Reupdate doc

Bug in `RPCClient._get_response_effective_data` for 32b process

ctypes_generation/definitions/defines/wintrust_crypt_def.txt

@@ -387,6 +387,38 @@
 #define CRYPT_ARCHIVABLE        0x00004000
 #define CRYPT_FORCE_KEY_PROTECTION_HIGH 0x00008000
 
+#define CERT_RDN_ANY_TYPE 0
+#define CERT_RDN_ENCODED_BLOB 1
+#define CERT_RDN_OCTET_STRING 2
+#define CERT_RDN_NUMERIC_STRING 3
+#define CERT_RDN_PRINTABLE_STRING 4
+#define CERT_RDN_TELETEX_STRING 5
+#define CERT_RDN_T61_STRING 5
+#define CERT_RDN_VIDEOTEX_STRING 6
+#define CERT_RDN_IA5_STRING 7
+#define CERT_RDN_GRAPHIC_STRING 8
+#define CERT_RDN_VISIBLE_STRING 9
+#define CERT_RDN_ISO646_STRING 9
+#define CERT_RDN_GENERAL_STRING 10
+#define CERT_RDN_UNIVERSAL_STRING 11
+#define CERT_RDN_INT4_STRING 11
+#define CERT_RDN_BMP_STRING 12
+#define CERT_RDN_UNICODE_STRING 12
+#define CERT_RDN_UTF8_STRING 13
+#define CERT_RDN_TYPE_MASK 0xff
+#define CERT_RDN_FLAGS_MASK 0xff000000
+#define CERT_RDN_ENABLE_T61_UNICODE_FLAG 0x80000000
+#define CERT_RDN_ENABLE_UTF8_UNICODE_FLAG 0x20000000
+#define CERT_RDN_FORCE_UTF8_UNICODE_FLAG 0x10000000
+#define CERT_RDN_DISABLE_CHECK_TYPE_FLAG 0x40000000
+#define CERT_RDN_DISABLE_IE4_UTF8_FLAG 0x1000000
+
+#define CRYPT_DECODE_NOCOPY_FLAG 0x1
+#define CRYPT_DECODE_TO_BE_SIGNED_FLAG 0x2
+#define CRYPT_DECODE_SHARE_OID_STRING_FLAG 0x4
+#define CRYPT_DECODE_NO_SIGNATURE_BYTE_REVERSAL_FLAG 0x8
+#define CRYPT_DECODE_ALLOC_FLAG 0x8000
+#define CRYPT_UNICODE_NAME_DECODE_DISABLE_IE4_UTF8_FLAG CERT_RDN_DISABLE_IE4_UTF8_FLAG
 
 #define CRYPT_ENCODE_DECODE_NONE            0
 #define X509_CERT                           (1)
@@ -582,4 +614,23 @@
 #define CMSG_CTRL_MAIL_LIST_DECRYPT      18
 #define CMSG_CTRL_VERIFY_SIGNATURE_EX    19
 #define CMSG_CTRL_ADD_CMS_SIGNER_INFO    20
-#define CMSG_CTRL_ENABLE_STRONG_SIGNATURE 21
+#define CMSG_CTRL_ENABLE_STRONG_SIGNATURE 21
+
+
+//+-------------------------------------------------------------------------
+//  The following flag should be set in the above dwFlags to enable
+//  a CertSetCertificateContextProperty(CERT_KEY_CONTEXT_PROP_ID) after a
+//  CryptAcquireContext is done in the Sign or Decrypt Message functions.
+//
+//  The following define must not collide with any of the
+//  CryptAcquireContext dwFlag defines.
+//--------------------------------------------------------------------------
+#define CERT_SET_KEY_PROV_HANDLE_PROP_ID    0x00000001
+#define CERT_SET_KEY_CONTEXT_PROP_ID        0x00000001
+
+// Special dwKeySpec indicating a CNG NCRYPT_KEY_HANDLE instead of a CAPI1
+// HCRYPTPROV
+#define CERT_NCRYPT_KEY_SPEC                0xFFFFFFFF
+
+
+#define CERT_REQUEST_V1     0

ctypes_generation/definitions/functions/crypto_wintrust.txt

@@ -617,4 +617,28 @@ BOOL CryptGetOIDFunctionValue(
 BOOL CertCloseStore(
   HCERTSTORE hCertStore,
   DWORD      dwFlags
+);
+
+BOOL CryptSignAndEncodeCertificate(
+  [in]      BCRYPT_KEY_HANDLE           hBCryptKey,
+  [in]      DWORD                       dwKeySpec,
+  [in]      DWORD                       dwCertEncodingType,
+  [in]      LPCSTR                      lpszStructType,
+  [in]      PVOID                       pvStructInfo,
+  [in]      PCRYPT_ALGORITHM_IDENTIFIER pSignatureAlgorithm,
+  [in]      PVOID                       pvHashAuxInfo,
+  [out]     BYTE                        *pbEncoded,
+  [in, out] DWORD                       *pcbEncoded
+);
+
+BOOL CryptSignCertificate(
+  [in]      BCRYPT_KEY_HANDLE           hBCryptKey,
+  [in]      DWORD                       dwKeySpec,
+  [in]      DWORD                       dwCertEncodingType,
+  [in]      BYTE                  *pbEncodedToBeSigned,
+  [in]      DWORD                       cbEncodedToBeSigned,
+  [in]      PCRYPT_ALGORITHM_IDENTIFIER pSignatureAlgorithm,
+  [in]      PVOID                       pvHashAuxInfo,
+  [out]     BYTE                        *pbSignature,
+  [in, out] DWORD                       *pcbSignature
 );

ctypes_generation/definitions/functions/ncrypt.txt

@@ -0,0 +1,14 @@
+SECURITY_STATUS NCryptOpenKey(
+  [in]  NCRYPT_PROV_HANDLE hProvider,
+  [out] NCRYPT_KEY_HANDLE  *phKey,
+  [in]  LPCWSTR            pszKeyName,
+  [in]  DWORD              dwLegacyKeySpec,
+  [in]  DWORD              dwFlags
+);
+
+
+SECURITY_STATUS NCryptOpenStorageProvider(
+  [out]          NCRYPT_PROV_HANDLE *phProvider,
+  [in, optional] LPCWSTR            pszProviderName,
+  [in]           DWORD              dwFlags
+);

ctypes_generation/definitions/simple_types.txt

@@ -86,6 +86,7 @@ PWINDBG_EXTENSION_APIS32 = PVOID
 PWINDBG_EXTENSION_APIS64 = PVOID
 FILEOP_FLAGS = WORD
 NET_API_STATUS = DWORD
+SECURITY_STATUS = LONG // Return type of ncrypt functions
 
 
 // 2 custom PFW defintions for bitness-forces structures
@@ -94,6 +95,7 @@ PVOID64 = DWORD64
 
 NCRYPT_HANDLE = ULONG_PTR
 NCRYPT_PROV_HANDLE = ULONG_PTR
+BCRYPT_KEY_HANDLE = ULONG_PTR
 NCRYPT_KEY_HANDLE = ULONG_PTR
 NCRYPT_HASH_HANDLE = ULONG_PTR
 NCRYPT_SECRET_HANDLE  = ULONG_PTR

ctypes_generation/definitions/structures/crypto.txt

@@ -715,4 +715,12 @@ typedef struct _STRUCT_PLAINTEXTKEYBLOB {
   BLOBHEADER hdr;
   DWORD      dwKeySize;
   BYTE       rgbKeyData[0];
-} STRUCT_PLAINTEXTKEYBLOB, *PSTRUCT_PLAINTEXTKEYBLOB;
+} STRUCT_PLAINTEXTKEYBLOB, *PSTRUCT_PLAINTEXTKEYBLOB;
+
+typedef struct _CERT_REQUEST_INFO {
+  DWORD                dwVersion;
+  CERT_NAME_BLOB       Subject;
+  CERT_PUBLIC_KEY_INFO SubjectPublicKeyInfo;
+  DWORD                cAttribute;
+  PCRYPT_ATTRIBUTE     rgAttribute;
+} CERT_REQUEST_INFO, *PCERT_REQUEST_INFO;

docs/build/html/_modules/windows/com.html

@@ -4,12 +4,12 @@
   <head>
     <meta charset="utf-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-    <title>windows.com &#8212; PythonForWindows 1.0.2 documentation</title>
+    <title>windows.com &#8212; PythonForWindows 1.0.3 documentation</title>
     <link rel="stylesheet" type="text/css" href="../../_static/pygments.css?v=fa44fd50" />
     <link rel="stylesheet" type="text/css" href="../../_static/classic.css?v=def86cc0" />
     <link rel="stylesheet" type="text/css" href="../../_static/css/mbasic.css?v=957880af" />
     
-    <script src="../../_static/documentation_options.js?v=1ed6394b"></script>
+    <script src="../../_static/documentation_options.js?v=baaebd52"></script>
     <script src="../../_static/doctools.js?v=9a2dae69"></script>
     <script src="../../_static/sphinx_highlight.js?v=dc90522c"></script>
     
@@ -25,7 +25,7 @@
         <li class="right" >
           <a href="../../py-modindex.html" title="Python Module Index"
              >modules</a> |</li>
-        <li class="nav-item nav-item-0"><a href="../../index.html">PythonForWindows 1.0.2 documentation</a> &#187;</li>
+        <li class="nav-item nav-item-0"><a href="../../index.html">PythonForWindows 1.0.3 documentation</a> &#187;</li>
           <li class="nav-item nav-item-1"><a href="../index.html" accesskey="U">Module code</a> &#187;</li>
         <li class="nav-item nav-item-this"><a href="">windows.com</a></li> 
       </ul>
@@ -75,7 +75,13 @@
 
 
 <span class="k">def</span> <span class="nf">initsecurity</span><span class="p">():</span> <span class="c1"># Should take some parameters..</span>
-    <span class="k">return</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">CoInitializeSecurity</span><span class="p">(</span><span class="mi">0</span><span class="p">,</span> <span class="o">-</span><span class="mi">1</span><span class="p">,</span> <span class="kc">None</span><span class="p">,</span> <span class="mi">0</span><span class="p">,</span> <span class="mi">0</span><span class="p">,</span> <span class="n">RPC_C_IMP_LEVEL_IMPERSONATE</span><span class="p">,</span> <span class="mi">0</span><span class="p">,</span><span class="mi">0</span><span class="p">,</span><span class="mi">0</span><span class="p">)</span>
+    <span class="k">try</span><span class="p">:</span>
+        <span class="n">winproxy</span><span class="o">.</span><span class="n">CoInitializeSecurity</span><span class="p">(</span><span class="mi">0</span><span class="p">,</span> <span class="o">-</span><span class="mi">1</span><span class="p">,</span> <span class="kc">None</span><span class="p">,</span> <span class="mi">0</span><span class="p">,</span> <span class="mi">0</span><span class="p">,</span> <span class="n">RPC_C_IMP_LEVEL_IMPERSONATE</span><span class="p">,</span> <span class="mi">0</span><span class="p">,</span><span class="mi">0</span><span class="p">,</span><span class="mi">0</span><span class="p">)</span>
+    <span class="k">except</span> <span class="ne">OSError</span> <span class="k">as</span> <span class="n">e</span><span class="p">:</span>
+        <span class="k">if</span> <span class="n">e</span><span class="o">.</span><span class="n">winerror</span> <span class="o">&amp;</span> <span class="mh">0xFFFFFFFF</span> <span class="o">!=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">RPC_E_TOO_LATE</span><span class="p">:</span>
+            <span class="c1"># RPC_E_TOO_LATE can happen when the python environment invokes CoInitializeSecurity before we get to it</span>
+            <span class="c1"># mspython builds do this consistently.</span>
+            <span class="k">raise</span> <span class="n">e</span>
 
 
 <span class="k">class</span> <span class="nc">Dispatch</span><span class="p">(</span><span class="n">interfaces</span><span class="o">.</span><span class="n">IDispatch</span><span class="p">):</span>
@@ -489,7 +495,7 @@
         <li class="right" >
           <a href="../../py-modindex.html" title="Python Module Index"
              >modules</a> |</li>
-        <li class="nav-item nav-item-0"><a href="../../index.html">PythonForWindows 1.0.2 documentation</a> &#187;</li>
+        <li class="nav-item nav-item-0"><a href="../../index.html">PythonForWindows 1.0.3 documentation</a> &#187;</li>
           <li class="nav-item nav-item-1"><a href="../index.html" >Module code</a> &#187;</li>
         <li class="nav-item nav-item-this"><a href="">windows.com</a></li> 
       </ul>

docs/build/html/_modules/windows/crypto/certificate.html

@@ -4,12 +4,12 @@
   <head>
     <meta charset="utf-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-    <title>windows.crypto.certificate &#8212; PythonForWindows 1.0.2 documentation</title>
+    <title>windows.crypto.certificate &#8212; PythonForWindows 1.0.3 documentation</title>
     <link rel="stylesheet" type="text/css" href="../../../_static/pygments.css?v=fa44fd50" />
     <link rel="stylesheet" type="text/css" href="../../../_static/classic.css?v=def86cc0" />
     <link rel="stylesheet" type="text/css" href="../../../_static/css/mbasic.css?v=957880af" />
     
