+
 Installing using setup.py
 ^^^^^^^^^^^^^^^^^^^^^^^^^
 
-You can install PythonForWindows using the ``setup.py`` at the root of the project::
+
+You can also install PythonForWindows by cloning it and using the ``setup.py`` at the root of the project::
 
     python setup.py install
 
-.. warning::
-
-    PythonForWindows is not available on Pypi for now and thus cannot be directly installed using ``pip``.
-
 
 Python3
 ^^^^^^^

docs/build/html/_sources/native_exec.rst.txt

@@ -147,6 +147,74 @@ Another example from a project::
         '\x81~\x08\x0c\x00\x00\x00u&\x8bN\x10\x8bQ\x04\x8bA\x08\x8b\t\x81\xf9\x01\x00\x00\x00u\x03\xee\xeb\r\x81\xf9\x02\x00\x00\x00u\x04f\xef\xeb\x01\xef1\xc0\xc3\xc7\xc0\r\x00\x00\xc0\xc3'
 
 
+Available Instructions in X86 assembler
+'''''''''''''''''''''''''''''''''''''''
+
+.. note::
+    Not all encodings may be implemented for each of the instructions.
+
+    ``Byte`` and ``Raw`` are not x86 instruction and allow to insert arbitrary data to the generated code.
+
+Listing:
+
+    * Add
+    * And
+    * Byte
+    * Cmp
+    * CmpsB
+    * CmpsD
+    * CmpsW
+    * Cpuid
+    * Dec
+    * In
+    * Inc
+    * Int
+    * Int3
+    * Iret
+    * Lea
+    * Mov
+    * Movsb
+    * Movsd
+    * Nop
+    * Not
+    * Or
+    * Out
+    * Pop
+    * Popad
+    * Popfd
+    * Push
+    * Pushad
+    * Pushfd
+    * Raw
+    * Ret
+    * Retf
+    * Rol
+    * Ror
+    * ScasB
+    * ScasD
+    * ScasW
+    * Shl
+    * Shr
+    * StosB
+    * StosD
+    * StosW
+    * Sub
+    * Test
+    * Xchg
+    * Xor
+
+.. note::
+
+    ``Raw``: Output raw data from an hexadecimal string
+
+        >>> windows.native_exec.simple_x64.Raw("90C332FCFF").get_code()
+        '\x90\xc32\xfc\xff'
+
+    ``Byte``: Output a raw byte
+
+        >>> windows.native_exec.simple_x86.Byte(0x42).get_code()
+        'B'
+
 :mod:`windows.native_exec.simple_x64` -- X64 Assembler
 """"""""""""""""""""""""""""""""""""""""""""""""""""""
 
@@ -180,6 +248,63 @@ Demo::
     'g\x8b\x00'
 
 
+Available Instructions in X64 assembler
+'''''''''''''''''''''''''''''''''''''''
+
+.. note::
+    Not all encodings may be implemented for each of the instructions.
+
+    ``Raw`` is not an x64 instruction and allow to insert arbitrary data to the generated code.
+
+Listing:
+    * Add
+    * And
+    * Cmp
+    * CmpsB
+    * CmpsD
+    * CmpsQ
+    * CmpsW
+    * Cpuid
+    * Dec
+    * In
+    * Inc
+    * Int
+    * Int3
+    * Lea
+    * Mov
+    * Nop
+    * Not
+    * Or
+    * Out
+    * Pop
+    * Popfq
+    * Push
+    * Pushfq
+    * Raw
+    * Ret
+    * Retf
+    * Retf32
+    * ScasB
+    * ScasD
+    * ScasQ
+    * ScasW
+    * Shl
+    * Shr
+    * Sub
+    * Test
+    * Xchg
+    * Xor
+
+
+.. note::
+
+    ``Raw``: Output raw data from an hexadecimal string
+
+        >>> windows.native_exec.simple_x64.Raw("90C332FCFF").get_code()
+        '\x90\xc32\xfc\xff'
+
+
+
 
 :mod:`windows.native_exec.nativeutils` -- Native utility functions
 """"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""