-    <script src="../../../_static/documentation_options.js?v=1ed6394b"></script>
+    <script src="../../../_static/documentation_options.js?v=baaebd52"></script>
     <script src="../../../_static/doctools.js?v=9a2dae69"></script>
     <script src="../../../_static/sphinx_highlight.js?v=dc90522c"></script>
     
@@ -25,7 +25,7 @@
         <li class="right" >
           <a href="../../../py-modindex.html" title="Python Module Index"
              >modules</a> |</li>
-        <li class="nav-item nav-item-0"><a href="../../../index.html">PythonForWindows 1.0.2 documentation</a> &#187;</li>
+        <li class="nav-item nav-item-0"><a href="../../../index.html">PythonForWindows 1.0.3 documentation</a> &#187;</li>
           <li class="nav-item nav-item-1"><a href="../../index.html" accesskey="U">Module code</a> &#187;</li>
         <li class="nav-item nav-item-this"><a href="">windows.crypto.certificate</a></li> 
       </ul>
@@ -205,6 +205,17 @@
         <span class="k">return</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">cast</span><span class="p">(</span><span class="n">res</span><span class="p">,</span> <span class="bp">cls</span><span class="p">)</span></div>
 
 
+<div class="viewcode-block" id="CertificateStore.from_user_store">
+<a class="viewcode-back" href="../../../crypto.html#windows.crypto.CertificateStore.from_user_store">[docs]</a>
+    <span class="nd">@classmethod</span>
+    <span class="k">def</span> <span class="nf">from_user_store</span><span class="p">(</span><span class="bp">cls</span><span class="p">,</span> <span class="n">store_name</span><span class="p">,</span> <span class="n">user</span><span class="o">=</span><span class="kc">True</span><span class="p">):</span>
+<span class="w">        </span><span class="sd">&quot;&quot;&quot;Create a new :class:`CertificateStore` from system store ``store_name``</span>
+<span class="sd">        (see `System Store Locations &lt;https://msdn.microsoft.com/en-us/library/windows/desktop/aa388136(v=vs.85).aspx&gt;`_)</span>
+<span class="sd">        &quot;&quot;&quot;</span>
+        <span class="n">res</span> <span class="o">=</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">CertOpenStore</span><span class="p">(</span><span class="n">gdef</span><span class="o">.</span><span class="n">CERT_STORE_PROV_SYSTEM_A</span><span class="p">,</span> <span class="n">DEFAULT_ENCODING</span><span class="p">,</span> <span class="kc">None</span><span class="p">,</span> <span class="n">gdef</span><span class="o">.</span><span class="n">CERT_SYSTEM_STORE_CURRENT_USER</span> <span class="o">|</span> <span class="n">gdef</span><span class="o">.</span><span class="n">CERT_STORE_READONLY_FLAG</span><span class="p">,</span> <span class="n">store_name</span><span class="p">)</span>
+        <span class="k">return</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">cast</span><span class="p">(</span><span class="n">res</span><span class="p">,</span> <span class="bp">cls</span><span class="p">)</span></div>
+
+
 <div class="viewcode-block" id="CertificateStore.new_in_memory">
 <a class="viewcode-back" href="../../../crypto.html#windows.crypto.CertificateStore.new_in_memory">[docs]</a>
     <span class="nd">@classmethod</span>
@@ -697,7 +708,7 @@
         <li class="right" >
           <a href="../../../py-modindex.html" title="Python Module Index"
              >modules</a> |</li>
-        <li class="nav-item nav-item-0"><a href="../../../index.html">PythonForWindows 1.0.2 documentation</a> &#187;</li>
+        <li class="nav-item nav-item-0"><a href="../../../index.html">PythonForWindows 1.0.3 documentation</a> &#187;</li>
           <li class="nav-item nav-item-1"><a href="../../index.html" >Module code</a> &#187;</li>
         <li class="nav-item nav-item-this"><a href="">windows.crypto.certificate</a></li> 
       </ul>

docs/build/html/_modules/windows/debug/breakpoints.html

@@ -4,12 +4,12 @@
   <head>
     <meta charset="utf-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-    <title>windows.debug.breakpoints &#8212; PythonForWindows 1.0.2 documentation</title>
+    <title>windows.debug.breakpoints &#8212; PythonForWindows 1.0.3 documentation</title>
     <link rel="stylesheet" type="text/css" href="../../../_static/pygments.css?v=fa44fd50" />
     <link rel="stylesheet" type="text/css" href="../../../_static/classic.css?v=def86cc0" />
     <link rel="stylesheet" type="text/css" href="../../../_static/css/mbasic.css?v=957880af" />
     
-    <script src="../../../_static/documentation_options.js?v=1ed6394b"></script>
+    <script src="../../../_static/documentation_options.js?v=baaebd52"></script>
     <script src="../../../_static/doctools.js?v=9a2dae69"></script>
     <script src="../../../_static/sphinx_highlight.js?v=dc90522c"></script>
     
@@ -25,7 +25,7 @@
         <li class="right" >
           <a href="../../../py-modindex.html" title="Python Module Index"
              >modules</a> |</li>
-        <li class="nav-item nav-item-0"><a href="../../../index.html">PythonForWindows 1.0.2 documentation</a> &#187;</li>
+        <li class="nav-item nav-item-0"><a href="../../../index.html">PythonForWindows 1.0.3 documentation</a> &#187;</li>
           <li class="nav-item nav-item-1"><a href="../../index.html" accesskey="U">Module code</a> &#187;</li>
         <li class="nav-item nav-item-this"><a href="">windows.debug.breakpoints</a></li> 
       </ul>
@@ -190,17 +190,11 @@
                 <span class="n">t</span> <span class="o">=</span> <span class="n">rt</span><span class="p">(</span><span class="n">value</span><span class="p">,</span> <span class="n">cproc</span><span class="p">)</span>
             <span class="k">else</span><span class="p">:</span>
                 <span class="n">t</span> <span class="o">=</span> <span class="n">rt</span><span class="p">(</span><span class="n">value</span><span class="p">)</span>
-
-            <span class="n">content</span> <span class="o">=</span> <span class="kc">None</span>
-            <span class="k">try</span><span class="p">:</span>
-                <span class="n">content</span> <span class="o">=</span> <span class="n">t</span><span class="o">.</span><span class="n">contents</span>
-            <span class="k">except</span> <span class="ne">Exception</span> <span class="k">as</span> <span class="n">e</span><span class="p">:</span>
-                <span class="c1"># contents will fail on basic type</span>
-                <span class="c1"># Not really an expected behavior</span>
-                <span class="c1"># But it works for now.. (and since a while)</span>
-                <span class="k">pass</span>
-            <span class="k">if</span> <span class="n">content</span> <span class="ow">is</span> <span class="kc">None</span><span class="p">:</span>
-                <span class="n">t</span> <span class="o">=</span> <span class="n">t</span><span class="o">.</span><span class="n">value</span>
+            <span class="k">if</span> <span class="ow">not</span> <span class="nb">hasattr</span><span class="p">(</span><span class="n">t</span><span class="p">,</span> <span class="s2">&quot;contents&quot;</span><span class="p">):</span>
+                <span class="k">try</span><span class="p">:</span>
+                    <span class="n">t</span> <span class="o">=</span> <span class="n">t</span><span class="o">.</span><span class="n">value</span>
+                <span class="k">except</span> <span class="ne">AttributeError</span><span class="p">:</span>
+                    <span class="k">pass</span>
             <span class="n">res</span><span class="p">[</span><span class="n">name</span><span class="p">[</span><span class="mi">1</span><span class="p">]]</span> <span class="o">=</span> <span class="n">t</span>
         <span class="k">return</span> <span class="n">res</span>
 
@@ -365,7 +359,7 @@
         <li class="right" >
           <a href="../../../py-modindex.html" title="Python Module Index"
              >modules</a> |</li>
-        <li class="nav-item nav-item-0"><a href="../../../index.html">PythonForWindows 1.0.2 documentation</a> &#187;</li>
+        <li class="nav-item nav-item-0"><a href="../../../index.html">PythonForWindows 1.0.3 documentation</a> &#187;</li>
           <li class="nav-item nav-item-1"><a href="../../index.html" >Module code</a> &#187;</li>
         <li class="nav-item nav-item-this"><a href="">windows.debug.breakpoints</a></li> 
       </ul>

docs/build/html/_modules/windows/debug/symbols.html

@@ -4,12 +4,12 @@
   <head>
     <meta charset="utf-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-    <title>windows.debug.symbols &#8212; PythonForWindows 1.0.2 documentation</title>
+    <title>windows.debug.symbols &#8212; PythonForWindows 1.0.3 documentation</title>
     <link rel="stylesheet" type="text/css" href="../../../_static/pygments.css?v=fa44fd50" />
     <link rel="stylesheet" type="text/css" href="../../../_static/classic.css?v=def86cc0" />
     <link rel="stylesheet" type="text/css" href="../../../_static/css/mbasic.css?v=957880af" />
     
-    <script src="../../../_static/documentation_options.js?v=1ed6394b"></script>
+    <script src="../../../_static/documentation_options.js?v=baaebd52"></script>
     <script src="../../../_static/doctools.js?v=9a2dae69"></script>
     <script src="../../../_static/sphinx_highlight.js?v=dc90522c"></script>
     
@@ -25,7 +25,7 @@
         <li class="right" >
           <a href="../../../py-modindex.html" title="Python Module Index"
              >modules</a> |</li>
-        <li class="nav-item nav-item-0"><a href="../../../index.html">PythonForWindows 1.0.2 documentation</a> &#187;</li>
+        <li class="nav-item nav-item-0"><a href="../../../index.html">PythonForWindows 1.0.3 documentation</a> &#187;</li>
           <li class="nav-item nav-item-1"><a href="../../index.html" accesskey="U">Module code</a> &#187;</li>
         <li class="nav-item nav-item-this"><a href="">windows.debug.symbols</a></li> 
       </ul>
@@ -54,7 +54,7 @@
 <div class="viewcode-block" id="set_dbghelp_path">
 <a class="viewcode-back" href="../../../debug.html#windows.debug.symbols.set_dbghelp_path">[docs]</a>
 <span class="k">def</span> <span class="nf">set_dbghelp_path</span><span class="p">(</span><span class="n">path</span><span class="p">):</span>
-<span class="w">    </span><span class="sd">&quot;&quot;&quot;Set the path of the ``dbghelp.dll`` file to use. It allow to configure a different version of the DLL handling PDB downloading.</span>
+<span class="w">    </span><span class="sa">r</span><span class="sd">&quot;&quot;&quot;Set the path of the ``dbghelp.dll`` file to use. It allow to configure a different version of the DLL handling PDB downloading.</span>
 
 <span class="sd">    If ``path`` is a directory, the final ``dbghelp.dll`` will be computed as</span>
 <span class="sd">    ``path\&lt;current_process_bitness&gt;\dbghelp.dll``.</span>
@@ -169,7 +169,7 @@
 
 
 <span class="k">class</span> <span class="nc">SymbolInfoW</span><span class="p">(</span><span class="n">gdef</span><span class="o">.</span><span class="n">SYMBOL_INFOW</span><span class="p">,</span> <span class="n">SymbolInfoBase</span><span class="p">):</span>
-<span class="w">    </span><span class="sd">&quot;&quot;&quot;Represent a Symbol.</span>
+<span class="w">    </span><span class="sa">r</span><span class="sd">&quot;&quot;&quot;Represent a Symbol.</span>
 <span class="sd">    This class in based on the class `SYMBOL_INFO &lt;https://docs.microsoft.com/en-us/windows/win32/api/dbghelp/ns-dbghelp-symbol_info&gt;`_</span>
 <span class="sd">    with the handling on displacement embeded into it.s</span>
 
@@ -222,6 +222,10 @@
             <span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">LocalFree</span><span class="p">(</span><span class="n">res</span><span class="p">)</span>
         <span class="k">return</span> <span class="n">newres</span>
 
+    <span class="nd">@property</span>
+    <span class="k">def</span> <span class="nf">module</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
+        <span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">resolver</span><span class="o">.</span><span class="n">get_module</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">modbase</span><span class="p">)</span>
+
     <span class="nd">@property</span>
     <span class="k">def</span> <span class="nf">name</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
         <span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">_get_type_info</span><span class="p">(</span><span class="n">gdef</span><span class="o">.</span><span class="n">TI_GET_SYMNAME</span><span class="p">)</span>
@@ -373,7 +377,7 @@
 
     <span class="nd">@property</span>
     <span class="k">def</span> <span class="nf">pdb</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
-<span class="w">        </span><span class="sd">&quot;&quot;&quot;The local path of the loaded PDB if present</span>
+<span class="w">        </span><span class="sa">r</span><span class="sd">&quot;&quot;&quot;The local path of the loaded PDB if present</span>
 
 <span class="sd">        Exemple:</span>
 <span class="sd">            &gt;&gt;&gt; sh = windows.debug.symbols.VirtualSymbolHandler()</span>
@@ -503,7 +507,7 @@
         <span class="k">return</span> <span class="n">sym</span>
 
     <span class="k">def</span> <span class="nf">resolve</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">name_or_addr</span><span class="p">):</span>
-<span class="w">        </span><span class="sd">&quot;&quot;&quot;Resolve ``name_or_addr``.</span>
+<span class="w">        </span><span class="sa">r</span><span class="sd">&quot;&quot;&quot;Resolve ``name_or_addr``.</span>
 
 <span class="sd">        If its an int -&gt; Return the :class:`SymbolInfo` at the address.</span>
 <span class="sd">        If its a string -&gt; Return the :class:`SymbolInfo` corresponding to the symbol name</span>
@@ -552,7 +556,7 @@
         <span class="k">return</span> <span class="kc">True</span>
 
     <span class="k">def</span> <span class="nf">search</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">mask</span><span class="p">,</span> <span class="n">mod</span><span class="o">=</span><span class="mi">0</span><span class="p">,</span> <span class="n">tag</span><span class="o">=</span><span class="mi">0</span><span class="p">,</span> <span class="n">options</span><span class="o">=</span><span class="n">gdef</span><span class="o">.</span><span class="n">SYMSEARCH_ALLITEMS</span><span class="p">,</span> <span class="n">callback</span><span class="o">=</span><span class="kc">None</span><span class="p">):</span>
-<span class="w">        </span><span class="sd">&quot;&quot;&quot;Search the symbols matching ``mask`` (``Windbg`` like).</span>
+<span class="w">        </span><span class="sa">r</span><span class="sd">&quot;&quot;&quot;Search the symbols matching ``mask`` (``Windbg`` like).</span>
 
 <span class="sd">        :return: [:class:`SymbolInfo`] -- A list of :class:`SymbolInfo`</span>
 
@@ -605,12 +609,6 @@
         <span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">SymGetTypeFromNameW</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">mod</span><span class="p">,</span> <span class="n">name</span><span class="p">,</span> <span class="n">buff</span><span class="p">)</span>
         <span class="k">return</span> <span class="n">SymbolType</span><span class="o">.</span><span class="n">from_symbol_info</span><span class="p">(</span><span class="n">buff</span><span class="p">[</span><span class="mi">0</span><span class="p">],</span> <span class="n">resolver</span><span class="o">=</span><span class="bp">self</span><span class="p">)</span>
 
-    <span class="c1">#</span>
-    <span class="k">def</span> <span class="nf">types</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">mod</span><span class="o">=</span><span class="kc">None</span><span class="p">):</span>
-        <span class="n">typeslist</span> <span class="o">=</span> <span class="p">[]</span> <span class="c1"># Iter on types of all modules if None provided ?</span>
-        <span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">SymEnumTypes</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">mod</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">simple_aggregator</span><span class="p">,</span> <span class="n">typeslist</span><span class="p">)</span>
-        <span class="k">return</span> <span class="p">[</span><span class="n">SymbolType</span><span class="o">.</span><span class="n">from_symbol_info</span><span class="p">(</span><span class="n">t</span><span class="p">,</span> <span class="n">resolver</span><span class="o">=</span><span class="bp">self</span><span class="p">)</span> <span class="k">for</span> <span class="n">t</span> <span class="ow">in</span> <span class="n">typeslist</span><span class="p">]</span>
-
 
 <span class="c1"># TODO: mets de l&#39;huile pour w4kfu</span>
 <span class="k">class</span> <span class="nc">StackWalker</span><span class="p">(</span><span class="nb">object</span><span class="p">):</span>
@@ -869,7 +867,7 @@
         <li class="right" >
           <a href="../../../py-modindex.html" title="Python Module Index"
              >modules</a> |</li>
-        <li class="nav-item nav-item-0"><a href="../../../index.html">PythonForWindows 1.0.2 documentation</a> &#187;</li>
+        <li class="nav-item nav-item-0"><a href="../../../index.html">PythonForWindows 1.0.3 documentation</a> &#187;</li>
           <li class="nav-item nav-item-1"><a href="../../index.html" >Module code</a> &#187;</li>
         <li class="nav-item nav-item-this"><a href="">windows.debug.symbols</a></li> 
       </ul>

docs/build/html/_modules/windows/generated_def/flag.html

@@ -4,12 +4,12 @@
   <head>
     <meta charset="utf-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-    <title>windows.generated_def.flag &#8212; PythonForWindows 1.0.2 documentation</title>
+    <title>windows.generated_def.flag &#8212; PythonForWindows 1.0.3 documentation</title>
     <link rel="stylesheet" type="text/css" href="../../../_static/pygments.css?v=fa44fd50" />
     <link rel="stylesheet" type="text/css" href="../../../_static/classic.css?v=def86cc0" />
     <link rel="stylesheet" type="text/css" href="../../../_static/css/mbasic.css?v=957880af" />
     
-    <script src="../../../_static/documentation_options.js?v=1ed6394b"></script>
+    <script src="../../../_static/documentation_options.js?v=baaebd52"></script>
     <script src="../../../_static/doctools.js?v=9a2dae69"></script>
     <script src="../../../_static/sphinx_highlight.js?v=dc90522c"></script>
     
@@ -25,7 +25,7 @@
         <li class="right" >
           <a href="../../../py-modindex.html" title="Python Module Index"
              >modules</a> |</li>
-        <li class="nav-item nav-item-0"><a href="../../../index.html">PythonForWindows 1.0.2 documentation</a> &#187;</li>
+        <li class="nav-item nav-item-0"><a href="../../../index.html">PythonForWindows 1.0.3 documentation</a> &#187;</li>
           <li class="nav-item nav-item-1"><a href="../../index.html" accesskey="U">Module code</a> &#187;</li>
         <li class="nav-item nav-item-this"><a href="">windows.generated_def.flag</a></li> 
       </ul>
@@ -145,7 +145,7 @@
         <li class="right" >
           <a href="../../../py-modindex.html" title="Python Module Index"
              >modules</a> |</li>
-        <li class="nav-item nav-item-0"><a href="../../../index.html">PythonForWindows 1.0.2 documentation</a> &#187;</li>
+        <li class="nav-item nav-item-0"><a href="../../../index.html">PythonForWindows 1.0.3 documentation</a> &#187;</li>
           <li class="nav-item nav-item-1"><a href="../../index.html" >Module code</a> &#187;</li>
         <li class="nav-item nav-item-this"><a href="">windows.generated_def.flag</a></li> 
       </ul>

docs/build/html/_modules/windows/generated_def/interfaces.html

@@ -4,12 +4,12 @@
   <head>
     <meta charset="utf-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-    <title>windows.generated_def.interfaces &#8212; PythonForWindows 1.0.2 documentation</title>
+    <title>windows.generated_def.interfaces &#8212; PythonForWindows 1.0.3 documentation</title>
     <link rel="stylesheet" type="text/css" href="../../../_static/pygments.css?v=fa44fd50" />
     <link rel="stylesheet" type="text/css" href="../../../_static/classic.css?v=def86cc0" />
     <link rel="stylesheet" type="text/css" href="../../../_static/css/mbasic.css?v=957880af" />
     
-    <script src="../../../_static/documentation_options.js?v=1ed6394b"></script>
+    <script src="../../../_static/documentation_options.js?v=baaebd52"></script>
     <script src="../../../_static/doctools.js?v=9a2dae69"></script>
     <script src="../../../_static/sphinx_highlight.js?v=dc90522c"></script>
     
@@ -25,7 +25,7 @@
         <li class="right" >
           <a href="../../../py-modindex.html" title="Python Module Index"
              >modules</a> |</li>
-        <li class="nav-item nav-item-0"><a href="../../../index.html">PythonForWindows 1.0.2 documentation</a> &#187;</li>
+        <li class="nav-item nav-item-0"><a href="../../../index.html">PythonForWindows 1.0.3 documentation</a> &#187;</li>
           <li class="nav-item nav-item-1"><a href="../../index.html" accesskey="U">Module code</a> &#187;</li>
         <li class="nav-item nav-item-this"><a href="">windows.generated_def.interfaces</a></li> 
       </ul>
@@ -3998,7 +3998,7 @@
         <li class="right" >
           <a href="../../../py-modindex.html" title="Python Module Index"
              >modules</a> |</li>
-        <li class="nav-item nav-item-0"><a href="../../../index.html">PythonForWindows 1.0.2 documentation</a> &#187;</li>
+        <li class="nav-item nav-item-0"><a href="../../../index.html">PythonForWindows 1.0.3 documentation</a> &#187;</li>
           <li class="nav-item nav-item-1"><a href="../../index.html" >Module code</a> &#187;</li>
         <li class="nav-item nav-item-this"><a href="">windows.generated_def.interfaces</a></li> 
       </ul>

docs/build/html/_modules/windows/pe_parse.html

@@ -4,12 +4,12 @@
   <head>
     <meta charset="utf-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-    <title>windows.pe_parse &#8212; PythonForWindows 1.0.2 documentation</title>
+    <title>windows.pe_parse &#8212; PythonForWindows 1.0.3 documentation</title>
     <link rel="stylesheet" type="text/css" href="../../_static/pygments.css?v=fa44fd50" />
     <link rel="stylesheet" type="text/css" href="../../_static/classic.css?v=def86cc0" />
     <link rel="stylesheet" type="text/css" href="../../_static/css/mbasic.css?v=957880af" />
     
-    <script src="../../_static/documentation_options.js?v=1ed6394b"></script>
+    <script src="../../_static/documentation_options.js?v=baaebd52"></script>
     <script src="../../_static/doctools.js?v=9a2dae69"></script>
     <script src="../../_static/sphinx_highlight.js?v=dc90522c"></script>
     
@@ -25,7 +25,7 @@
         <li class="right" >
           <a href="../../py-modindex.html" title="Python Module Index"
              >modules</a> |</li>
-        <li class="nav-item nav-item-0"><a href="../../index.html">PythonForWindows 1.0.2 documentation</a> &#187;</li>
+        <li class="nav-item nav-item-0"><a href="../../index.html">PythonForWindows 1.0.3 documentation</a> &#187;</li>
           <li class="nav-item nav-item-1"><a href="../index.html" accesskey="U">Module code</a> &#187;</li>
         <li class="nav-item nav-item-this"><a href="">windows.pe_parse</a></li> 
       </ul>
@@ -42,6 +42,7 @@
 <span class="kn">import</span> <span class="nn">windows.hooks</span> <span class="k">as</span> <span class="nn">hooks</span>
 <span class="kn">import</span> <span class="nn">windows.utils</span> <span class="k">as</span> <span class="nn">utils</span>
 