docs/build/html/encoding.html

@@ -0,0 +1,372 @@
+
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
+  "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+
+<html xmlns="http://www.w3.org/1999/xhtml">
+  <head>
+    <meta http-equiv="X-UA-Compatible" content="IE=Edge" />
+    <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
+    <title>17. Python, Windows &amp; encoding &#8212; PythonForWindows 0.6 documentation</title>
+    <link rel="stylesheet" href="_static/classic.css" type="text/css" />
+    <link rel="stylesheet" href="_static/pygments.css" type="text/css" />
+    <link rel="stylesheet" type="text/css" href="_static/css/mbasic.css" />
+    
+    <script type="text/javascript" id="documentation_options" data-url_root="./" src="_static/documentation_options.js"></script>
+    <script type="text/javascript" src="_static/jquery.js"></script>
+    <script type="text/javascript" src="_static/underscore.js"></script>
+    <script type="text/javascript" src="_static/doctools.js"></script>
+    <script type="text/javascript" src="_static/language_data.js"></script>
+    
+    <link rel="index" title="Index" href="genindex.html" />
+    <link rel="search" title="Search" href="search.html" />
+    <link rel="next" title="18. Internals" href="internals.html" />
+    <link rel="prev" title="16. Early Work In Progress" href="wip.html" /> 
+  </head><body>
+    <div class="related" role="navigation" aria-label="related navigation">
+      <h3>Navigation</h3>
+      <ul>
+        <li class="right" style="margin-right: 10px">
+          <a href="genindex.html" title="General Index"
+             accesskey="I">index</a></li>
+        <li class="right" >
+          <a href="py-modindex.html" title="Python Module Index"
+             >modules</a> |</li>
+        <li class="right" >
+          <a href="internals.html" title="18. Internals"
+             accesskey="N">next</a> |</li>
+        <li class="right" >
+          <a href="wip.html" title="16. Early Work In Progress"
+             accesskey="P">previous</a> |</li>
+        <li class="nav-item nav-item-0"><a href="index.html">PythonForWindows 0.6 documentation</a> &#187;</li> 
+      </ul>
+    </div>  
+
+    <div class="document">
+      <div class="documentwrapper">
+        <div class="bodywrapper">
+          <div class="body" role="main">
+            
+  <div class="section" id="python-windows-encoding">
+<span id="py-windows-encoding"></span><h1>17. Python, Windows &amp; encoding<a class="headerlink" href="#python-windows-encoding" title="Permalink to this headline">¶</a></h1>
+<p>This part is only the result of my experimentations and readings and might not reflect the full picture.</p>
+<p>My near-futur goal is to have PythonForWindows fully support unicode and use W (Wide) API.
+This will result in most of the strings handled by PFW being unicode strings.</p>
+<p>In python3 it should work as-is because Windows console handle Wide unicode and Py3 is using the <code class="docutils literal notranslate"><span class="pre">ConsoleWriteW</span></code> API directly.
+The fact that python3 <a class="reference external" href="https://docs.python.org/2.7/library/functions.html#str" title="(in Python v2.7)"><code class="xref py py-class docutils literal notranslate"><span class="pre">str</span></code></a> type represent unicode string helps a lot.</p>
+<p>But, As I want to maintains Python2.7 compatibilty and easyness of use, things beging to become tricky.</p>
+<p>The main problem is the ability to print unicode (chinese / russian / …) in the console and object repr.</p>
+<dl class="docutils">
+<dt>Example:</dt>
+<dd><div class="first last highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">&gt;&gt;&gt; </span><span class="n">windows</span><span class="o">.</span><span class="n">crypto</span><span class="o">.</span><span class="n">Certificate</span><span class="o">.</span><span class="n">from_file</span><span class="p">(</span><span class="s2">&quot;omae.cer&quot;</span><span class="p">)</span>
+<span class="go">&lt;Certificate &quot;お前はもう死んでい&quot; serial=&quot;19 da cc 2b a5 61 b6 98 4e 0d 6c 0c cb ce e6 99&quot;&gt;</span>
+</pre></div>
+</div>
+</dd>
+</dl>
+<p>To achieve this in Py2 the required additionnal configuration of the console should be:</p>
+<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="nb">set</span> <span class="n">PYTHONIOENCODING</span><span class="o">=</span><span class="n">utf</span><span class="o">-</span><span class="mi">8</span> <span class="c1"># Set environnement variable PYTHONIOENCODING to utf-8. Allowing UTF8 encoding for python output (including sys.stdout).</span>
+<span class="n">chcp</span> <span class="mi">65001</span> <span class="c1"># Setting the console code page to 65001 (UTF-8) Allowing the console to print the correct chars when receiving UTF-8 data</span>
+</pre></div>
+</div>
+<p>For it to work optimaly in Py2.7, it require some tricks in both the codebase, the python configuration and console configuration.</p>
+<p>My goal is to offer the better experience even without any Python/Console configuration.
+But with the additionnal configuration it should be able to print anything without trouble.</p>
+<div class="section" id="what-does-this-additional-configuration-does">
+<h2>17.1. What does this additional configuration does ?<a class="headerlink" href="#what-does-this-additional-configuration-does" title="Permalink to this headline">¶</a></h2>
+<div class="section" id="pythonioencoding">
+<h3>17.1.1. PYTHONIOENCODING<a class="headerlink" href="#pythonioencoding" title="Permalink to this headline">¶</a></h3>
+<p>As the official <a class="reference external" href="https://docs.python.org/2/using/cmdline.html#envvar-PYTHONIOENCODING">Python2 documentation</a> says:</p>
+<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="n">Overrides</span> <span class="n">the</span> <span class="n">encoding</span> <span class="n">used</span> <span class="k">for</span> <span class="n">stdin</span><span class="o">/</span><span class="n">stdout</span><span class="o">/</span><span class="n">stderr</span><span class="p">,</span> <span class="ow">in</span> <span class="n">the</span> <span class="n">syntax</span> <span class="n">encodingname</span><span class="p">:</span><span class="n">errorhandler</span><span class="o">.</span> <span class="n">The</span> <span class="p">:</span><span class="n">errorhandler</span> <span class="n">part</span> <span class="ow">is</span> <span class="n">optional</span> <span class="ow">and</span> <span class="n">has</span> <span class="n">the</span> <span class="n">same</span> <span class="n">meaning</span> <span class="k">as</span> <span class="ow">in</span> <span class="nb">str</span><span class="o">.</span><span class="n">encode</span><span class="p">()</span><span class="o">.</span>
+</pre></div>
+</div>
+<p>The goal of setting this environnement variable is to have the stdout encoding set to <code class="docutils literal notranslate"><span class="pre">utf-8</span></code>.
+This will allow a somewhat seamless encoding of any unicode string you try to print.</p>
+<p>By default, the <code class="docutils literal notranslate"><span class="pre">sys.stdout.encoding</span></code> is set according to the current console output codepage (<a class="reference external" href="https://docs.microsoft.com/en-us/windows/console/getconsoleoutputcp">GetConsoleOutputCP</a>) at python initialisation.
+This can be seen in <a class="reference external" href="https://github.com/python/cpython/blob/2.7/Python/pythonrun.c#L354">Py_InitializeEx</a>.</p>
+<p>Most of the default codepage (437 in my case) cannot encode all unicode character.
+These two elements together are the reason why priting an unicode string without any change in Python2 will lead to this type of problem:</p>
+<div class="highlight-default notranslate"><div class="highlight"><pre><span></span>$ chcp
+Active code page: 437
+
+$ python -s -E
+Python 2.7.12 (v2.7.12:d33e0cf91556, Jun 27 2016, 15:19:22) [MSC v.1500 32 bit (Intel)] on win32
+Type &quot;help&quot;, &quot;copyright&quot;, &quot;credits&quot; or &quot;license&quot; for more information.
+&gt;&gt;&gt; import sys
+&gt;&gt;&gt; sys.stdout.encoding
+&#39;cp437&#39;
+&gt;&gt;&gt; print(u&quot;\u304a\u524d\u306f\u3082\u3046\u6b7b\u3093\u3067\u3044&quot;)
+Traceback (most recent call last):
+File &quot;&lt;stdin&gt;&quot;, line 1, in &lt;module&gt;
+File &quot;C:\Python27\lib\encodings\cp437.py&quot;, line 12, in encode
+    return codecs.charmap_encode(input,errors,encoding_map)
+UnicodeEncodeError: &#39;charmap&#39; codec can&#39;t encode characters in position 0-8: character maps to &lt;undefined&gt;
+</pre></div>
+</div>
+<div class="admonition note">
+<p class="first admonition-title">Note</p>
+<p class="last">Note that the fails is in <code class="docutils literal notranslate"><span class="pre">cp437.py</span></code> directly linked to <code class="docutils literal notranslate"><span class="pre">sys.stdout.encoding</span></code></p>
+</div>
+<p>By setting <code class="docutils literal notranslate"><span class="pre">PYTHONIOENCODING</span></code> you force the <code class="docutils literal notranslate"><span class="pre">sys.stdout.encoding</span></code>:</p>
+<div class="highlight-default notranslate"><div class="highlight"><pre><span></span>$ chcp
+Active code page: 437
+
+$ set PYTHONIOENCODING=utf-8
+
+$ python
+Python 2.7.12 (v2.7.12:d33e0cf91556, Jun 27 2016, 15:19:22) [MSC v.1500 32 bit (Intel)] on win32
+Type &quot;help&quot;, &quot;copyright&quot;, &quot;credits&quot; or &quot;license&quot; for more information.
+&gt;&gt;&gt; import sys
+&gt;&gt;&gt; sys.stdout.encoding
+&#39;utf-8&#39;
+&gt;&gt;&gt; print(u&quot;\u304a\u524d\u306f\u3082\u3046\u6b7b\u3093\u3067\u3044&quot;)
+お前はもう死んでい # Gibberish due to bad codepage in console
+</pre></div>
+</div>
+<p>Well, it does not raise an exception anymore but it’s printing gibberish.
+This is because, as-is the console still expects cp437 as an output.</p>
+</div>
+<div class="section" id="chcp-65001">
+<h3>17.1.2. chcp 65001<a class="headerlink" href="#chcp-65001" title="Permalink to this headline">¶</a></h3>
+<p>The <a class="reference external" href="https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/chcp">chcp</a> commande allow to display/change the active console code page.
+The codepage 65001 stand for UTF-8.</p>
+<p>Thus, setting the console code page to 65001 will tell it to expect UTF-8 as a program output. Which is perfect with our previous setup of <code class="docutils literal notranslate"><span class="pre">PYTHONIOENCODING</span></code>:</p>
+<div class="highlight-default notranslate"><div class="highlight"><pre><span></span>$ set PYTHONIOENCODING=utf-8
+
+$ chcp 65001
+Active code page: 65001
+
+$ python
+Python 2.7.12 (v2.7.12:d33e0cf91556, Jun 27 2016, 15:19:22) [MSC v.1500 32 bit (Intel)] on win32
+Type &quot;help&quot;, &quot;copyright&quot;, &quot;credits&quot; or &quot;license&quot; for more information.
+&gt;&gt;&gt; import sys
+&gt;&gt;&gt; sys.stdout.encoding
+&#39;utf-8&#39;
+&gt;&gt;&gt; print(u&quot;\u304a\u524d\u306f\u3082\u3046\u6b7b\u3093\u3067\u3044&quot;)
+お前はもう死んでい
+</pre></div>
+</div>
+</div>
+</div>
+<div class="section" id="the-case-of-repr">
+<h2>17.2. The case of __repr__<a class="headerlink" href="#the-case-of-repr" title="Permalink to this headline">¶</a></h2>
+<p>The case of UTF-8 and __repr__ in Python2.7 is more tricky.
+I pay particular attention to this case because I am an heavy user of the interactive console and object <code class="docutils literal notranslate"><span class="pre">__repr__</span></code> to explore Windows.</p>
+<p>the <code class="docutils literal notranslate"><span class="pre">__repr__</span></code> function cannot return an <code class="docutils literal notranslate"><span class="pre">unicode</span></code> object and must return a <code class="docutils literal notranslate"><span class="pre">str</span></code>.
+But as I want to be able to output repr for objects with unicode attributes (like a お前はもう死んでい certificate), I need to encode my unicode __repr__.</p>
+<p>In those cases, I encode the repr with the stdout encoding (with backslash escape for non-encodable error).
+This should assure that the result can always be written to stdout.</p>
+<p>But based on the encoding of stdout and the code page 3 case may appear.
+For exmple with an object having the following unicode repr:</p>
+<blockquote>
+<div><ul class="simple">
+<li>&lt;Certificate “お前はもう死んでい” serial=”19 da cc 2b a5 61 b6 98 4e 0d 6c 0c cb ce e6 99”&gt;</li>
+</ul>
+</div></blockquote>
+<p>The possibilities are:</p>
+<blockquote>
+<div><ul class="simple">
+<li><dl class="first docutils">
+<dt>stdout encoding do not handle full unicode (like cp437)</dt>
+<dd><ul class="first last">
+<li>repr will be backslash escaped to allow printing</li>
+<li>&lt;Certificate “u304au524du306fu3082u3046u6b7bu3093u3067u3044” serial=”19 da cc 2b a5 61 b6 98 4e 0d 6c 0c cb ce e6 99”&gt;</li>
+</ul>
+</dd>
+</dl>
+</li>
+<li><dl class="first docutils">
+<dt>stdout encoding is utf-8 but code page is not (like cp437)</dt>
+<dd><ul class="first last">
+<li>console will output gibberish by trying to interpret utf-8 as a custom CodePage</li>
+<li>&lt;Certificate “πüèσëìπü»πééπü嵡╗πéôπüºπüä” serial=”19 da cc 2b a5 61 b6 98 4e 0d 6c 0c cb ce e6 99”&gt;</li>
+</ul>
+</dd>
+</dl>
+</li>
+<li><dl class="first docutils">
+<dt>stdout encoding is utf-8 and code page is 65001</dt>
+<dd><ul class="first last">
+<li>it works !</li>
+<li>&lt;Certificate “お前はもう死んでい” serial=”19 da cc 2b a5 61 b6 98 4e 0d 6c 0c cb ce e6 99”&gt;</li>
+</ul>
+</dd>
+</dl>
+</li>
+</ul>
+</div></blockquote>
+</div>
+<div class="section" id="sample-of-test">
+<h2>17.3. Sample of test<a class="headerlink" href="#sample-of-test" title="Permalink to this headline">¶</a></h2>
+<p>I have created a sample <code class="docutils literal notranslate"><span class="pre">samples\encoding\check_encoding_config.py</span></code> that should help to understand and verify the current configuration of the console.
+The code check and display the values of <code class="docutils literal notranslate"><span class="pre">PYTHONIOENCODING</span></code>, <code class="docutils literal notranslate"><span class="pre">sys.stdout.encoding</span></code> and the current console code page. It also tries to print an unicode string as well as an unicode object __repr__.</p>
+<div class="section" id="no-setup">
+<h3>17.3.1. No setup<a class="headerlink" href="#no-setup" title="Permalink to this headline">¶</a></h3>
+<p><code class="docutils literal notranslate"><span class="pre">PYTHONIOENCODING</span></code> is not set and code page is something like 437.</p>
+<blockquote>
+<div><ul class="simple">
+<li>The printing of an unicode string will fail</li>
+<li><dl class="first docutils">
+<dt>The printing of an unicode __repr__ will display escaped unicode values</dt>
+<dd><ul class="first last">
+<li>PFW make its best to not raise an encoding related exception on __repr__ by checking <code class="docutils literal notranslate"><span class="pre">sys.stdout.encoding</span></code></li>
+</ul>
+</dd>
+</dl>
+</li>
+</ul>
+</div></blockquote>
+<p>Example:</p>
+<div class="highlight-default notranslate"><div class="highlight"><pre><span></span>$ chcp 437
+Active code page: 437
+
+$ set PYTHONIOENCODING=
+
+$ python samples\encoding\check_encoding_config.py
+Python version is &lt;2.7.12 (v2.7.12:d33e0cf91556, Jun 27 2016, 15:19:22) [MSC v.1500 32 bit (Intel)]&gt;
+Py2 python/console configuration analysis:
+[*] env[PYTHONIOENCODING] = None
+    [-] No env variable &lt;PYTHONIOENCODING&gt;.
+        sys.stdout encoding will only depends on your console codepage. Leading to high probability of EncodingError if printing unicode string
+[*] sys.stdout.encoding = cp437
+    [-] Unoptimal stdout encoding
+        Recommended fix is setting PYTHONIOENCODING == utf-8
+[*] Console Codepage = 437
+    [-] Non UTF-8 codepage for the current console
+        Setting codepage to UTF8 (chcp 65001) will ensure currect output with PYTHONIOENCODING UTF-8
+[-] Error printing unicode string: &#39;charmap&#39; codec can&#39;t encode characters in position 23-31: character maps to &lt;undefined&gt;
+Unicode object repr: &lt;MyUtf8Object name=&quot;\u304a\u524d\u306f\u3082\u3046\u6b7b\u3093\u3067\u3044-\u043a\u0430\u043a\u0438\u0435_\u0444\u0436\u044e\u0449\u0434\u0444\u044f&quot;&gt;
+</pre></div>
+</div>
+</div>
+<div class="section" id="pythonioencoding-only">
+<h3>17.3.2. PYTHONIOENCODING only<a class="headerlink" href="#pythonioencoding-only" title="Permalink to this headline">¶</a></h3>
+<p><code class="docutils literal notranslate"><span class="pre">PYTHONIOENCODING</span></code> is set to <code class="docutils literal notranslate"><span class="pre">utf-8</span></code> and code page is something like 437.</p>
+<blockquote>
+<div><ul class="simple">
+<li>The printing of an unicode string will work but display gibberish</li>
+<li>The printing of an unicode __repr__ will work but display gibberish</li>
+</ul>
+</div></blockquote>
+<p>This is due to a mis-match between python output encoding and the console expected output.</p>
+<p>Example:</p>
+<div class="highlight-default notranslate"><div class="highlight"><pre><span></span>$ chcp
+Active code page: 437
+
+$ set PYTHONIOENCODING=utf-8
+
+$ python samples\encoding\check_encoding_config.py
+Python version is &lt;2.7.12 (v2.7.12:d33e0cf91556, Jun 27 2016, 15:19:22) [MSC v.1500 32 bit (Intel)]&gt;
+Py2 python/console configuration analysis:
+[*] env[PYTHONIOENCODING] = utf-8
+    [+] Optimal PYTHONIOENCODING
+[*] sys.stdout.encoding = utf-8
+[*] Console Codepage = 437
+    [-] Non UTF-8 codepage for the current console
+        Setting codepage to UTF8 (chcp 65001) will ensure currect output with PYTHONIOENCODING UTF-8
+Unicode string print: &lt;お前はもう死んでい-какие_фжющдфя&gt;
+Unicode object repr: &lt;MyUtf8Object name=&quot;お前はもう死んでい-какие_фжющдфя&quot;&gt;
+</pre></div>
+</div>
+</div>
+<div class="section" id="full-setup">
+<h3>17.3.3. Full setup<a class="headerlink" href="#full-setup" title="Permalink to this headline">¶</a></h3>
+<p><code class="docutils literal notranslate"><span class="pre">PYTHONIOENCODING</span></code> is set to <code class="docutils literal notranslate"><span class="pre">utf-8</span></code> and code page is 65001.
+Everything should work:</p>
+<div class="highlight-default notranslate"><div class="highlight"><pre><span></span>$ set PYTHONIOENCODING=utf-8
+
+$ chcp 65001
+Active code page: 65001
+
+$ python samples\encoding\check_encoding_config.py
+Python version is &lt;2.7.12 (v2.7.12:d33e0cf91556, Jun 27 2016, 15:19:22) [MSC v.1500 32 bit (Intel)]&gt;
+Py2 python/console configuration analysis:
+[*] env[PYTHONIOENCODING] = utf-8
+    [+] Optimal PYTHONIOENCODING
+[*] sys.stdout.encoding = utf-8
+[*] Console Codepage = 65001
+Unicode string print: &lt;お前はもう死んでい-какие_фжющдфя&gt;
+Unicode object repr: &lt;MyUtf8Object name=&quot;お前はもう死んでい-какие_фжющдфя&quot;&gt;
+</pre></div>
+</div>
+</div>
+</div>
+</div>
+
+
+          </div>
+        </div>
+      </div>
+      <div class="sphinxsidebar" role="navigation" aria-label="main navigation">
+        <div class="sphinxsidebarwrapper">
+  <h3><a href="index.html">Table of Contents</a></h3>
+  <ul>
+<li><a class="reference internal" href="#">17. Python, Windows &amp; encoding</a><ul>
+<li><a class="reference internal" href="#what-does-this-additional-configuration-does">17.1. What does this additional configuration does ?</a><ul>
+<li><a class="reference internal" href="#pythonioencoding">17.1.1. PYTHONIOENCODING</a></li>
+<li><a class="reference internal" href="#chcp-65001">17.1.2. chcp 65001</a></li>
+</ul>
+</li>
+<li><a class="reference internal" href="#the-case-of-repr">17.2. The case of __repr__</a></li>
+<li><a class="reference internal" href="#sample-of-test">17.3. Sample of test</a><ul>
+<li><a class="reference internal" href="#no-setup">17.3.1. No setup</a></li>
+<li><a class="reference internal" href="#pythonioencoding-only">17.3.2. PYTHONIOENCODING only</a></li>
+<li><a class="reference internal" href="#full-setup">17.3.3. Full setup</a></li>
+</ul>
+</li>
+</ul>
+</li>
+</ul>
+
+  <h4>Previous topic</h4>
+  <p class="topless"><a href="wip.html"
+                        title="previous chapter">16. Early Work In Progress</a></p>
+  <h4>Next topic</h4>
+  <p class="topless"><a href="internals.html"
+                        title="next chapter">18. Internals</a></p>
+  <div role="note" aria-label="source link">
+    <h3>This Page</h3>
+    <ul class="this-page-menu">
+      <li><a href="_sources/encoding.rst.txt"
+            rel="nofollow">Show Source</a></li>
+    </ul>
+   </div>
+<div id="searchbox" style="display: none" role="search">
+  <h3>Quick search</h3>
+    <div class="searchformwrapper">
+    <form class="search" action="search.html" method="get">
+      <input type="text" name="q" />
+      <input type="submit" value="Go" />
+      <input type="hidden" name="check_keywords" value="yes" />
+      <input type="hidden" name="area" value="default" />
+    </form>
+    </div>
+</div>
+<script type="text/javascript">$('#searchbox').show(0);</script>
+        </div>
+      </div>
+      <div class="clearer"></div>
+    </div>
+    <div class="related" role="navigation" aria-label="related navigation">
+      <h3>Navigation</h3>
+      <ul>
+        <li class="right" style="margin-right: 10px">
+          <a href="genindex.html" title="General Index"
+             >index</a></li>
+        <li class="right" >
+          <a href="py-modindex.html" title="Python Module Index"
+             >modules</a> |</li>
+        <li class="right" >
+          <a href="internals.html" title="18. Internals"
+             >next</a> |</li>
+        <li class="right" >
+          <a href="wip.html" title="16. Early Work In Progress"
+             >previous</a> |</li>
+        <li class="nav-item nav-item-0"><a href="index.html">PythonForWindows 0.6 documentation</a> &#187;</li> 
+      </ul>
+    </div>
+    <div class="footer" role="contentinfo">
+        &#169; Copyright 2015-2020, Clement Rouault.
+      Created using <a href="http://sphinx-doc.org/">Sphinx</a> 1.8.5.
+    </div>
+  </body>
+</html>