+<span class="kn">import</span> <span class="nn">windows.generated_def</span> <span class="k">as</span> <span class="nn">gdef</span>
 <span class="kn">from</span> <span class="nn">windows.generated_def.winstructs</span> <span class="kn">import</span> <span class="o">*</span>
 <span class="kn">from</span> <span class="nn">windows.utils</span> <span class="kn">import</span> <span class="n">transform_ctypes_fields</span>
 <span class="kn">import</span> <span class="nn">windows.remotectypes</span> <span class="k">as</span> <span class="nn">rctypes</span>
@@ -77,9 +78,9 @@
     <span class="c1"># We can force bitness as the field we access are bitness-independant</span>
     <span class="n">pe</span> <span class="o">=</span> <span class="n">GetPEFile</span><span class="p">(</span><span class="n">baseaddr</span><span class="p">,</span> <span class="n">target</span><span class="p">,</span> <span class="n">force_bitness</span><span class="o">=</span><span class="mi">32</span><span class="p">)</span>
     <span class="n">machine</span> <span class="o">=</span> <span class="n">pe</span><span class="o">.</span><span class="n">get_NT_HEADER</span><span class="p">()</span><span class="o">.</span><span class="n">FileHeader</span><span class="o">.</span><span class="n">Machine</span>
-    <span class="k">if</span> <span class="n">machine</span> <span class="o">==</span> <span class="mh">0x14c</span><span class="p">:</span>
+    <span class="k">if</span> <span class="n">machine</span> <span class="o">==</span> <span class="n">gdef</span><span class="o">.</span><span class="n">IMAGE_FILE_MACHINE_I386</span><span class="p">:</span>
         <span class="k">return</span> <span class="mi">32</span>
-    <span class="k">elif</span> <span class="n">machine</span> <span class="o">==</span> <span class="mh">0x8664</span><span class="p">:</span>
+    <span class="k">elif</span> <span class="n">machine</span> <span class="ow">in</span> <span class="p">(</span><span class="n">gdef</span><span class="o">.</span><span class="n">IMAGE_FILE_MACHINE_AMD64</span><span class="p">,</span> <span class="n">gdef</span><span class="o">.</span><span class="n">IMAGE_FILE_MACHINE_ARM64</span><span class="p">):</span>
         <span class="k">return</span> <span class="mi">64</span>
     <span class="k">else</span><span class="p">:</span>
         <span class="k">raise</span> <span class="ne">ValueError</span><span class="p">(</span><span class="s2">&quot;Unknow PE target machine &lt;0x</span><span class="si">{0:x}</span><span class="s2">&gt;&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">machine</span><span class="p">))</span>
@@ -150,7 +151,7 @@
         <span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">target</span> <span class="ow">is</span> <span class="kc">None</span><span class="p">:</span>
             <span class="n">name</span> <span class="o">=</span> <span class="n">get_string</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">target</span><span class="p">,</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">addressof</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">Name</span><span class="p">))[:</span><span class="mi">8</span><span class="p">]</span>
         <span class="k">else</span><span class="p">:</span>
-            <span class="n">name</span> <span class="o">=</span> <span class="n">get_string</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">target</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">_base_addr</span><span class="p">)[:</span><span class="mi">8</span><span class="p">]</span>
+            <span class="n">name</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">target</span><span class="o">.</span><span class="n">read_memory</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">_base_addr</span><span class="p">,</span> <span class="mi">8</span><span class="p">)</span><span class="o">.</span><span class="n">split</span><span class="p">(</span><span class="sa">b</span><span class="s2">&quot;</span><span class="se">\x00</span><span class="s2">&quot;</span><span class="p">,</span> <span class="mi">1</span><span class="p">)[</span><span class="mi">0</span><span class="p">]</span><span class="o">.</span><span class="n">decode</span><span class="p">(</span><span class="s2">&quot;ascii&quot;</span><span class="p">)</span>
         <span class="c1"># Decode as UTF-8 as the MS doc say ?</span>
         <span class="k">return</span> <span class="n">name</span>
 
@@ -549,7 +550,7 @@
         <li class="right" >
           <a href="../../py-modindex.html" title="Python Module Index"
              >modules</a> |</li>
-        <li class="nav-item nav-item-0"><a href="../../index.html">PythonForWindows 1.0.2 documentation</a> &#187;</li>
+        <li class="nav-item nav-item-0"><a href="../../index.html">PythonForWindows 1.0.3 documentation</a> &#187;</li>
           <li class="nav-item nav-item-1"><a href="../index.html" >Module code</a> &#187;</li>
         <li class="nav-item nav-item-this"><a href="">windows.pe_parse</a></li> 
       </ul>

docs/build/html/_modules/windows/remotectypes.html

@@ -4,12 +4,12 @@
   <head>
     <meta charset="utf-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-    <title>windows.remotectypes &#8212; PythonForWindows 1.0.2 documentation</title>
+    <title>windows.remotectypes &#8212; PythonForWindows 1.0.3 documentation</title>
     <link rel="stylesheet" type="text/css" href="../../_static/pygments.css?v=fa44fd50" />
     <link rel="stylesheet" type="text/css" href="../../_static/classic.css?v=def86cc0" />
     <link rel="stylesheet" type="text/css" href="../../_static/css/mbasic.css?v=957880af" />
     
-    <script src="../../_static/documentation_options.js?v=1ed6394b"></script>
+    <script src="../../_static/documentation_options.js?v=baaebd52"></script>
     <script src="../../_static/doctools.js?v=9a2dae69"></script>
     <script src="../../_static/sphinx_highlight.js?v=dc90522c"></script>
     
@@ -25,7 +25,7 @@
         <li class="right" >
           <a href="../../py-modindex.html" title="Python Module Index"
              >modules</a> |</li>
-        <li class="nav-item nav-item-0"><a href="../../index.html">PythonForWindows 1.0.2 documentation</a> &#187;</li>
+        <li class="nav-item nav-item-0"><a href="../../index.html">PythonForWindows 1.0.3 documentation</a> &#187;</li>
           <li class="nav-item nav-item-1"><a href="../index.html" accesskey="U">Module code</a> &#187;</li>
         <li class="nav-item nav-item-this"><a href="">windows.remotectypes</a></li> 
       </ul>
@@ -599,7 +599,7 @@
         <li class="right" >
           <a href="../../py-modindex.html" title="Python Module Index"
              >modules</a> |</li>
-        <li class="nav-item nav-item-0"><a href="../../index.html">PythonForWindows 1.0.2 documentation</a> &#187;</li>
+        <li class="nav-item nav-item-0"><a href="../../index.html">PythonForWindows 1.0.3 documentation</a> &#187;</li>
           <li class="nav-item nav-item-1"><a href="../index.html" >Module code</a> &#187;</li>
         <li class="nav-item nav-item-this"><a href="">windows.remotectypes</a></li> 
       </ul>

docs/build/html/_modules/windows/rpc/client.html

@@ -216,7 +216,7 @@
             <span class="n">this</span><span class="o">.</span><span class="n">version</span> <span class="o">=</span> <span class="p">(</span><span class="mi">5</span><span class="p">,</span><span class="mi">7</span><span class="p">)</span>
             <span class="n">this</span><span class="o">.</span><span class="n">flags</span> <span class="o">=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">ORPCF_LOCAL</span>
             <span class="c1"># Returned correct type with mandatory fields filed</span>
-            <span class="n">lthis</span> <span class="o">=</span> <span class="n">find_correct_localthis_for_version</span><span class="p">()</span>
+            <span class="n">lthis</span> <span class="o">=</span> <span class="n">fill_correct_localthis_for_version</span><span class="p">()</span>
             <span class="k">return</span> <span class="n">buffer</span><span class="p">(</span><span class="n">req</span><span class="p">)[:]</span> <span class="o">+</span> <span class="n">buffer</span><span class="p">(</span><span class="n">this</span><span class="p">)[:]</span> <span class="o">+</span> <span class="n">buffer</span><span class="p">(</span><span class="n">lthis</span><span class="p">)[:]</span> <span class="o">+</span> <span class="n">params</span>
         <span class="k">return</span> <span class="n">buffer</span><span class="p">(</span><span class="n">req</span><span class="p">)[:]</span> <span class="o">+</span> <span class="n">params</span>
 
@@ -255,8 +255,11 @@
         <span class="s2">&quot;raise if request_type == RESPONSE_TYPE_FAIL&quot;</span>
         <span class="n">request_type</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">unpack</span><span class="p">(</span><span class="s2">&quot;&lt;I&quot;</span><span class="p">,</span> <span class="n">response</span><span class="o">.</span><span class="n">data</span><span class="p">[:</span><span class="mi">4</span><span class="p">])[</span><span class="mi">0</span><span class="p">]</span>
         <span class="k">if</span> <span class="n">request_type</span> <span class="o">==</span> <span class="n">gdef</span><span class="o">.</span><span class="n">RPC_RESPONSE_TYPE_FAIL</span><span class="p">:</span>
-            <span class="n">error_code</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">unpack</span><span class="p">(</span><span class="s2">&quot;&lt;5I&quot;</span><span class="p">,</span> <span class="n">response</span><span class="o">.</span><span class="n">data</span><span class="p">)[</span><span class="mi">2</span><span class="p">]</span>
-            <span class="k">raise</span> <span class="ne">ValueError</span><span class="p">(</span><span class="s2">&quot;RPC Response error </span><span class="si">{0}</span><span class="s2"> (</span><span class="si">{1!r}</span><span class="s2">)&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">error_code</span><span class="p">,</span> <span class="n">KNOWN_RPC_ERROR_CODE</span><span class="o">.</span><span class="n">get</span><span class="p">(</span><span class="n">error_code</span><span class="p">,</span> <span class="n">error_code</span><span class="p">)))</span>
+            <span class="n">effective_error_code</span> <span class="o">=</span> <span class="n">error_code</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">unpack</span><span class="p">(</span><span class="s2">&quot;&lt;5I&quot;</span><span class="p">,</span> <span class="n">response</span><span class="o">.</span><span class="n">data</span><span class="p">)[</span><span class="mi">2</span><span class="p">]</span>
+            <span class="c1"># https://learn.microsoft.com/en-us/windows/win32/com/structure-of-com-error-codes</span>
+            <span class="k">if</span> <span class="n">gdef</span><span class="o">.</span><span class="n">HRESULT_FACILITY</span><span class="p">(</span><span class="n">error_code</span><span class="p">)</span> <span class="o">==</span> <span class="n">gdef</span><span class="o">.</span><span class="n">FACILITY_WIN32</span><span class="p">:</span>
+                <span class="n">effective_error_code</span> <span class="o">=</span> <span class="n">effective_error_code</span> <span class="o">&amp;</span> <span class="mh">0xffff</span>
+            <span class="k">raise</span> <span class="ne">ValueError</span><span class="p">(</span><span class="s2">&quot;RPC Response error </span><span class="si">{0:#x}</span><span class="s2"> (</span><span class="si">{1!r}</span><span class="s2">)&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">error_code</span><span class="p">,</span> <span class="n">KNOWN_RPC_ERROR_CODE</span><span class="p">[</span><span class="n">effective_error_code</span><span class="p">]))</span>
         <span class="k">return</span> <span class="n">request_type</span>
 