docs/build/html/etw.html

@@ -174,7 +174,7 @@ This function will call <code class="docutils literal notranslate"><span class="
 
 <dl class="method">
 <dt id="windows.winobject.event_trace.EtwTrace.start">
-<code class="descname">start</code><span class="sig-paren">(</span><em>flags=0</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/event_trace.html#EtwTrace.start"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.winobject.event_trace.EtwTrace.start" title="Permalink to this definition">¶</a></dt>
+<code class="descname">start</code><span class="sig-paren">(</span><em>flags=0</em>, <em>mode=0</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/event_trace.html#EtwTrace.start"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.winobject.event_trace.EtwTrace.start" title="Permalink to this definition">¶</a></dt>
 <dd><p>Start the tracing</p>
 </dd></dl>
 

docs/build/html/evtlog.html

@@ -199,6 +199,8 @@
 <dd><code class="docutils literal notranslate"><span class="pre">Event/EventData[Data='C:\WINDOWS\System32\svchost.exe']</span></code></dd>
 <dt>List all events with an EventID of 2006:</dt>
 <dd><code class="docutils literal notranslate"><span class="pre">Event/System[EventID=2006]</span></code></dd>
+<dt>List all event with a given EventID while searching for a specific field value (Sysmon for the test here)</dt>
+<dd><code class="docutils literal notranslate"><span class="pre">Event/System[EventID=3]</span> <span class="pre">and</span> <span class="pre">Event/EventData/Data[&#64;Name='DestinationIp']</span> <span class="pre">and</span> <span class="pre">Event/EventData[Data='10.0.0.2']</span></code></dd>
 </dl>
 </div>
 <table class="docutils field-list" frame="void" rules="none">
@@ -586,6 +588,8 @@
 <dd><code class="docutils literal notranslate"><span class="pre">Event/EventData[Data='C:\WINDOWS\System32\svchost.exe']</span></code></dd>
 <dt>List all events with an EventID of 2006:</dt>
 <dd><code class="docutils literal notranslate"><span class="pre">Event/System[EventID=2006]</span></code></dd>
+<dt>List all event with a given EventID while searching for a specific field value (Sysmon for the test here)</dt>
+<dd><code class="docutils literal notranslate"><span class="pre">Event/System[EventID=3]</span> <span class="pre">and</span> <span class="pre">Event/EventData/Data[&#64;Name='DestinationIp']</span> <span class="pre">and</span> <span class="pre">Event/EventData[Data='10.0.0.2']</span></code></dd>
 </dl>
 </div>
 <table class="docutils field-list" frame="void" rules="none">

docs/build/html/index.html

@@ -57,15 +57,18 @@ I am always glad to have feedbacks from people using this project.</p>
 <p>Examples are available on the <a class="reference external" href="https://github.com/hakril/pythonforwindows#pythonforwindows">github page</a>  and in the <a class="reference internal" href="sample.html#sample-of-code"><span class="std std-ref">Samples of code</span></a>.</p>
 <div class="section" id="installation">
 <h3>Installation<a class="headerlink" href="#installation" title="Permalink to this headline">¶</a></h3>
-<div class="section" id="installing-using-setup-py">
-<h4>Installing using setup.py<a class="headerlink" href="#installing-using-setup-py" title="Permalink to this headline">¶</a></h4>
-<p>You can install PythonForWindows using the <code class="docutils literal notranslate"><span class="pre">setup.py</span></code> at the root of the project:</p>
-<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="n">python</span> <span class="n">setup</span><span class="o">.</span><span class="n">py</span> <span class="n">install</span>
+<div class="section" id="installing-from-pypi">
+<h4>Installing from Pypi<a class="headerlink" href="#installing-from-pypi" title="Permalink to this headline">¶</a></h4>
+<p>PythonForWindows is available on <a class="reference external" href="https://pypi.org/project/PythonForWindows/">Pypi</a> an this can be installed with:</p>
+<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="n">python</span> <span class="o">-</span><span class="n">m</span> <span class="n">pip</span> <span class="n">install</span> <span class="n">PythonForWindows</span>
 </pre></div>
 </div>
-<div class="admonition warning">
-<p class="first admonition-title">Warning</p>
-<p class="last">PythonForWindows is not available on Pypi for now and thus cannot be directly installed using <code class="docutils literal notranslate"><span class="pre">pip</span></code>.</p>
+</div>
+<div class="section" id="installing-using-setup-py">
+<h4>Installing using setup.py<a class="headerlink" href="#installing-using-setup-py" title="Permalink to this headline">¶</a></h4>
+<p>You can also install PythonForWindows by cloning it and using the <code class="docutils literal notranslate"><span class="pre">setup.py</span></code> at the root of the project:</p>
+<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="n">python</span> <span class="n">setup</span><span class="o">.</span><span class="n">py</span> <span class="n">install</span>
+</pre></div>
 </div>
 </div>
 <div class="section" id="python3">
@@ -241,6 +244,7 @@ Do not hesitate report bugs and issues.</p>
 <li><a class="reference internal" href="#">Welcome to PythonForWindows’s documentation!</a><ul>
 <li><a class="reference internal" href="#description">Description</a><ul>
 <li><a class="reference internal" href="#installation">Installation</a><ul>
+<li><a class="reference internal" href="#installing-from-pypi">Installing from Pypi</a></li>
 <li><a class="reference internal" href="#installing-using-setup-py">Installing using setup.py</a></li>
 <li><a class="reference internal" href="#python3">Python3</a></li>
 </ul>

docs/build/html/native_exec.html

@@ -381,6 +381,77 @@ including jump and label via the <code class="xref py py-class docutils literal
 <span class="s1">&#39;</span><span class="se">\x81</span><span class="s1">~</span><span class="se">\x08\x0c\x00\x00\x00</span><span class="s1">u&amp;</span><span class="se">\x8b</span><span class="s1">N</span><span class="se">\x10\x8b</span><span class="s1">Q</span><span class="se">\x04\x8b</span><span class="s1">A</span><span class="se">\x08\x8b\t\x81\xf9\x01\x00\x00\x00</span><span class="s1">u</span><span class="se">\x03\xee\xeb\r\x81\xf9\x02\x00\x00\x00</span><span class="s1">u</span><span class="se">\x04</span><span class="s1">f</span><span class="se">\xef\xeb\x01\xef</span><span class="s1">1</span><span class="se">\xc0\xc3\xc7\xc0\r\x00\x00\xc0\xc3</span><span class="s1">&#39;</span>
 </pre></div>
 </div>
+<div class="section" id="available-instructions-in-x86-assembler">
+<h3>3.2.1. Available Instructions in X86 assembler<a class="headerlink" href="#available-instructions-in-x86-assembler" title="Permalink to this headline">¶</a></h3>
+<div class="admonition note">
+<p class="first admonition-title">Note</p>
+<p>Not all encodings may be implemented for each of the instructions.</p>
+<p class="last"><code class="docutils literal notranslate"><span class="pre">Byte</span></code> and <code class="docutils literal notranslate"><span class="pre">Raw</span></code> are not x86 instruction and allow to insert arbitrary data to the generated code.</p>
+</div>
+<p>Listing:</p>
+<blockquote>
+<div><ul class="simple">
+<li>Add</li>
+<li>And</li>
+<li>Byte</li>
+<li>Cmp</li>
+<li>CmpsB</li>
+<li>CmpsD</li>
+<li>CmpsW</li>
+<li>Cpuid</li>
+<li>Dec</li>
+<li>In</li>
+<li>Inc</li>
+<li>Int</li>
+<li>Int3</li>
+<li>Iret</li>
+<li>Lea</li>
+<li>Mov</li>
+<li>Movsb</li>
+<li>Movsd</li>
+<li>Nop</li>
+<li>Not</li>
+<li>Or</li>
+<li>Out</li>
+<li>Pop</li>
+<li>Popad</li>
+<li>Popfd</li>
+<li>Push</li>
+<li>Pushad</li>
+<li>Pushfd</li>
+<li>Raw</li>
+<li>Ret</li>
+<li>Retf</li>
+<li>Rol</li>
+<li>Ror</li>
+<li>ScasB</li>
+<li>ScasD</li>
+<li>ScasW</li>
+<li>Shl</li>
+<li>Shr</li>
+<li>StosB</li>
+<li>StosD</li>
+<li>StosW</li>
+<li>Sub</li>
+<li>Test</li>
+<li>Xchg</li>
+<li>Xor</li>
+</ul>
+</div></blockquote>
+<div class="admonition note">
+<p class="first admonition-title">Note</p>
+<p><code class="docutils literal notranslate"><span class="pre">Raw</span></code>: Output raw data from an hexadecimal string</p>
+<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">&gt;&gt;&gt; </span><span class="n">windows</span><span class="o">.</span><span class="n">native_exec</span><span class="o">.</span><span class="n">simple_x64</span><span class="o">.</span><span class="n">Raw</span><span class="p">(</span><span class="s2">&quot;90C332FCFF&quot;</span><span class="p">)</span><span class="o">.</span><span class="n">get_code</span><span class="p">()</span>
+<span class="go">&#39;\x90\xc32\xfc\xff&#39;</span>
+</pre></div>
+</div>
+<p><code class="docutils literal notranslate"><span class="pre">Byte</span></code>: Output a raw byte</p>
+<div class="last highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">&gt;&gt;&gt; </span><span class="n">windows</span><span class="o">.</span><span class="n">native_exec</span><span class="o">.</span><span class="n">simple_x86</span><span class="o">.</span><span class="n">Byte</span><span class="p">(</span><span class="mh">0x42</span><span class="p">)</span><span class="o">.</span><span class="n">get_code</span><span class="p">()</span>
+<span class="go">&#39;B&#39;</span>
+</pre></div>
+</div>
+</div>
+</div>
 </div>
 <div class="section" id="module-windows.native_exec.simple_x64">
 <span id="windows-native-exec-simple-x64-x64-assembler"></span><h2>3.3. <a class="reference internal" href="#module-windows.native_exec.simple_x64" title="windows.native_exec.simple_x64"><code class="xref py py-mod docutils literal notranslate"><span class="pre">windows.native_exec.simple_x64</span></code></a> – X64 Assembler<a class="headerlink" href="#module-windows.native_exec.simple_x64" title="Permalink to this headline">¶</a></h2>
@@ -413,6 +484,65 @@ including jump and label via the <code class="xref py py-class docutils literal
 <span class="go">&#39;g\x8b\x00&#39;</span>
 </pre></div>
 </div>
+<div class="section" id="available-instructions-in-x64-assembler">
+<h3>3.3.1. Available Instructions in X64 assembler<a class="headerlink" href="#available-instructions-in-x64-assembler" title="Permalink to this headline">¶</a></h3>
+<div class="admonition note">
+<p class="first admonition-title">Note</p>
+<p>Not all encodings may be implemented for each of the instructions.</p>
+<p class="last"><code class="docutils literal notranslate"><span class="pre">Raw</span></code> is not an x64 instruction and allow to insert arbitrary data to the generated code.</p>
+</div>
+<dl class="docutils">
+<dt>Listing:</dt>
+<dd><ul class="first last simple">
+<li>Add</li>
+<li>And</li>
+<li>Cmp</li>
+<li>CmpsB</li>
+<li>CmpsD</li>
+<li>CmpsQ</li>
+<li>CmpsW</li>
+<li>Cpuid</li>
+<li>Dec</li>
+<li>In</li>
+<li>Inc</li>
+<li>Int</li>
+<li>Int3</li>
+<li>Lea</li>
+<li>Mov</li>
+<li>Nop</li>
+<li>Not</li>
+<li>Or</li>
+<li>Out</li>
+<li>Pop</li>
+<li>Popfq</li>
+<li>Push</li>
+<li>Pushfq</li>
+<li>Raw</li>
+<li>Ret</li>
+<li>Retf</li>
+<li>Retf32</li>
+<li>ScasB</li>
+<li>ScasD</li>
+<li>ScasQ</li>
+<li>ScasW</li>
+<li>Shl</li>
+<li>Shr</li>
+<li>Sub</li>
+<li>Test</li>
+<li>Xchg</li>
+<li>Xor</li>
+</ul>
+</dd>
+</dl>
+<div class="admonition note">
+<p class="first admonition-title">Note</p>
+<p><code class="docutils literal notranslate"><span class="pre">Raw</span></code>: Output raw data from an hexadecimal string</p>
+<div class="last highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">&gt;&gt;&gt; </span><span class="n">windows</span><span class="o">.</span><span class="n">native_exec</span><span class="o">.</span><span class="n">simple_x64</span><span class="o">.</span><span class="n">Raw</span><span class="p">(</span><span class="s2">&quot;90C332FCFF&quot;</span><span class="p">)</span><span class="o">.</span><span class="n">get_code</span><span class="p">()</span>
+<span class="go">&#39;\x90\xc32\xfc\xff&#39;</span>
+</pre></div>
+</div>
+</div>
+</div>
 </div>
 <div class="section" id="module-windows.native_exec.nativeutils">
 <span id="windows-native-exec-nativeutils-native-utility-functions"></span><h2>3.4. <a class="reference internal" href="#module-windows.native_exec.nativeutils" title="windows.native_exec.nativeutils"><code class="xref py py-mod docutils literal notranslate"><span class="pre">windows.native_exec.nativeutils</span></code></a> – Native utility functions<a class="headerlink" href="#module-windows.native_exec.nativeutils" title="Permalink to this headline">¶</a></h2>
@@ -500,8 +630,14 @@ the end of your <code class="xref py py-class docutils literal notranslate"><spa
   <ul>
 <li><a class="reference internal" href="#">3. <code class="docutils literal notranslate"><span class="pre">windows.native_exec</span></code> – Native Code Execution</a><ul>
 <li><a class="reference internal" href="#module-windows.native_exec.cpuid">3.1. <code class="docutils literal notranslate"><span class="pre">windows.native_exec.cpuid</span></code> – Interface to native CPUID</a></li>
-<li><a class="reference internal" href="#module-windows.native_exec.simple_x86">3.2. <code class="docutils literal notranslate"><span class="pre">windows.native_exec.simple_x86</span></code> – X86 Assembler</a></li>
-<li><a class="reference internal" href="#module-windows.native_exec.simple_x64">3.3. <code class="docutils literal notranslate"><span class="pre">windows.native_exec.simple_x64</span></code> – X64 Assembler</a></li>
+<li><a class="reference internal" href="#module-windows.native_exec.simple_x86">3.2. <code class="docutils literal notranslate"><span class="pre">windows.native_exec.simple_x86</span></code> – X86 Assembler</a><ul>
+<li><a class="reference internal" href="#available-instructions-in-x86-assembler">3.2.1. Available Instructions in X86 assembler</a></li>
+</ul>
+</li>
+<li><a class="reference internal" href="#module-windows.native_exec.simple_x64">3.3. <code class="docutils literal notranslate"><span class="pre">windows.native_exec.simple_x64</span></code> – X64 Assembler</a><ul>
+<li><a class="reference internal" href="#available-instructions-in-x64-assembler">3.3.1. Available Instructions in X64 assembler</a></li>
+</ul>
+</li>
 <li><a class="reference internal" href="#module-windows.native_exec.nativeutils">3.4. <code class="docutils literal notranslate"><span class="pre">windows.native_exec.nativeutils</span></code> – Native utility functions</a></li>
 </ul>
 </li>