     <span class="k">def</span> <span class="nf">_get_response_effective_data</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">response</span><span class="p">):</span>
@@ -267,33 +270,41 @@
             <span class="n">data</span> <span class="o">=</span> <span class="n">response</span><span class="o">.</span><span class="n">data</span><span class="p">[</span><span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">ALPC_RPC_RESPONSE</span><span class="p">):]</span>
         <span class="k">else</span><span class="p">:</span>
             <span class="c1"># Response in view M extract size from PORT_MESSAGE &amp; read data from view</span>
-            <span class="k">assert</span> <span class="n">response</span><span class="o">.</span><span class="n">port_message</span><span class="o">.</span><span class="n">u1</span><span class="o">.</span><span class="n">s1</span><span class="o">.</span><span class="n">TotalLength</span> <span class="o">&gt;=</span> <span class="mh">0x48</span> <span class="c1"># At least 0x20 of data</span>
+            <span class="k">assert</span> <span class="n">response</span><span class="o">.</span><span class="n">port_message</span><span class="o">.</span><span class="n">u1</span><span class="o">.</span><span class="n">s1</span><span class="o">.</span><span class="n">DataLength</span> <span class="o">&gt;=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">ALPC_RPC_RESPONSE</span><span class="p">)</span> <span class="c1"># 0x20</span>
             <span class="n">rpcdatasize</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">unpack</span><span class="p">(</span><span class="s2">&quot;&lt;I&quot;</span><span class="p">,</span> <span class="n">response</span><span class="o">.</span><span class="n">data</span><span class="p">[</span><span class="mh">0x18</span><span class="p">:</span><span class="mh">0x1c</span><span class="p">])[</span><span class="mi">0</span><span class="p">]</span> <span class="c1"># ctypes.sizeof(ALPC_RPC_RESPONSE)</span>
             <span class="n">viewattr</span> <span class="o">=</span> <span class="n">response</span><span class="o">.</span><span class="n">view_attribute</span>
             <span class="k">assert</span> <span class="n">viewattr</span><span class="o">.</span><span class="n">ViewSize</span> <span class="o">&gt;=</span> <span class="n">rpcdatasize</span>
             <span class="n">data</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">read_memory</span><span class="p">(</span><span class="n">viewattr</span><span class="o">.</span><span class="n">ViewBase</span><span class="p">,</span> <span class="n">rpcdatasize</span><span class="p">)</span>
+            <span class="c1"># We have copied the data from the view: free it</span>
+            <span class="c1"># It looks like:</span>
+            <span class="c1"># windows.winproxy.NtAlpcDeleteSectionView(self.alpc_client.handle, 0, viewattr.ViewBase)</span>
+            <span class="c1"># Will ne be enough, as it will wait for the message to be reused to unmap the section..</span>
+            <span class="c1"># And the current architecture encourage creating new message every time</span>
         <span class="k">if</span> <span class="n">response_header</span><span class="o">.</span><span class="n">request_id</span> <span class="o">==</span> <span class="bp">self</span><span class="o">.</span><span class="n">REQUEST_IDENTIFIER_ORPC</span><span class="p">:</span>
             <span class="c1"># Parse &amp; remove ORPC headers (orpcthat + LocalThat)</span>
-            <span class="n">orpcthat</span> <span class="o">=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">ORPCTHAT32</span><span class="o">.</span><span class="n">from_buffer_copy</span><span class="p">(</span><span class="n">data</span><span class="p">)</span>
-            <span class="n">data</span> <span class="o">=</span> <span class="n">data</span><span class="p">[</span><span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">orpcthat</span><span class="p">):]</span>
-            <span class="k">if</span> <span class="n">orpcthat</span><span class="o">.</span><span class="n">extensions</span> <span class="o">!=</span> <span class="mi">0</span><span class="p">:</span>
-                <span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Parsing extension !&quot;</span><span class="p">)</span>
-                <span class="c1"># Parse extension : code have not been tested a lot</span>
-                <span class="n">write_array_extend</span> <span class="o">=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">WireExtentArray</span><span class="o">.</span><span class="n">from_buffer_copy</span><span class="p">(</span><span class="n">data</span><span class="p">)</span>
-                <span class="n">data</span> <span class="o">=</span> <span class="n">data</span><span class="p">[</span><span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">gdef</span><span class="o">.</span><span class="n">WireExtentArray</span><span class="p">):]</span>
-                <span class="k">if</span> <span class="n">write_array_extend</span><span class="o">.</span><span class="n">rounded_size</span> <span class="o">!=</span> <span class="mi">2</span><span class="p">:</span>
-                    <span class="k">raise</span> <span class="ne">NotImplementedError</span><span class="p">(</span><span class="s2">&quot;orpcthat.extensions: WireExtentArray.rounded_size != 2&quot;</span><span class="p">)</span>
-                <span class="k">for</span> <span class="n">value</span> <span class="ow">in</span> <span class="n">write_array_extend</span><span class="o">.</span><span class="n">unique_flag</span><span class="p">:</span>
-                    <span class="k">if</span> <span class="n">value</span> <span class="o">!=</span> <span class="mi">0</span><span class="p">:</span>
-                        <span class="n">data</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">_pass_wire_extend</span><span class="p">(</span><span class="n">data</span><span class="p">)</span>
-            <span class="n">localthat_type</span> <span class="o">=</span> <span class="n">find_correct_localthat_for_version</span><span class="p">()</span>
-            <span class="k">if</span> <span class="n">localthat_type</span> <span class="ow">is</span> <span class="ow">not</span> <span class="kc">None</span><span class="p">:</span>
-                <span class="n">localthat</span> <span class="o">=</span> <span class="n">localthat_type</span><span class="o">.</span><span class="n">from_buffer_copy</span><span class="p">(</span><span class="n">data</span><span class="p">)</span>
-                <span class="c1"># Check localthat pointers are empty</span>
-                <span class="k">for</span> <span class="n">field</span> <span class="ow">in</span> <span class="p">(</span><span class="s2">&quot;pAsyncResponseBlock&quot;</span><span class="p">,</span> <span class="s2">&quot;containerErrorInformation&quot;</span><span class="p">,</span> <span class="s2">&quot;containerPassthroughData&quot;</span><span class="p">):</span>
-                    <span class="k">if</span> <span class="nb">getattr</span><span class="p">(</span><span class="n">localthat</span><span class="p">,</span> <span class="n">field</span><span class="p">,</span> <span class="mi">0</span><span class="p">)</span> <span class="o">!=</span> <span class="mi">0</span><span class="p">:</span>
-                        <span class="k">raise</span> <span class="ne">NotImplementedError</span><span class="p">(</span><span class="s2">&quot;ORPC Response with localthat.</span><span class="si">{0}</span><span class="s2"> != 0&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">field</span><span class="p">))</span>
-                <span class="n">data</span> <span class="o">=</span> <span class="n">data</span><span class="p">[</span><span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">localthat</span><span class="p">):]</span>
+            <span class="n">data</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">_pass_orpc_response_structures</span><span class="p">(</span><span class="n">data</span><span class="p">)</span>
+        <span class="k">return</span> <span class="n">data</span>
+
+    <span class="k">def</span> <span class="nf">_pass_orpc_response_structures</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">data</span><span class="p">):</span>
+        <span class="n">orpcthat</span> <span class="o">=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">ORPCTHAT32</span><span class="o">.</span><span class="n">from_buffer_copy</span><span class="p">(</span><span class="n">data</span><span class="p">)</span>
+        <span class="n">data</span> <span class="o">=</span> <span class="n">data</span><span class="p">[</span><span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">orpcthat</span><span class="p">):]</span>
+        <span class="k">if</span> <span class="n">orpcthat</span><span class="o">.</span><span class="n">extensions</span> <span class="o">!=</span> <span class="mi">0</span><span class="p">:</span>
+            <span class="c1"># Parse extension : code have not been tested a lot</span>
+            <span class="n">write_array_extend</span> <span class="o">=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">WireExtentArray</span><span class="o">.</span><span class="n">from_buffer_copy</span><span class="p">(</span><span class="n">data</span><span class="p">)</span>
+            <span class="n">data</span> <span class="o">=</span> <span class="n">data</span><span class="p">[</span><span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">gdef</span><span class="o">.</span><span class="n">WireExtentArray</span><span class="p">):]</span>
+            <span class="k">if</span> <span class="n">write_array_extend</span><span class="o">.</span><span class="n">rounded_size</span> <span class="o">!=</span> <span class="mi">2</span><span class="p">:</span>
+                <span class="k">raise</span> <span class="ne">NotImplementedError</span><span class="p">(</span><span class="s2">&quot;orpcthat.extensions: WireExtentArray.rounded_size != 2&quot;</span><span class="p">)</span>
+            <span class="k">for</span> <span class="n">value</span> <span class="ow">in</span> <span class="n">write_array_extend</span><span class="o">.</span><span class="n">unique_flag</span><span class="p">:</span>
+                <span class="k">if</span> <span class="n">value</span> <span class="o">!=</span> <span class="mi">0</span><span class="p">:</span>
+                    <span class="n">data</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">_pass_wire_extend</span><span class="p">(</span><span class="n">data</span><span class="p">)</span>
+        <span class="n">localthat_type</span> <span class="o">=</span> <span class="n">find_correct_localthat_for_version</span><span class="p">()</span>
+        <span class="k">if</span> <span class="n">localthat_type</span> <span class="ow">is</span> <span class="ow">not</span> <span class="kc">None</span><span class="p">:</span>
+            <span class="n">localthat</span> <span class="o">=</span> <span class="n">localthat_type</span><span class="o">.</span><span class="n">from_buffer_copy</span><span class="p">(</span><span class="n">data</span><span class="p">)</span>
+            <span class="c1"># Check localthat pointers are empty</span>
+            <span class="k">for</span> <span class="n">field</span> <span class="ow">in</span> <span class="p">(</span><span class="s2">&quot;pAsyncResponseBlock&quot;</span><span class="p">,</span> <span class="s2">&quot;containerErrorInformation&quot;</span><span class="p">,</span> <span class="s2">&quot;containerPassthroughData&quot;</span><span class="p">):</span>
+                <span class="k">if</span> <span class="nb">getattr</span><span class="p">(</span><span class="n">localthat</span><span class="p">,</span> <span class="n">field</span><span class="p">,</span> <span class="mi">0</span><span class="p">)</span> <span class="o">!=</span> <span class="mi">0</span><span class="p">:</span>
+                    <span class="k">raise</span> <span class="ne">NotImplementedError</span><span class="p">(</span><span class="s2">&quot;ORPC Response with localthat.</span><span class="si">{0}</span><span class="s2"> != 0&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">field</span><span class="p">))</span>
+            <span class="n">data</span> <span class="o">=</span> <span class="n">data</span><span class="p">[</span><span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">localthat</span><span class="p">):]</span>
         <span class="k">return</span> <span class="n">data</span>
 
     <span class="k">def</span> <span class="nf">_pass_wire_extend</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">data</span><span class="p">):</span>
@@ -319,7 +330,7 @@
 <span class="c1"># Nb fields:  7</span>
 <span class="c1"># 10.0.16299.1 -&gt; 10.0.26100.2454</span>
 
-<span class="k">def</span> <span class="nf">find_correct_localthis_for_version</span><span class="p">():</span>
+<span class="k">def</span> <span class="nf">fill_correct_localthis_for_version</span><span class="p">():</span>
     <span class="n">vmaj</span><span class="p">,</span> <span class="n">vmin</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">system</span><span class="o">.</span><span class="n">version</span>
     <span class="k">if</span> <span class="p">(</span><span class="n">vmaj</span><span class="p">,</span> <span class="n">vmin</span><span class="p">)</span> <span class="o">&lt;</span> <span class="p">(</span><span class="mi">6</span><span class="p">,</span> <span class="mi">1</span><span class="p">):</span>
         <span class="k">return</span> <span class="kc">None</span>

docs/build/html/_modules/windows/rpc/ndr.html

@@ -4,12 +4,12 @@
   <head>
     <meta charset="utf-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-    <title>windows.rpc.ndr &#8212; PythonForWindows 1.0.2 documentation</title>
+    <title>windows.rpc.ndr &#8212; PythonForWindows 1.0.3 documentation</title>
     <link rel="stylesheet" type="text/css" href="../../../_static/pygments.css?v=fa44fd50" />
     <link rel="stylesheet" type="text/css" href="../../../_static/classic.css?v=def86cc0" />
     <link rel="stylesheet" type="text/css" href="../../../_static/css/mbasic.css?v=957880af" />
     
-    <script src="../../../_static/documentation_options.js?v=1ed6394b"></script>
+    <script src="../../../_static/documentation_options.js?v=baaebd52"></script>
     <script src="../../../_static/doctools.js?v=9a2dae69"></script>
     <script src="../../../_static/sphinx_highlight.js?v=dc90522c"></script>
     
@@ -25,7 +25,7 @@
         <li class="right" >
           <a href="../../../py-modindex.html" title="Python Module Index"
              >modules</a> |</li>
-        <li class="nav-item nav-item-0"><a href="../../../index.html">PythonForWindows 1.0.2 documentation</a> &#187;</li>
+        <li class="nav-item nav-item-0"><a href="../../../index.html">PythonForWindows 1.0.3 documentation</a> &#187;</li>
           <li class="nav-item nav-item-1"><a href="../../index.html" accesskey="U">Module code</a> &#187;</li>
         <li class="nav-item nav-item-this"><a href="">windows.rpc.ndr</a></li> 
       </ul>
@@ -229,6 +229,8 @@
         <span class="k">assert</span> <span class="n">size1</span> <span class="o">==</span> <span class="n">size2</span>
         <span class="k">assert</span> <span class="n">zero</span> <span class="o">==</span> <span class="mi">0</span>
         <span class="n">s</span> <span class="o">=</span> <span class="n">stream</span><span class="o">.</span><span class="n">read</span><span class="p">(</span><span class="n">size1</span> <span class="o">*</span> <span class="mi">2</span><span class="p">)</span>
+        <span class="k">if</span> <span class="n">stream</span><span class="o">.</span><span class="n">use_memoryview</span><span class="p">:</span>
+            <span class="k">return</span> <span class="nb">bytearray</span><span class="p">(</span><span class="n">s</span><span class="p">)</span><span class="o">.</span><span class="n">decode</span><span class="p">(</span><span class="s2">&quot;utf-16-le&quot;</span><span class="p">)</span>
         <span class="k">return</span> <span class="n">s</span><span class="o">.</span><span class="n">decode</span><span class="p">(</span><span class="s2">&quot;utf-16-le&quot;</span><span class="p">)</span>
 
     <span class="nd">@classmethod</span>
@@ -652,10 +654,14 @@
 <a class="viewcode-back" href="../../../rpc.html#windows.rpc.ndr.NdrStream">[docs]</a>
 <span class="k">class</span> <span class="nc">NdrStream</span><span class="p">(</span><span class="nb">object</span><span class="p">):</span>
 <span class="w">    </span><span class="sd">&quot;&quot;&quot;A stream of bytes used for NDR unpacking&quot;&quot;&quot;</span>
-    <span class="k">def</span> <span class="fm">__init__</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">data</span><span class="p">):</span>
+    <span class="k">def</span> <span class="fm">__init__</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">data</span><span class="p">,</span> <span class="n">use_memoryview</span><span class="o">=</span><span class="kc">False</span><span class="p">):</span>
+<span class="w">        </span><span class="sd">&quot;&quot;&quot;&quot;&quot;&quot;</span>
         <span class="bp">self</span><span class="o">.</span><span class="n">fulldata</span> <span class="o">=</span> <span class="n">data</span>
-        <span class="bp">self</span><span class="o">.</span><span class="n">data</span> <span class="o">=</span> <span class="n">data</span>
-        <span class="c1"># self.data = memoryview(data) # FAST but need some code rewrite at some places</span>
+        <span class="bp">self</span><span class="o">.</span><span class="n">use_memoryview</span> <span class="o">=</span> <span class="n">use_memoryview</span>
+        <span class="k">if</span> <span class="n">use_memoryview</span><span class="p">:</span>
+            <span class="bp">self</span><span class="o">.</span><span class="n">data</span> <span class="o">=</span> <span class="nb">memoryview</span><span class="p">(</span><span class="n">data</span><span class="p">)</span> <span class="c1"># FAST but need some code rewrite at some places</span>
+        <span class="k">else</span><span class="p">:</span>
+            <span class="bp">self</span><span class="o">.</span><span class="n">data</span> <span class="o">=</span> <span class="n">data</span>
 