docs/build/html/process.html

@@ -357,13 +357,13 @@
 
 <dl class="method">
 <dt id="windows.winobject.process.CurrentProcess.read_string">
-<code class="descname">read_string</code><span class="sig-paren">(</span><em>addr</em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.CurrentProcess.read_string" title="Permalink to this definition">¶</a></dt>
+<code class="descname">read_string</code><span class="sig-paren">(</span><em>addr</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/process.html#CurrentProcess.read_string"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.winobject.process.CurrentProcess.read_string" title="Permalink to this definition">¶</a></dt>
 <dd><p>Read an ascii string at <code class="docutils literal notranslate"><span class="pre">addr</span></code></p>
 </dd></dl>
 
 <dl class="method">
 <dt id="windows.winobject.process.CurrentProcess.read_wstring">
-<code class="descname">read_wstring</code><span class="sig-paren">(</span><em>addr</em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.CurrentProcess.read_wstring" title="Permalink to this definition">¶</a></dt>
+<code class="descname">read_wstring</code><span class="sig-paren">(</span><em>addr</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/process.html#CurrentProcess.read_wstring"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.winobject.process.CurrentProcess.read_wstring" title="Permalink to this definition">¶</a></dt>
 <dd><p>Read a windows UTF16 string at <code class="docutils literal notranslate"><span class="pre">addr</span></code></p>
 </dd></dl>
 

docs/source/index.rst

@@ -27,17 +27,22 @@ Examples are available on the `github page <https://github.com/hakril/pythonforw
 Installation
 ''''''''''''
 
+Installing from Pypi
+^^^^^^^^^^^^^^^^^^^^
+
+PythonForWindows is available on `Pypi <https://pypi.org/project/PythonForWindows/>`_ an this can be installed with::
+
+
+    python -m pip install PythonForWindows
+
 Installing using setup.py
 ^^^^^^^^^^^^^^^^^^^^^^^^^
 
-You can install PythonForWindows using the ``setup.py`` at the root of the project::
+
+You can also install PythonForWindows by cloning it and using the ``setup.py`` at the root of the project::
 
     python setup.py install
 
-.. warning::
-
-    PythonForWindows is not available on Pypi for now and thus cannot be directly installed using ``pip``.
-
 
 Python3
 ^^^^^^^

docs/source/native_exec.rst

@@ -147,6 +147,8 @@ Another example from a project::
         '\x81~\x08\x0c\x00\x00\x00u&\x8bN\x10\x8bQ\x04\x8bA\x08\x8b\t\x81\xf9\x01\x00\x00\x00u\x03\xee\xeb\r\x81\xf9\x02\x00\x00\x00u\x04f\xef\xeb\x01\xef1\xc0\xc3\xc7\xc0\r\x00\x00\xc0\xc3'
 
 
+
+
 :mod:`windows.native_exec.simple_x64` -- X64 Assembler
 """"""""""""""""""""""""""""""""""""""""""""""""""""""
 

samples/alpc/advanced_alpc.py

@@ -19,8 +19,8 @@ def full_alpc_server():
     msg = server.recv()
     print("[SERV] == Message received ==")
     if msg.type & 0xfff == LPC_CONNECTION_REQUEST:
-        print(" * ALPC connection request: <{0}>".format(msg.data))
-        msg.data = "Connection message response"
+        print(" * ALPC connection request: <{0}>".format(msg.data.decode()))
+        msg.data = b"Connection message response"
         server.accept_connection(msg, port_context=PORT_CONTEXT)
     else:
         raise ValueError("Expected connection")
@@ -33,7 +33,7 @@ def full_alpc_server():
         # print("[SERV] RECV Message Valid ATTRS = {0:#x}".format(msg.attributes.ValidAttributes))
         # print("[SERV] RECV Message ATTRS = {0:#x}".format(msg.attributes.AllocatedAttributes))
         if msg.type & 0xfff == LPC_REQUEST:
-            print(" * ALPC request: <{0}>".format(msg.data))
+            print(" * ALPC request: <{0}>".format(msg.data.decode()))
             print(" * view_is_valid <{0}>".format(msg.view_is_valid))
             if msg.view_is_valid:
                 print("   * message view attribute:")
@@ -69,20 +69,20 @@ def full_alpc_server():
             # We can reply by to way:
             #    - Send the same message with modified data
             #    - Recreate a Message and copy the MessageId
-            msg.data = "REQUEST '{0}' DONE".format(msg.data)
+            msg.data = "REQUEST '{0}' DONE".format(msg.data.decode()).encode()
             sys.stdout.flush()
             server.send(msg)
         else:
-            print ValueError("Unexpected message type <{0}>".format(msg.type & 0xfff))
+            print(ValueError("Unexpected message type <{0}>".format(msg.type & 0xfff)))
 
 
 def send_message_with_handle(client):
-    print ""
+    print("")
     print("[Client] == Sending a message with a handle ==")
 
     # Craft a file with some data
     f = tempfile.NamedTemporaryFile()
-    f.write("Tempfile data <3")
+    f.write(b"Tempfile data <3")
     f.seek(0)
 
     # New message with a Handle
@@ -92,11 +92,11 @@ def send_message_with_handle(client):
     msg.handle_attribute.Handle = windows.utils.get_handle_from_file(f)
     msg.handle_attribute.ObjectType = 0
     msg.handle_attribute.DesiredAccess = 0
-    msg.data = "some message with a file"
+    msg.data = b"some message with a file"
     client.send_receive(msg)
 
 def send_message_with_view(client):
-    print ""
+    print("")
     print("[Client] == Sending a message with a view ==")
 
     # Create View
@@ -110,8 +110,8 @@ def send_message_with_view(client):
     msg.view_attribute.ViewBase = view.ViewBase
     msg.view_attribute.SectionHandle = view.SectionHandle
     msg.view_attribute.ViewSize = 0x4000
-    msg.data = "some message with a view"
-    windows.current_process.write_memory(view.ViewBase, "The content of the view :)\x00")
+    msg.data = b"some message with a view"
+    windows.current_process.write_memory(view.ViewBase, b"The content of the view :)\x00")
     client.send_receive(msg)
 
 def alpc_client():
@@ -121,20 +121,20 @@ def alpc_client():
     # You can create a non-connected AlpcClient and send a custom
     # 'AlpcMessage' for complexe alpc port connection.
     connect_message = windows.alpc.AlpcMessage()
-    connect_message.data = "Connection request client message"
+    connect_message.data = b"Connection request client message"
     print("[CLIENT] == Connecting to port ==")
     connect_response = client.connect_to_port(PORT_NAME, connect_message)
-    print("[CLIENT] Connected with response: <{0}>".format(connect_response.data))
+    print("[CLIENT] Connected with response: <{0}>".format(connect_response.data.decode()))
 