     <span class="k">def</span> <span class="nf">partial_unpack</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="nb">format</span><span class="p">):</span>
         <span class="n">size</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">calcsize</span><span class="p">(</span><span class="nb">format</span><span class="p">)</span>
@@ -757,7 +763,7 @@
         <li class="right" >
           <a href="../../../py-modindex.html" title="Python Module Index"
              >modules</a> |</li>
-        <li class="nav-item nav-item-0"><a href="../../../index.html">PythonForWindows 1.0.2 documentation</a> &#187;</li>
+        <li class="nav-item nav-item-0"><a href="../../../index.html">PythonForWindows 1.0.3 documentation</a> &#187;</li>
           <li class="nav-item nav-item-1"><a href="../../index.html" >Module code</a> &#187;</li>
         <li class="nav-item nav-item-this"><a href="">windows.rpc.ndr</a></li> 
       </ul>

docs/build/html/_modules/windows/syswow64.html

@@ -4,12 +4,12 @@
   <head>
     <meta charset="utf-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-    <title>windows.syswow64 &#8212; PythonForWindows 1.0.2 documentation</title>
+    <title>windows.syswow64 &#8212; PythonForWindows 1.0.3 documentation</title>
     <link rel="stylesheet" type="text/css" href="../../_static/pygments.css?v=fa44fd50" />
     <link rel="stylesheet" type="text/css" href="../../_static/classic.css?v=def86cc0" />
     <link rel="stylesheet" type="text/css" href="../../_static/css/mbasic.css?v=957880af" />
     
-    <script src="../../_static/documentation_options.js?v=1ed6394b"></script>
+    <script src="../../_static/documentation_options.js?v=baaebd52"></script>
     <script src="../../_static/doctools.js?v=9a2dae69"></script>
     <script src="../../_static/sphinx_highlight.js?v=dc90522c"></script>
     
@@ -25,7 +25,7 @@
         <li class="right" >
           <a href="../../py-modindex.html" title="Python Module Index"
              >modules</a> |</li>
-        <li class="nav-item nav-item-0"><a href="../../index.html">PythonForWindows 1.0.2 documentation</a> &#187;</li>
+        <li class="nav-item nav-item-0"><a href="../../index.html">PythonForWindows 1.0.3 documentation</a> &#187;</li>
           <li class="nav-item nav-item-1"><a href="../index.html" accesskey="U">Module code</a> &#187;</li>
         <li class="nav-item nav-item-this"><a href="">windows.syswow64</a></li> 
       </ul>
@@ -212,19 +212,20 @@
 
 <span class="k">def</span> <span class="nf">get_current_process_syswow_peb</span><span class="p">():</span>
     <span class="n">current_process</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span>
-
-    <span class="k">class</span> <span class="nc">CurrentProcessReadSyswow</span><span class="p">(</span><span class="n">process</span><span class="o">.</span><span class="n">Process</span><span class="p">):</span>
-        <span class="n">bitness</span> <span class="o">=</span> <span class="mi">64</span>
-        <span class="k">def</span> <span class="nf">_get_handle</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
-            <span class="k">return</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">OpenProcess</span><span class="p">(</span><span class="n">dwProcessId</span><span class="o">=</span><span class="n">current_process</span><span class="o">.</span><span class="n">pid</span><span class="p">)</span>
-
-        <span class="k">def</span> <span class="nf">read_memory</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">addr</span><span class="p">,</span> <span class="n">size</span><span class="p">):</span>
-            <span class="n">buffer_addr</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">create_string_buffer</span><span class="p">(</span><span class="n">size</span><span class="p">)</span>
-            <span class="n">winproxy</span><span class="o">.</span><span class="n">NtWow64ReadVirtualMemory64</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">addr</span><span class="p">,</span> <span class="n">buffer_addr</span><span class="p">,</span> <span class="n">size</span><span class="p">)</span>
-            <span class="k">return</span> <span class="n">buffer_addr</span><span class="p">[:]</span>
     <span class="n">peb_addr</span> <span class="o">=</span> <span class="n">get_current_process_syswow_peb_addr</span><span class="p">()</span>
     <span class="k">return</span> <span class="n">windows</span><span class="o">.</span><span class="n">winobject</span><span class="o">.</span><span class="n">process</span><span class="o">.</span><span class="n">RemotePEB64</span><span class="p">(</span><span class="n">peb_addr</span><span class="p">,</span> <span class="n">CurrentProcessReadSyswow</span><span class="p">())</span>
 
+<span class="k">class</span> <span class="nc">CurrentProcessReadSyswow</span><span class="p">(</span><span class="n">process</span><span class="o">.</span><span class="n">Process</span><span class="p">):</span>
+    <span class="n">bitness</span> <span class="o">=</span> <span class="mi">64</span>
+
+    <span class="k">def</span> <span class="nf">_get_handle</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
+        <span class="c1"># GetCurrentProcess() is not accepted for NtWow64ReadVirtualMemory64 :(</span>
+        <span class="k">return</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">OpenProcess</span><span class="p">(</span><span class="n">dwProcessId</span><span class="o">=</span><span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">pid</span><span class="p">)</span>
+
+    <span class="k">def</span> <span class="nf">read_memory</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">addr</span><span class="p">,</span> <span class="n">size</span><span class="p">):</span>
+        <span class="n">buffer_addr</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">create_string_buffer</span><span class="p">(</span><span class="n">size</span><span class="p">)</span>
+        <span class="n">winproxy</span><span class="o">.</span><span class="n">NtWow64ReadVirtualMemory64</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">addr</span><span class="p">,</span> <span class="n">buffer_addr</span><span class="p">,</span> <span class="n">size</span><span class="p">)</span>
+        <span class="k">return</span> <span class="n">buffer_addr</span><span class="p">[:]</span>
 
 <span class="k">class</span> <span class="nc">ReadSyswow64Process</span><span class="p">(</span><span class="n">process</span><span class="o">.</span><span class="n">Process</span><span class="p">):</span>
         <span class="k">def</span> <span class="fm">__init__</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">target</span><span class="p">):</span>
@@ -432,7 +433,7 @@
         <li class="right" >
           <a href="../../py-modindex.html" title="Python Module Index"
              >modules</a> |</li>
-        <li class="nav-item nav-item-0"><a href="../../index.html">PythonForWindows 1.0.2 documentation</a> &#187;</li>
+        <li class="nav-item nav-item-0"><a href="../../index.html">PythonForWindows 1.0.3 documentation</a> &#187;</li>
           <li class="nav-item nav-item-1"><a href="../index.html" >Module code</a> &#187;</li>
         <li class="nav-item nav-item-this"><a href="">windows.syswow64</a></li> 
       </ul>

docs/build/html/_modules/windows/utils/winutils.html

@@ -4,12 +4,12 @@
   <head>
     <meta charset="utf-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-    <title>windows.utils.winutils &#8212; PythonForWindows 1.0.2 documentation</title>
+    <title>windows.utils.winutils &#8212; PythonForWindows 1.0.3 documentation</title>
     <link rel="stylesheet" type="text/css" href="../../../_static/pygments.css?v=fa44fd50" />
     <link rel="stylesheet" type="text/css" href="../../../_static/classic.css?v=def86cc0" />
     <link rel="stylesheet" type="text/css" href="../../../_static/css/mbasic.css?v=957880af" />
     
-    <script src="../../../_static/documentation_options.js?v=1ed6394b"></script>
+    <script src="../../../_static/documentation_options.js?v=baaebd52"></script>
     <script src="../../../_static/doctools.js?v=9a2dae69"></script>
     <script src="../../../_static/sphinx_highlight.js?v=dc90522c"></script>
     
@@ -25,7 +25,7 @@
         <li class="right" >
           <a href="../../../py-modindex.html" title="Python Module Index"
              >modules</a> |</li>
-        <li class="nav-item nav-item-0"><a href="../../../index.html">PythonForWindows 1.0.2 documentation</a> &#187;</li>
+        <li class="nav-item nav-item-0"><a href="../../../index.html">PythonForWindows 1.0.3 documentation</a> &#187;</li>
           <li class="nav-item nav-item-1"><a href="../../index.html" accesskey="U">Module code</a> &#187;</li>
         <li class="nav-item nav-item-this"><a href="">windows.utils.winutils</a></li> 
       </ul>
@@ -75,19 +75,6 @@
         <span class="k">return</span> <span class="n">mod</span><span class="o">.</span><span class="n">pe</span><span class="o">.</span><span class="n">exports</span><span class="p">[</span><span class="n">func_name</span><span class="p">]</span>
 
 
-<span class="k">def</span> <span class="nf">is_wow_64</span><span class="p">(</span><span class="n">hProcess</span><span class="p">):</span>
-    <span class="k">try</span><span class="p">:</span>
-        <span class="n">fnIsWow64Process</span> <span class="o">=</span> <span class="n">get_func_addr</span><span class="p">(</span><span class="s2">&quot;kernel32.dll&quot;</span><span class="p">,</span> <span class="s2">&quot;IsWow64Process&quot;</span><span class="p">)</span>
-    <span class="k">except</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">WinproxyError</span><span class="p">:</span>
-        <span class="k">return</span> <span class="kc">False</span>
-    <span class="n">IsWow64Process</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">WINFUNCTYPE</span><span class="p">(</span><span class="n">BOOL</span><span class="p">,</span> <span class="n">HANDLE</span><span class="p">,</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">POINTER</span><span class="p">(</span><span class="n">BOOL</span><span class="p">))(</span><span class="n">fnIsWow64Process</span><span class="p">)</span>
-    <span class="n">Wow64Process</span> <span class="o">=</span> <span class="n">BOOL</span><span class="p">()</span>
-    <span class="n">res</span> <span class="o">=</span> <span class="n">IsWow64Process</span><span class="p">(</span><span class="n">hProcess</span><span class="p">,</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">byref</span><span class="p">(</span><span class="n">Wow64Process</span><span class="p">))</span>
-    <span class="k">if</span> <span class="n">res</span><span class="p">:</span>
-        <span class="k">return</span> <span class="nb">bool</span><span class="p">(</span><span class="n">Wow64Process</span><span class="p">)</span>
-    <span class="k">raise</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">WinError</span><span class="p">()</span>
-
-
 <div class="viewcode-block" id="create_file_from_handle">
 <a class="viewcode-back" href="../../../utils.html#windows.utils.create_file_from_handle">[docs]</a>
 <span class="k">def</span> <span class="nf">create_file_from_handle</span><span class="p">(</span><span class="n">handle</span><span class="p">,</span> <span class="n">mode</span><span class="o">=</span><span class="s2">&quot;r&quot;</span><span class="p">):</span>
@@ -136,14 +123,35 @@
 