     # AlpcClient send/recv/send_receive methods accept both string or
     # AlpcMessage for complexe message.
-    print""
+    print("")
     print("[CLIENT] == Sending a message ==")
     msg = windows.alpc.AlpcMessage()
-    msg.data = "Complex Message 1"
-    print(" * Sending Message <{0}>".format(msg.data))
+    msg.data = b"Complex Message 1"
+    print(" * Sending Message <{0}>".format(msg.data.decode()))
     response = client.send_receive(msg)
-    print("[CLIENT] Server response: <{0}>".format(response.data))
+    print("[CLIENT] Server response: <{0}>".format(response.data.decode()))
     print("[CLIENT] RESP Message Valid ATTRS = {0}".format(response.valid_attributes))
 
     send_message_with_handle(client)

samples/alpc/simple_alpc.py

@@ -12,20 +12,20 @@ def alpc_server():
 
     msg = server.recv() # Wait for a message
     print("[SERV] Message type = {0:#x}".format(msg.type))
-    print("[SERV] Received data: <{0}>".format(msg.data))
+    print("[SERV] Received data: <{0}>".format(msg.data.decode()))
     assert msg.type & 0xfff  == LPC_CONNECTION_REQUEST # Check that message is a connection request
     print("[SERV] Connection request")
     server.accept_connection(msg)
 
     msg = server.recv() # Wait for a real message
-    print ""
-    print("[SERV] Received message: <{0}>".format(msg.data))
+    print("")
+    print("[SERV] Received message: <{0}>".format(msg.data.decode()))
     print("[SERV] Message type = {0:#x}".format(msg.type))
     assert msg.type & 0xfff  == LPC_REQUEST
     # We can reply by two ways:
     #    - Send the same message with modified data
     #    - Recreate a Message and copy the MessageId
-    msg.data = "REQUEST '{0}' DONE".format(msg.data)
+    msg.data = u"REQUEST '{0}' DONE".format(msg.data.decode()).encode()
     server.send(msg)
 
 
@@ -36,15 +36,15 @@ def alpc_client():
     client = windows.alpc.AlpcClient(PORT_NAME)
     print("[CLIENT] Connected: {0}".format(client))
     # Send a message / wait for the response
-    response = client.send_receive("Hello world !")
-    print("[CLIENT] Response: <{0}>".format(response.data))
+    response = client.send_receive(b"Hello world !")
+    print("[CLIENT] Response: <{0}>".format(response.data.decode()))
     # You can also send message without waiting for a response with 'client.send'
 
 
 if __name__ == "__main__":
     proc = multiprocessing.Process(target=alpc_server, args=())
     proc.start()
-    import time; time.sleep(0.5)
+    import time; time.sleep(1)
     alpc_client()
     print("BYE")
     proc.terminate()

samples/event_log/evtexplorer.py

@@ -0,0 +1,90 @@
+import sys
+import windows
+
+# target = int(sys.argv[1])
+
+import argparse
+
+parser = argparse.ArgumentParser(prog=__file__, formatter_class=argparse.ArgumentDefaultsHelpFormatter)
+
+parser.add_argument('--channel', nargs=1)
+parser.add_argument('--publisher', nargs=1)
+parser.add_argument('--verbose', action="store_true")
+parser.add_argument('--evtdata', action="store_true")
+parser.add_argument('--list-channels', action="store_true")
+parser.add_argument('--list-publishers', action="store_true")
+parser.add_argument('evtid', nargs="?", type=int)
+args = parser.parse_args()
+print(args)
+
+for publisher in windows.system.event_log.publishers:
+    if args.publisher and args.publisher[0] not in publisher.name:
+        continue
+
+    if args.list_publishers:
+        print(publisher)
+        continue
+
+    try:
+        channels = publisher.metadata.channel_name_by_id
+    except WindowsError as e:
+        if args.verbose:
+            print(publisher, e)
+        continue
+
+
+
+    if args.list_channels:
+        publisher_printed = False
+        for chan in channels.values():
+            if args.channel and  args.channel[0] not in chan:
+                continue
+            if not publisher_printed:
+                print(publisher)
+                publisher_printed = True
+            print(" * {0}".format(chan))
+        continue
+
+
+    if args.channel:
+        channels = {k:v for k,v in channels.items() if args.channel[0] in v}
+
+    try:
+        eventsmeta = publisher.metadata.events_metadata
+    except WindowsError as e:
+        if args.verbose:
+            print(publisher, e)
+        continue
+
+    match_events = {k: [] for k in channels}
+    match_events[0] = []
+    try:
+        for eventmeta in eventsmeta:
+            if args.evtid and args.evtid != eventmeta.id:
+                continue
+            if eventmeta.channel_id in match_events:
+                match_events[eventmeta.channel_id].append(eventmeta)
+    except WindowsError as e:
+        if args.verbose:
+            print(publisher, e)
+        continue
+
+    for channel_id in match_events:
+        # if args.channel: print channel anyway
+        if (not args.channel) and not match_events[channel_id]:
+            continue
+        if channel_id == 0:
+            print("<Undefined channel> of {0}".format(publisher))
+        else:
+            print(channels[channel_id])
+        for eventsmeta in match_events[channel_id]:
+            try:
+                msg = publisher.metadata.message(eventsmeta.message_id)
+            except WindowsError as e:
+                msg = ""
+
+            print("  * {0} <{1!r}>".format(eventsmeta.id, msg))
+            if args.evtdata:
+                for evtdata in eventsmeta.event_data:
+                    print("    * {0} ({1})".format(evtdata["name"], evtdata["outType"]))
+

samples/find_value.py

@@ -89,5 +89,4 @@ except ValueError:
     search_name(target)
 else:
     print("== Searching value <{0:#x}> ==".format(itarget))
-    print ""
     search_value(itarget)

samples/native_utils.py

@@ -36,8 +36,7 @@ c += x64.Ret()
 RemoteManualLoadLibray += GetProcAddress64
 
 
-calc= windows.test.pop_proc_64(dwCreationFlags=CREATE_SUSPENDED)
-
+calc = windows.test.pop_proc_64(dwCreationFlags=CREATE_SUSPENDED)
 addr = calc.virtual_alloc(0x1000)
 addr2 = addr + len(dll)
 addr3 = addr2 + len(api)

samples/network/demo_ws2_32.py

@@ -0,0 +1,36 @@
+import windows.generated_def as gdef
+import windows.winproxy
+import ctypes
+
+
+WEBSITE = b"perdu.com"
+MESSAGE = b"""GET / HTTP/1.1\r\nHost: perdu.com\r\n\r\n"""
+
+x = gdef.WSADATA()
+windows.winproxy.WSAStartup(0x0202, x)
+
+print("=== WSADATA ===")
+windows.utils.sprint(x)
+
+hints = gdef.ADDRINFOA()
+hints.ai_family = gdef.AF_UNSPEC
+hints.ai_socktype = gdef.SOCK_STREAM
+hints.ai_protocol = gdef.IPPROTO_TCP
+
+result = gdef.PADDRINFOA()
+windows.winproxy.getaddrinfo(WEBSITE, b"80", hints, result);
+
+print("=== PADDRINFOA ===")
+windows.utils.sprint(result)
+
+
+connect_socket = windows.winproxy.socket(result[0].ai_family, result[0].ai_socktype, result[0].ai_protocol)
+res =  windows.winproxy.connect(connect_socket, result[0].ai_addr, result[0].ai_addrlen)
+windows.winproxy.send(connect_socket, MESSAGE)
+
+buf = ctypes.create_string_buffer(10000)
+windows.winproxy.recv(connect_socket, buf)
+print("Received:\n{0}".format(buf.value))
+
+windows.winproxy.closesocket(connect_socket)
+windows.winproxy.WSACleanup()

setup.py

@@ -1,16 +1,24 @@
 # -*- coding: utf-8 -*-
 import sys
+import os.path
 from setuptools import setup
 
 PKG_NAME = "PythonForWindows"
-VERSION  = "0.6"
+VERSION  = "0.6.8"
+
+# Load long description from README.md
+this_directory = os.path.abspath(os.path.dirname(__file__))
+with open(os.path.join(this_directory, 'README.md')) as f:
+    long_description = f.read()
 
 setup(
     name = PKG_NAME,
     version = VERSION,
     author = 'Hakril',
-    author_email = 'none',
+    author_email = 'pfw@hakril.net',
     description = 'A codebase aimed to make interaction with Windows and native execution easier',
+    long_description=long_description,
+    long_description_content_type='text/markdown',
     license = 'BSD',
     keywords = 'windows python',
     url = 'https://github.com/hakril/PythonForWindows',

tests/conftest.py

@@ -11,21 +11,29 @@ from .pfwtest import is_windows_32_bits, is_process_32_bits, test_binary_name, D
 
 if is_windows_32_bits:
     def pop_proc_32(dwCreationFlags=DEFAULT_CREATION_FLAGS):
-        return windows.utils.create_process(r"C:\Windows\system32\{0}".format(test_binary_name).encode("ascii"), dwCreationFlags=dwCreationFlags, show_windows=True)
+        p = windows.utils.create_process(r"C:\Windows\system32\{0}".format(test_binary_name).encode("ascii"), dwCreationFlags=dwCreationFlags, show_windows=True)
+        assert p.bitness == 32
+        return p
 
     def pop_proc_64(dwCreationFlags=DEFAULT_CREATION_FLAGS):
         raise WindowsError("Cannot create calc64 in 32bits system")
 else:
     def pop_proc_32(dwCreationFlags=DEFAULT_CREATION_FLAGS):
-        return windows.utils.create_process(r"C:\Windows\syswow64\{0}".format(test_binary_name).encode("ascii"), dwCreationFlags=dwCreationFlags, show_windows=True)
+        p = windows.utils.create_process(r"C:\Windows\syswow64\{0}".format(test_binary_name).encode("ascii"), dwCreationFlags=dwCreationFlags, show_windows=True)
+        assert p.bitness == 32
+        return p
 
     if is_process_32_bits:
         def pop_proc_64(dwCreationFlags=DEFAULT_CREATION_FLAGS):
             with windows.utils.DisableWow64FsRedirection():
-                return windows.utils.create_process(r"C:\Windows\system32\{0}".format(test_binary_name).encode("ascii"), dwCreationFlags=dwCreationFlags, show_windows=True)
+                p = windows.utils.create_process(r"C:\Windows\system32\{0}".format(test_binary_name).encode("ascii"), dwCreationFlags=dwCreationFlags, show_windows=True)
+                assert p.bitness == 64
+                return p
     else:
         def pop_proc_64(dwCreationFlags=DEFAULT_CREATION_FLAGS):
-            return windows.utils.create_process(r"C:\Windows\system32\{0}".format(test_binary_name).encode("ascii"), dwCreationFlags=dwCreationFlags, show_windows=True)
+            p = windows.utils.create_process(r"C:\Windows\system32\{0}".format(test_binary_name).encode("ascii"), dwCreationFlags=dwCreationFlags, show_windows=True)
+            assert p.bitness == 64
+            return p
 
 
 import sys
@@ -36,7 +44,8 @@ def generate_pop_and_exit_fixtures(proc_popers, ids=[], dwCreationFlags=DEFAULT_
     def pop_and_exit_process(request):
         proc_poper = request.param
         proc = proc_poper(dwCreationFlags=dwCreationFlags)
-        time.sleep(0.1) # Give time to the process to load :)
+        time.sleep(0.2) # Give time to the process to load :)
+        print("Created {0} ({1}bits) for test".format(proc, proc.bitness))
         yield weakref.proxy(proc)  # provide the fixture value
         try:
             proc.exit(0)

tests/pfwtest.py

@@ -28,7 +28,7 @@ require_admin = pytest.mark.skipif(not is_admin, reason="Test must be launched a
 check_for_gc_garbage = pytest.mark.usefixtures("check_for_gc_garbage")
 check_for_handle_leak = pytest.mark.usefixtures("check_for_handle_leak")
 
-test_binary_name = "notepad.exe"
+test_binary_name = "winver.exe"
 DEFAULT_CREATION_FLAGS = gdef.CREATE_NEW_CONSOLE
 
 
@@ -53,7 +53,7 @@ def check_injected_python_installed(request):
         raise ValueError("Could not find the fixture name of the injected python")
     procparam = procparams[0]
     proc = request.getfixturevalue(procparam)
-    if not python_is_installed[proc.bitness]:
+    if not windows.injection.find_python_dll_to_inject(proc.bitness):
         pytest.skip("Python {0}b not installed -> skipping test with python injection into {0}b process".format(proc.bitness))
     return None
 

tests/test_crypto.py

@@ -238,3 +238,21 @@ def test_cryptmsg_from_data():
     assert cryptmsg.get_recipient_data(0).SerialNumber.data[::-1] == rawtarget
 
 
+# Dpapi
+
+def test_dpapi_protect_unprotect():
+    message_to_protect = b"Testing DPAPI message \xff\x01 but also \x02\xfe\xee"
+    protected = windows.crypto.protect(message_to_protect)
+    assert message_to_protect not in protected
+    assert windows.crypto.unprotect(protected) == message_to_protect
+
+def test_dpapi_protect_unprotect_with_entropy():
+    message_to_protect = b"Testing DPAPI message \xff\x01 but also \x02\xfe\xee with entropy <3"
+    protect_entropy = b"This is a password ? \x01\xff\x99"
+    protected = windows.crypto.protect(message_to_protect, entropy=protect_entropy)
+    assert message_to_protect not in protected
+    with pytest.raises(WindowsError) as ar:
+        windows.crypto.unprotect(protected)
+    with pytest.raises(WindowsError) as ar:
+        windows.crypto.unprotect(protected, entropy=b"Not the good password")
+    assert windows.crypto.unprotect(protected, entropy=protect_entropy) == message_to_protect

tests/test_debugger.py

@@ -2,6 +2,7 @@ import pytest
 import textwrap
 import ctypes
 import os
+import time
 
 import windows
 import windows.debug
@@ -133,6 +134,8 @@ def test_four_hwx_breakpoint_fail(proc32_64_debug):
     proc32_64_debug.create_thread(addr, 0)
     with pytest.raises(ValueError) as e:
         d.loop()
+    d.detach()
+    proc32_64_debug.exit()
     assert "DRx" in e.value.args[0]
 
 
@@ -186,7 +189,9 @@ def test_simple_breakpoint_name_addr(proc32_64_debug, bptype):
             TSTBP.COUNTER += 1
             d.current_process.exit()
 
+    # import pdb; pdb.set_trace()
     d = windows.debug.Debugger(proc32_64_debug)
+    # Broken in Win11 for now: https://twitter.com/hakril/status/1555473886321549312
     d.add_bp(TSTBP("ntdll!LdrLoadDll"))
     d.loop()
     assert TSTBP.COUNTER == 1
@@ -372,9 +377,19 @@ def test_standard_breakpoint_self_remove(proc32_64_debug, bptype):
     data = set()
 
     def do_check():
-        proc32_64_debug.execute_python_unsafe("open(u'FILENAME1')").wait()
-        proc32_64_debug.execute_python_unsafe("open(u'FILENAME2')").wait()
-        proc32_64_debug.execute_python_unsafe("open(u'FILENAME3')").wait()
+        time.sleep(1)
+        print("[==================] LOADING PYTHON")
+        proc32_64_debug.execute_python_unsafe("1").wait()
+        print("[==================] OPEN SELF_FILENAME1")
+        proc32_64_debug.execute_python_unsafe("open(u'SELF_FILENAME1')").wait()
+        time.sleep(0.1)
+        print("[==================] OPEN SELF_FILENAME2")
+        proc32_64_debug.execute_python_unsafe("open(u'SELF_FILENAME2')").wait()
+        time.sleep(0.1)
+        print("[==================] OPEN SELF_FILENAME3")
+        proc32_64_debug.execute_python_unsafe("open(u'SELF_FILENAME3')").wait()
+        time.sleep(0.1)
+        print("[==================] KILLING TARGET")
         proc32_64_debug.exit()
 
     class TSTBP(bptype):
@@ -384,15 +399,27 @@ def test_standard_breakpoint_self_remove(proc32_64_debug, bptype):
             ctx = dbg.current_thread.context
             filename = self.extract_arguments(dbg.current_process, dbg.current_thread)["lpFileName"]
             data.add(filename)
-            if filename == u"FILENAME2":
+            print("[+++++++++++++++++] Filename: {0}".format(filename))
+            if filename == u"SELF_FILENAME2":
+                print("[+++++++++++++++++] del_bp")
                 dbg.del_bp(self)
 
     d = windows.debug.Debugger(proc32_64_debug)
     d.add_bp(TSTBP("kernelbase!CreateFileW"))
     threading.Thread(target=do_check).start()
     d.loop()
-    assert data >= set([u"FILENAME1", u"FILENAME2"])
-    assert u"FILENAME3" not in data
+    assert data >= set([u"SELF_FILENAME1", u"SELF_FILENAME2"])
+    assert u"SELF_FILENAME3" not in data
+
+class MyMetaDbgDebuger(windows.debug.Debugger):
+    def on_exception(self, exc):
+        print(exc)
+        import pdb;pdb.set_trace()
+        print(exc)
+        x = 2
+        if x == 3:
+            return gdef.DBG_EXCEPTION_NOT_HANDLED
+        return gdef.DBG_CONTINUE
 
 @pytest.mark.timeout(DEFAULT_DEBUGGER_TIMEOUT)
 @python_injection
@@ -401,10 +428,21 @@ def test_standard_breakpoint_remove(proc32_64_debug, bptype):
     data = set()
 
     def do_check():
+        time.sleep(1)
+        print("[==================] LOADING PYTHON")
+        proc32_64_debug.execute_python_unsafe("1").wait()
+        print("[==================] OPEN FILENAME1")
         proc32_64_debug.execute_python_unsafe("open(u'FILENAME1')").wait()
+        time.sleep(0.1)
+        print("[==================] OPEN FILENAME2")
         proc32_64_debug.execute_python_unsafe("open(u'FILENAME2')").wait()
+        time.sleep(0.1)
+        print("[==================] RM BP")
         d.del_bp(the_bp)
+        print("[==================] OPEN FILENAME3")
         proc32_64_debug.execute_python_unsafe("open(u'FILENAME3')").wait()
+        time.sleep(0.1)
+        print("[==================] KILLING TARGET")
         proc32_64_debug.exit()
 
     class TSTBP(bptype):
@@ -413,18 +451,22 @@ def test_standard_breakpoint_remove(proc32_64_debug, bptype):
             addr = exc.ExceptionRecord.ExceptionAddress
             ctx = dbg.current_thread.context
             filename = self.extract_arguments(dbg.current_process, dbg.current_thread)["lpFileName"]
+            print("[+++++++++++++++++] Filename: {0}".format(filename))
             data.add(filename)
 
     d = windows.debug.Debugger(proc32_64_debug)
+    # d = MyMetaDbgDebuger(proc32_64_debug)
     the_bp = TSTBP("kernelbase!CreateFileW")
     # import pdb;pdb.set_trace()
     d.add_bp(the_bp)
+    time.sleep(0.1)
     threading.Thread(target=do_check).start()
     d.loop()
     assert data >= set([u"FILENAME1", u"FILENAME2"])
     assert u"FILENAME3" not in data
 