 <div class="viewcode-block" id="create_process">
 <a class="viewcode-back" href="../../../utils.html#windows.utils.create_process">[docs]</a>
-<span class="k">def</span> <span class="nf">create_process</span><span class="p">(</span><span class="n">path</span><span class="p">,</span> <span class="n">args</span><span class="o">=</span><span class="kc">None</span><span class="p">,</span> <span class="n">dwCreationFlags</span><span class="o">=</span><span class="mi">0</span><span class="p">,</span> <span class="n">show_windows</span><span class="o">=</span><span class="kc">True</span><span class="p">):</span>
-<span class="w">    </span><span class="sd">&quot;&quot;&quot;A convenient wrapper arround :func:`windows.winproxy.CreateProcessW`&quot;&quot;&quot;</span>
+<span class="k">def</span> <span class="nf">create_process</span><span class="p">(</span><span class="n">path</span><span class="p">,</span> <span class="n">args</span><span class="o">=</span><span class="kc">None</span><span class="p">,</span> <span class="n">dwCreationFlags</span><span class="o">=</span><span class="mi">0</span><span class="p">,</span> <span class="n">show_windows</span><span class="o">=</span><span class="kc">True</span><span class="p">,</span> <span class="n">machine</span><span class="o">=</span><span class="kc">None</span><span class="p">):</span>
+<span class="w">    </span><span class="sd">&quot;&quot;&quot;A convenient wrapper arround :func:`windows.winproxy.CreateProcessW`</span>
+<span class="sd">    ..note:</span>
+<span class="sd">        The machine param only works starting at vista and should be used on arm64 computer</span>
+<span class="sd">    &quot;&quot;&quot;</span>
     <span class="n">proc_info</span> <span class="o">=</span> <span class="n">PROCESS_INFORMATION</span><span class="p">()</span>
+    <span class="n">StartupInfo</span> <span class="o">=</span> <span class="kc">None</span>
     <span class="n">lpStartupInfo</span> <span class="o">=</span> <span class="kc">None</span>
+
+    <span class="k">if</span> <span class="n">machine</span> <span class="ow">is</span> <span class="ow">not</span> <span class="kc">None</span><span class="p">:</span>
+        <span class="n">buffer</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">create_string_buffer</span><span class="p">(</span><span class="mh">0x100</span><span class="p">)</span>
+        <span class="n">size</span> <span class="o">=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">DWORD64</span><span class="p">(</span><span class="nb">len</span><span class="p">(</span><span class="n">buffer</span><span class="p">))</span>
+        <span class="n">machine</span> <span class="o">=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">WORD</span><span class="p">(</span><span class="n">machine</span><span class="p">)</span>
+        <span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">InitializeProcThreadAttributeList</span><span class="p">(</span><span class="n">buffer</span><span class="p">,</span> <span class="mi">1</span><span class="p">,</span> <span class="mi">0</span><span class="p">,</span> <span class="n">size</span><span class="p">)</span>
+        <span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">UpdateProcThreadAttribute</span><span class="p">(</span><span class="n">buffer</span><span class="p">,</span> <span class="mi">0</span><span class="p">,</span> <span class="n">gdef</span><span class="o">.</span><span class="n">PROC_THREAD_ATTRIBUTE_MACHINE_TYPE</span><span class="p">,</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">addressof</span><span class="p">(</span><span class="n">machine</span><span class="p">),</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">machine</span><span class="p">),</span> <span class="kc">None</span><span class="p">,</span> <span class="kc">None</span><span class="p">)</span>
+
+        <span class="n">startup_infoex</span> <span class="o">=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">STARTUPINFOEXW</span><span class="p">()</span>
+        <span class="n">startup_infoex</span><span class="o">.</span><span class="n">StartupInfo</span><span class="o">.</span><span class="n">cb</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">gdef</span><span class="o">.</span><span class="n">STARTUPINFOEXW</span><span class="p">)</span>
+        <span class="n">startup_infoex</span><span class="o">.</span><span class="n">lpAttributeList</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">cast</span><span class="p">(</span><span class="n">buffer</span><span class="p">,</span> <span class="n">gdef</span><span class="o">.</span><span class="n">PVOID</span><span class="p">)</span>
+        <span class="n">StartupInfo</span> <span class="o">=</span> <span class="n">startup_infoex</span><span class="o">.</span><span class="n">StartupInfo</span>
+
+        <span class="n">dwCreationFlags</span> <span class="o">|=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">EXTENDED_STARTUPINFO_PRESENT</span>
+
     <span class="k">if</span> <span class="n">show_windows</span><span class="p">:</span>
-        <span class="n">StartupInfo</span> <span class="o">=</span> <span class="n">STARTUPINFOW</span><span class="p">()</span>
-        <span class="n">StartupInfo</span><span class="o">.</span><span class="n">cb</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">StartupInfo</span><span class="p">)</span>
+        <span class="k">if</span> <span class="n">StartupInfo</span> <span class="ow">is</span> <span class="kc">None</span><span class="p">:</span>
+            <span class="n">StartupInfo</span> <span class="o">=</span> <span class="n">STARTUPINFOW</span><span class="p">()</span>
+            <span class="n">StartupInfo</span><span class="o">.</span><span class="n">cb</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">StartupInfo</span><span class="p">)</span>
         <span class="n">StartupInfo</span><span class="o">.</span><span class="n">dwFlags</span> <span class="o">=</span> <span class="mi">0</span>
+    <span class="k">if</span> <span class="n">StartupInfo</span><span class="p">:</span>
         <span class="n">lpStartupInfo</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">byref</span><span class="p">(</span><span class="n">StartupInfo</span><span class="p">)</span>
     <span class="n">lpCommandLine</span> <span class="o">=</span> <span class="kc">None</span>
     <span class="k">if</span> <span class="nb">isinstance</span><span class="p">(</span><span class="n">path</span><span class="p">,</span> <span class="nb">bytes</span><span class="p">):</span>
@@ -160,6 +168,8 @@
     <span class="n">dbgprint</span><span class="p">(</span><span class="s2">&quot;CreateProcessW new thread handle </span><span class="si">{:#x}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">proc_info</span><span class="o">.</span><span class="n">hThread</span><span class="p">),</span> <span class="s2">&quot;HANDLE&quot;</span><span class="p">)</span>
     <span class="n">dbgprint</span><span class="p">(</span><span class="s2">&quot;Automatic close of thread handle </span><span class="si">{:#x}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">proc_info</span><span class="o">.</span><span class="n">hThread</span><span class="p">),</span> <span class="s2">&quot;HANDLE&quot;</span><span class="p">)</span>
     <span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">CloseHandle</span><span class="p">(</span><span class="n">proc_info</span><span class="o">.</span><span class="n">hThread</span><span class="p">)</span>  <span class="c1"># Give access to a WinThread in addition of the WinProcess ?</span>
+    <span class="k">if</span> <span class="n">machine</span><span class="p">:</span>
+        <span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">DeleteProcThreadAttributeList</span><span class="p">(</span><span class="n">buffer</span><span class="p">)</span>
     <span class="k">return</span> <span class="n">windows</span><span class="o">.</span><span class="n">winobject</span><span class="o">.</span><span class="n">process</span><span class="o">.</span><span class="n">WinProcess</span><span class="p">(</span><span class="n">pid</span><span class="o">=</span><span class="n">proc_info</span><span class="o">.</span><span class="n">dwProcessId</span><span class="p">,</span> <span class="n">handle</span><span class="o">=</span><span class="n">proc_info</span><span class="o">.</span><span class="n">hProcess</span><span class="p">)</span></div>
 
 
@@ -360,6 +370,16 @@
             <span class="n">microsecond</span><span class="o">=</span><span class="n">systime</span><span class="o">.</span><span class="n">wMilliseconds</span> <span class="o">*</span> <span class="mi">1000</span><span class="p">,</span>
     <span class="p">)</span>
 
+<span class="n">IMAGE_FILE_MACHINE_TO_PROC_ARCH</span> <span class="o">=</span> <span class="p">{</span>
+    <span class="n">gdef</span><span class="o">.</span><span class="n">IMAGE_FILE_MACHINE_I386</span><span class="p">:</span> <span class="n">gdef</span><span class="o">.</span><span class="n">PROCESSOR_ARCHITECTURE_INTEL</span><span class="p">,</span>
+    <span class="n">gdef</span><span class="o">.</span><span class="n">IMAGE_FILE_MACHINE_AMD64</span><span class="p">:</span> <span class="n">gdef</span><span class="o">.</span><span class="n">PROCESSOR_ARCHITECTURE_AMD64</span><span class="p">,</span>
+    <span class="n">gdef</span><span class="o">.</span><span class="n">IMAGE_FILE_MACHINE_ARM64</span><span class="p">:</span> <span class="n">gdef</span><span class="o">.</span><span class="n">PROCESSOR_ARCHITECTURE_ARM64</span><span class="p">,</span>
+    <span class="n">gdef</span><span class="o">.</span><span class="n">IMAGE_FILE_MACHINE_UNKNOWN</span><span class="p">:</span> <span class="n">gdef</span><span class="o">.</span><span class="n">PROCESSOR_ARCHITECTURE_UNKNOWN</span>
+<span class="p">}</span>
+
+<span class="k">def</span> <span class="nf">image_file_machine_to_processor_architecture</span><span class="p">(</span><span class="n">image_file_machine</span><span class="p">):</span>
+    <span class="k">return</span> <span class="n">IMAGE_FILE_MACHINE_TO_PROC_ARCH</span><span class="p">[</span><span class="n">image_file_machine</span><span class="p">]</span>
+
 <span class="k">class</span> <span class="nc">FixedInteractiveConsole</span><span class="p">(</span><span class="n">code</span><span class="o">.</span><span class="n">InteractiveConsole</span><span class="p">):</span>
     <span class="k">def</span> <span class="nf">raw_input</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">prompt</span><span class="o">=</span><span class="s2">&quot;&gt;&gt;&gt;&quot;</span><span class="p">):</span>
         <span class="n">sys</span><span class="o">.</span><span class="n">stdout</span><span class="o">.</span><span class="n">write</span><span class="p">(</span><span class="n">prompt</span><span class="p">)</span>
@@ -626,6 +646,14 @@
 <span class="c1">#    addr = windows.winproxy.MapViewOfFile(h, dwDesiredAccess=FILE_MAP_READ, dwNumberOfBytesToMap=1)</span>
 <span class="c1">#    return addr</span>
 
+<span class="k">def</span> <span class="nf">get_system_info</span><span class="p">(</span><span class="n">native</span><span class="o">=</span><span class="kc">False</span><span class="p">):</span>
+    <span class="n">res</span> <span class="o">=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">SYSTEM_INFO</span><span class="p">()</span>
+    <span class="k">if</span> <span class="n">native</span><span class="p">:</span>
+        <span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">GetNativeSystemInfo</span><span class="p">(</span><span class="n">res</span><span class="p">)</span>
+    <span class="k">else</span><span class="p">:</span>
+        <span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">GetSystemInfo</span><span class="p">(</span><span class="n">res</span><span class="p">)</span>
+    <span class="k">return</span> <span class="n">res</span>
+
 <span class="k">def</span> <span class="nf">decompress_buffer</span><span class="p">(</span><span class="n">buffer</span><span class="p">,</span> <span class="n">comptype</span><span class="o">=</span><span class="n">gdef</span><span class="o">.</span><span class="n">COMPRESSION_FORMAT_LZNT1</span><span class="p">,</span> <span class="n">uncompress_size</span><span class="o">=</span><span class="kc">None</span><span class="p">):</span>
     <span class="k">if</span> <span class="n">uncompress_size</span> <span class="ow">is</span> <span class="kc">None</span><span class="p">:</span>
         <span class="n">uncompress_size</span> <span class="o">=</span> <span class="nb">len</span><span class="p">(</span><span class="n">buffer</span><span class="p">)</span> <span class="o">*</span> <span class="mi">10</span>
@@ -700,7 +728,7 @@
 <div class="viewcode-block" id="DisableWow64FsRedirection">
 <a class="viewcode-back" href="../../../utils.html#windows.utils.DisableWow64FsRedirection">[docs]</a>
 <span class="k">class</span> <span class="nc">DisableWow64FsRedirection</span><span class="p">(</span><span class="nb">object</span><span class="p">):</span>
-<span class="w">    </span><span class="sd">&quot;&quot;&quot;</span>
+<span class="w">    </span><span class="sa">r</span><span class="sd">&quot;&quot;&quot;</span>
 <span class="sd">    A context manager that disable the SysWow64 Filesystem Redirection ::</span>
 
 <span class="sd">        if is_process_32_bits:</span>
@@ -752,7 +780,7 @@
         <li class="right" >
           <a href="../../../py-modindex.html" title="Python Module Index"
              >modules</a> |</li>
-        <li class="nav-item nav-item-0"><a href="../../../index.html">PythonForWindows 1.0.2 documentation</a> &#187;</li>
+        <li class="nav-item nav-item-0"><a href="../../../index.html">PythonForWindows 1.0.3 documentation</a> &#187;</li>
           <li class="nav-item nav-item-1"><a href="../../index.html" >Module code</a> &#187;</li>
         <li class="nav-item nav-item-this"><a href="">windows.utils.winutils</a></li> 
       </ul>

docs/build/html/_modules/windows/winobject/event_log.html

@@ -4,12 +4,12 @@
   <head>
     <meta charset="utf-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-    <title>windows.winobject.event_log &#8212; PythonForWindows 1.0.2 documentation</title>
+    <title>windows.winobject.event_log &#8212; PythonForWindows 1.0.3 documentation</title>
     <link rel="stylesheet" type="text/css" href="../../../_static/pygments.css?v=fa44fd50" />
     <link rel="stylesheet" type="text/css" href="../../../_static/classic.css?v=def86cc0" />
     <link rel="stylesheet" type="text/css" href="../../../_static/css/mbasic.css?v=957880af" />
     