 
+
 def get_generate_read_at_for_proc(target):
     if target.bitness == 32:
         def generate_read_at(addr):

tests/test_evtlog.py

@@ -2,8 +2,9 @@ import pytest
 import uuid
 
 import windows
-import windows.generated_def as gdef
+import gc
 
+import windows.generated_def as gdef
 import windows.winobject.event_log as evtl
 
 
@@ -25,19 +26,21 @@ def test_event_channel(name, publisher_name):
     assert chan.config.publisher.name == publisher_name
     assert not chan.config.classic
 
-@pytest.mark.parametrize("name, eventid", [(CHANNEL_NAME, 2004)])
-def test_event_channel_query(name, eventid):
-    chan = windows.system.event_log[name]
+@pytest.mark.parametrize("channelname", [CHANNEL_NAME])
+def test_event_channel_query(channelname):
+    chan = windows.system.event_log[channelname]
     all_events = chan.events
     assert len(all_events) # Should have some event to test | skip else ?
-    eventquery = chan.query(ids=2004)
+    # Find an eventid that is present in the events
+    target_evtid = all_events[0].id
+    eventquery = chan.query(ids=target_evtid)
     assert isinstance(eventquery, evtl.EvtQuery)
     all_id_events = eventquery.all()
     assert len(all_id_events)
     assert len(all_id_events) <= len(all_events)
-    assert all(evt.id == eventid for evt in all_id_events)
+    assert all(evt.id == target_evtid for evt in all_id_events)
     # Extract event metadata
-    event_data_names = chan.get_event_metadata(eventid).event_data
+    event_data_names = chan.get_event_metadata(target_evtid).event_data
     # Check all event data match event metadata description
     for evt in all_id_events:
         # assert set(evt.data.keys()) == set(event_data_names)
@@ -80,12 +83,14 @@ def test_event_close():
     while count < count_max:
         for i,e  in enumerate(chan.query()):
             count += 1
+    gc.collect()
+
     post_usage = windows.current_process.memory_info.PrivateUsage
     memory_usage_in_mo = (post_usage - start_usage) / 1024 / 1024
     memory_usage_in_ko = (post_usage - start_usage) / 1024
     # With auto-evtclose of evt there should not be too much memory used when
     # Variable are not accessible anymore
-    assert memory_usage_in_mo <= 0.5
+    assert memory_usage_in_mo <= 1
 
 def test_evthandle_close():
     start_usage = windows.current_process.memory_info.PrivateUsage
@@ -94,10 +99,25 @@ def test_evthandle_close():
         query = chan.query()
         config = chan.config # Config is an EVT_HANDLE
         pubm = config.publisher.metadata
-        # windows.winproxy.EvtClose(chan)
+    gc.collect()
+
     post_usage = windows.current_process.memory_info.PrivateUsage
     memory_usage_in_mo = (post_usage - start_usage) / 1024 / 1024
-    assert memory_usage_in_mo <= 0.5
+    assert memory_usage_in_mo <= 1
+
+def test_evtrender_evthandle_close():
+    start_usage = windows.current_process.memory_info.PrivateUsage
+    chan = windows.system.event_log["System"]
+    query = chan.query()
+    evt = next(query)
+    for i in range(0x10000):
+        x = evt.opcode
+    gc.collect()
+
+    post_usage = windows.current_process.memory_info.PrivateUsage
+    memory_usage_in_mo = (post_usage - start_usage) / 1024 / 1024
+    # Use ~20MO if render are leaking
+    assert memory_usage_in_mo <= 1
 
 tscheduler = windows.system.task_scheduler
 troot = tscheduler.root
@@ -119,10 +139,12 @@ TEST_TASK_EVENTLOG_CHANNEL = "Microsoft-Windows-TaskScheduler/Operational"
 TEST_TASK_EVENTLOG_ID = 106 # Task registered
 
 def test_evtlog_query_seek():
-    taskpath = generated_evt_log("query_seek")
-    import time; time.sleep(1)
     chan = windows.system.event_log[TEST_TASK_EVENTLOG_CHANNEL]
-    query = chan.query(ids=106)
+    if not chan.config.enabled:
+        pytest.skip("EvtLog channel <{0}> not enabled".format(TEST_TASK_EVENTLOG_CHANNEL))
+    taskpath = generated_evt_log("query_seek")
+    import time; time.sleep(5)
+    query = chan.query(ids=TEST_TASK_EVENTLOG_ID)
     query.seek(-1)
     events = query.all()
     assert len(events) == 1

tests/test_generated_def.py

@@ -12,9 +12,13 @@ def assert_struct_offset(struct, field, offset):
 if windows.current_process.bitness == 32:
     PEB32 = windows.generated_def.PEB
     PEB64 = rctypes.transform_type_to_remote64bits(windows.generated_def.PEB)
+    SYSTEM_PROCESS_INFORMATION32 = windows.generated_def.SYSTEM_PROCESS_INFORMATION
+    SYSTEM_PROCESS_INFORMATION64 = rctypes.transform_type_to_remote64bits(windows.generated_def.SYSTEM_PROCESS_INFORMATION)
 else:
     PEB32 = rctypes.transform_type_to_remote32bits(windows.generated_def.PEB)
     PEB64 = windows.generated_def.PEB
+    SYSTEM_PROCESS_INFORMATION32 = rctypes.transform_type_to_remote32bits(windows.generated_def.SYSTEM_PROCESS_INFORMATION)
+    SYSTEM_PROCESS_INFORMATION64 = windows.generated_def.SYSTEM_PROCESS_INFORMATION
 
 def test_peb32_fields():
     assert_peb_offset = lambda field, offset: assert_struct_offset(PEB32, field, offset)
@@ -49,6 +53,50 @@ def test_peb64_fields():
     assert_peb_offset("CSDVersion", 0x02E8)
     assert_peb_offset("MinimumStackCommit", 0x0318)
 
+def test_system_process_information32_fields():
+    assert_spi_offset = lambda field, offset: assert_struct_offset(SYSTEM_PROCESS_INFORMATION32, field, offset)
+    # Mainly based on https://www.geoffchappell.com/studies/windows/km/ntoskrnl/api/ex/sysinfo/process.htm
+    # And some symbol files :)
+    assert_spi_offset("NextEntryOffset", 0)
+    assert_spi_offset('NumberOfThreads', 4)
+    assert_spi_offset('CreateTime', 0x20)
+    assert_spi_offset('UserTime', 0x28)
+    assert_spi_offset('KernelTime', 0x30)
+    assert_spi_offset('ImageName', 0x38)
+    assert_spi_offset('BasePriority', 0x40)
+    assert_spi_offset('UniqueProcessId', 0x44)
+    assert_spi_offset('InheritedFromUniqueProcessId', 0x48)
+    assert_spi_offset('PeakVirtualSize', 0x58)
+    assert_spi_offset('VirtualSize', 0x5C)
+    assert_spi_offset('PageFaultCount', 0x60)
+    assert_spi_offset('PeakWorkingSetSize', 0x64)
+    assert_spi_offset('WorkingSetSize', 0x68)
+    assert_spi_offset('PagefileUsage', 0x7C)
+    assert_spi_offset('PeakPagefileUsage', 0x80)
+
+
+def test_system_process_information64_fields():
+    assert_spi_offset = lambda field, offset: assert_struct_offset(SYSTEM_PROCESS_INFORMATION64, field, offset)
+    # Mainly based on https://www.geoffchappell.com/studies/windows/km/ntoskrnl/api/ex/sysinfo/process.htm
+    # And some symbol files :)
+    assert_spi_offset("NextEntryOffset", 0)
+    assert_spi_offset('NumberOfThreads', 4)
+    assert_spi_offset('CreateTime', 0x20)
+    assert_spi_offset('UserTime', 0x28)
+    assert_spi_offset('KernelTime', 0x30)
+    assert_spi_offset('ImageName', 0x38)
+    assert_spi_offset('BasePriority', 0x48)
+    assert_spi_offset('UniqueProcessId', 0x50)
+    assert_spi_offset('InheritedFromUniqueProcessId', 0x58)
+    assert_spi_offset('PeakVirtualSize', 0x70)
+    assert_spi_offset('VirtualSize', 0x78)
+    assert_spi_offset('PageFaultCount', 0x80)
+    assert_spi_offset('PeakWorkingSetSize', 0x88)
+    assert_spi_offset('WorkingSetSize', 0x90)
+    assert_spi_offset('PagefileUsage', 0xB8)
+    assert_spi_offset('PeakPagefileUsage', 0xC0)
+
+
 def test_cs_custom_define():
     assert windows.generated_def.CS_USER_32B == 0x23
     assert windows.generated_def.CS_USER_64B == 0x33

tests/test_handle.py

@@ -1,4 +1,5 @@
 import windows
+import windows.pipe
 
 def test_handle_process_id():
     handle_with_process = [h for h in windows.system.handles if h.dwProcessId]
@@ -20,7 +21,7 @@ TEST_FILE_FOR_HANDLE = r"C:\Windows\explorer.exe"
 
 def test_remote_handle_type_and_name(proc32_64):
     # tmpfile
-    proc32_64.execute_python("import windows")
+    proc32_64.execute_python("import windows; import windows.pipe")
     # A filename that a normal process should not have a handle on (to be sur)
     proc32_64.execute_python(r"""f = open(r"{filename}")""".format(filename=TEST_FILE_FOR_HANDLE))
     proc32_64.execute_python(r"""h = windows.utils.get_handle_from_file(f)""")

tests/test_hook.py

@@ -1,6 +1,7 @@
 import pytest
 import textwrap
 import ctypes
+import time
 
 import windows
 import windows.generated_def as gdef
@@ -97,6 +98,7 @@ def test_self_iat_hook_multithread():
 def test_remote_iat_hook(proc32_64):
     proc32_64.execute_python("import windows")
     proc32_64.execute_python("windows.utils.create_console()")
+    time.sleep(0.5) # Let all initialisation finish (runtime windows + remote python)
 
     code = """
     import windows.generated_def as gdef