-    <script src="../../../_static/documentation_options.js?v=1ed6394b"></script>
+    <script src="../../../_static/documentation_options.js?v=baaebd52"></script>
     <script src="../../../_static/doctools.js?v=9a2dae69"></script>
     <script src="../../../_static/sphinx_highlight.js?v=dc90522c"></script>
     
@@ -25,7 +25,7 @@
         <li class="right" >
           <a href="../../../py-modindex.html" title="Python Module Index"
              >modules</a> |</li>
-        <li class="nav-item nav-item-0"><a href="../../../index.html">PythonForWindows 1.0.2 documentation</a> &#187;</li>
+        <li class="nav-item nav-item-0"><a href="../../../index.html">PythonForWindows 1.0.3 documentation</a> &#187;</li>
           <li class="nav-item nav-item-1"><a href="../../index.html" accesskey="U">Module code</a> &#187;</li>
         <li class="nav-item nav-item-this"><a href="">windows.winobject.event_log</a></li> 
       </ul>
@@ -1279,7 +1279,7 @@
         <li class="right" >
           <a href="../../../py-modindex.html" title="Python Module Index"
              >modules</a> |</li>
-        <li class="nav-item nav-item-0"><a href="../../../index.html">PythonForWindows 1.0.2 documentation</a> &#187;</li>
+        <li class="nav-item nav-item-0"><a href="../../../index.html">PythonForWindows 1.0.3 documentation</a> &#187;</li>
           <li class="nav-item nav-item-1"><a href="../../index.html" >Module code</a> &#187;</li>
         <li class="nav-item nav-item-this"><a href="">windows.winobject.event_log</a></li> 
       </ul>

docs/build/html/_modules/windows/winobject/handle.html

@@ -4,12 +4,12 @@
   <head>
     <meta charset="utf-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-    <title>windows.winobject.handle &#8212; PythonForWindows 1.0.2 documentation</title>
+    <title>windows.winobject.handle &#8212; PythonForWindows 1.0.3 documentation</title>
     <link rel="stylesheet" type="text/css" href="../../../_static/pygments.css?v=fa44fd50" />
     <link rel="stylesheet" type="text/css" href="../../../_static/classic.css?v=def86cc0" />
     <link rel="stylesheet" type="text/css" href="../../../_static/css/mbasic.css?v=957880af" />
     
-    <script src="../../../_static/documentation_options.js?v=1ed6394b"></script>
+    <script src="../../../_static/documentation_options.js?v=baaebd52"></script>
     <script src="../../../_static/doctools.js?v=9a2dae69"></script>
     <script src="../../../_static/sphinx_highlight.js?v=dc90522c"></script>
     
@@ -25,7 +25,7 @@
         <li class="right" >
           <a href="../../../py-modindex.html" title="Python Module Index"
              >modules</a> |</li>
-        <li class="nav-item nav-item-0"><a href="../../../index.html">PythonForWindows 1.0.2 documentation</a> &#187;</li>
+        <li class="nav-item nav-item-0"><a href="../../../index.html">PythonForWindows 1.0.3 documentation</a> &#187;</li>
           <li class="nav-item nav-item-1"><a href="../../index.html" accesskey="U">Module code</a> &#187;</li>
         <li class="nav-item nav-item-this"><a href="">windows.winobject.handle</a></li> 
       </ul>
@@ -186,6 +186,8 @@
 
 
 <span class="k">def</span> <span class="nf">enumerate_handles_syswow64</span><span class="p">():</span>
+    <span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">_is_x86_on_arm64</span><span class="p">:</span>
+        <span class="k">raise</span> <span class="ne">NotImplementedError</span><span class="p">(</span><span class="s2">&quot;Crossing heaven gate x86 -&gt; arm64 not implemented&quot;</span><span class="p">)</span>
     <span class="n">size_needed</span> <span class="o">=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">ULONG</span><span class="p">()</span>
     <span class="c1"># Should at least be sizeof(gdef.SYSTEM_HANDLE_INFORMATION)</span>
     <span class="n">tmp_buffer</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">utils</span><span class="o">.</span><span class="n">BUFFER</span><span class="p">(</span><span class="n">gdef</span><span class="o">.</span><span class="n">SYSTEM_HANDLE_INFORMATION64</span><span class="p">)()</span>
@@ -267,7 +269,7 @@
         <li class="right" >
           <a href="../../../py-modindex.html" title="Python Module Index"
              >modules</a> |</li>
-        <li class="nav-item nav-item-0"><a href="../../../index.html">PythonForWindows 1.0.2 documentation</a> &#187;</li>
+        <li class="nav-item nav-item-0"><a href="../../../index.html">PythonForWindows 1.0.3 documentation</a> &#187;</li>
           <li class="nav-item nav-item-1"><a href="../../index.html" >Module code</a> &#187;</li>
         <li class="nav-item nav-item-this"><a href="">windows.winobject.handle</a></li> 
       </ul>

docs/build/html/_modules/windows/winobject/object_manager.html

@@ -4,12 +4,12 @@
   <head>
     <meta charset="utf-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-    <title>windows.winobject.object_manager &#8212; PythonForWindows 1.0.2 documentation</title>
+    <title>windows.winobject.object_manager &#8212; PythonForWindows 1.0.3 documentation</title>
     <link rel="stylesheet" type="text/css" href="../../../_static/pygments.css?v=fa44fd50" />
     <link rel="stylesheet" type="text/css" href="../../../_static/classic.css?v=def86cc0" />
     <link rel="stylesheet" type="text/css" href="../../../_static/css/mbasic.css?v=957880af" />
     
-    <script src="../../../_static/documentation_options.js?v=1ed6394b"></script>
+    <script src="../../../_static/documentation_options.js?v=baaebd52"></script>
     <script src="../../../_static/doctools.js?v=9a2dae69"></script>
     <script src="../../../_static/sphinx_highlight.js?v=dc90522c"></script>
     
@@ -25,7 +25,7 @@
         <li class="right" >
           <a href="../../../py-modindex.html" title="Python Module Index"
              >modules</a> |</li>
-        <li class="nav-item nav-item-0"><a href="../../../index.html">PythonForWindows 1.0.2 documentation</a> &#187;</li>
+        <li class="nav-item nav-item-0"><a href="../../../index.html">PythonForWindows 1.0.3 documentation</a> &#187;</li>
           <li class="nav-item nav-item-1"><a href="../../index.html" accesskey="U">Module code</a> &#187;</li>
         <li class="nav-item nav-item-this"><a href="">windows.winobject.object_manager</a></li> 
       </ul>
@@ -224,13 +224,13 @@
 <div class="viewcode-block" id="KernelObject.__getitem__">
 <a class="viewcode-back" href="../../../object_manager.html#windows.winobject.object_manager.KernelObject.__getitem__">[docs]</a>
     <span class="k">def</span> <span class="fm">__getitem__</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">name</span><span class="p">):</span>
-<span class="w">        </span><span class="sd">&quot;&quot;&quot;Query object ``name`` from the directory, split and subquery on ``\\``::</span>
+<span class="w">        </span><span class="sa">r</span><span class="sd">&quot;&quot;&quot;Query object ``name`` from the directory, split and subquery on ``\``::</span>
 
 <span class="sd">            &gt;&gt;&gt; obj</span>
 <span class="sd">            &lt;KernelObject &quot;\Windows&quot; (type=&quot;Directory&quot;)&gt;</span>
 <span class="sd">            &gt;&gt;&gt; obj[&quot;WindowStations&quot;][&quot;WinSta0&quot;]</span>
 <span class="sd">            &lt;KernelObject &quot;\Windows\WindowStations&quot; (type=&quot;Directory&quot;)&gt;</span>
-<span class="sd">            &gt;&gt;&gt; obj[&quot;WindowStations\\WinSta0&quot;]</span>
+<span class="sd">            &gt;&gt;&gt; obj[r&quot;WindowStations\\WinSta0&quot;]</span>
 <span class="sd">            &lt;KernelObject &quot;\Windows\WindowStations&quot; (type=&quot;Directory&quot;)&gt;</span>
 
 <span class="sd">        :rtype: :class:`KernelObject`</span>
@@ -317,7 +317,7 @@
         <li class="right" >
           <a href="../../../py-modindex.html" title="Python Module Index"
              >modules</a> |</li>
-        <li class="nav-item nav-item-0"><a href="../../../index.html">PythonForWindows 1.0.2 documentation</a> &#187;</li>
+        <li class="nav-item nav-item-0"><a href="../../../index.html">PythonForWindows 1.0.3 documentation</a> &#187;</li>
           <li class="nav-item nav-item-1"><a href="../../index.html" >Module code</a> &#187;</li>
         <li class="nav-item nav-item-this"><a href="">windows.winobject.object_manager</a></li> 
       </ul>

docs/build/html/_modules/windows/winobject/process.html

@@ -4,12 +4,12 @@
   <head>
     <meta charset="utf-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-    <title>windows.winobject.process &#8212; PythonForWindows 1.0.2 documentation</title>
+    <title>windows.winobject.process &#8212; PythonForWindows 1.0.3 documentation</title>
     <link rel="stylesheet" type="text/css" href="../../../_static/pygments.css?v=fa44fd50" />
     <link rel="stylesheet" type="text/css" href="../../../_static/classic.css?v=def86cc0" />
     <link rel="stylesheet" type="text/css" href="../../../_static/css/mbasic.css?v=957880af" />
     
-    <script src="../../../_static/documentation_options.js?v=1ed6394b"></script>
+    <script src="../../../_static/documentation_options.js?v=baaebd52"></script>
     <script src="../../../_static/doctools.js?v=9a2dae69"></script>
     <script src="../../../_static/sphinx_highlight.js?v=dc90522c"></script>
     
@@ -25,7 +25,7 @@
         <li class="right" >
           <a href="../../../py-modindex.html" title="Python Module Index"
              >modules</a> |</li>
-        <li class="nav-item nav-item-0"><a href="../../../index.html">PythonForWindows 1.0.2 documentation</a> &#187;</li>
+        <li class="nav-item nav-item-0"><a href="../../../index.html">PythonForWindows 1.0.3 documentation</a> &#187;</li>
           <li class="nav-item nav-item-1"><a href="../../index.html" accesskey="U">Module code</a> &#187;</li>
         <li class="nav-item nav-item-this"><a href="">windows.winobject.process</a></li> 
       </ul>
@@ -51,6 +51,7 @@
 <span class="kn">import</span> <span class="nn">windows</span>
 <span class="kn">import</span> <span class="nn">windows.native_exec.simple_x86</span> <span class="k">as</span> <span class="nn">x86</span>
 <span class="kn">import</span> <span class="nn">windows.native_exec.simple_x64</span> <span class="k">as</span> <span class="nn">x64</span>
+<span class="kn">import</span> <span class="nn">windows.native_exec.simple_arm64</span> <span class="k">as</span> <span class="nn">arm64</span>
 <span class="kn">import</span> <span class="nn">windows.remotectypes</span> <span class="k">as</span> <span class="nn">rctypes</span>
 <span class="kn">import</span> <span class="nn">windows.generated_def</span> <span class="k">as</span> <span class="nn">gdef</span>
 
@@ -106,27 +107,82 @@
 
 
 <span class="k">class</span> <span class="nc">Process</span><span class="p">(</span><span class="n">utils</span><span class="o">.</span><span class="n">AutoHandle</span><span class="p">):</span>
-    <span class="nd">@utils</span><span class="o">.</span><span class="n">fixedpropety</span>
+    <span class="nd">@utils</span><span class="o">.</span><span class="n">fixedproperty</span>
     <span class="k">def</span> <span class="nf">is_wow_64</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
 <span class="w">        </span><span class="sd">&quot;&quot;&quot;``True`` if the process is a SysWow64 process (32bit process on 64bits system).</span>
 
 <span class="sd">        :type: :class:`bool`</span>
 <span class="sd">		&quot;&quot;&quot;</span>
-        <span class="c1"># return utils.is_wow_64(self.handle)</span>
-        <span class="k">return</span> <span class="n">utils</span><span class="o">.</span><span class="n">is_wow_64</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">limited_handle</span><span class="p">)</span>
+        <span class="k">if</span> <span class="ow">not</span> <span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">is_implemented</span><span class="p">(</span><span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">IsWow64Process</span><span class="p">):</span>
+            <span class="k">return</span> <span class="kc">False</span>
+        <span class="n">Wow64Process</span> <span class="o">=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">BOOL</span><span class="p">()</span>
+        <span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">IsWow64Process</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">Wow64Process</span><span class="p">)</span>
+        <span class="k">return</span> <span class="nb">bool</span><span class="p">(</span><span class="n">Wow64Process</span><span class="p">)</span>
 
-    <span class="nd">@utils</span><span class="o">.</span><span class="n">fixedpropety</span>
+
+
+    <span class="nd">@utils</span><span class="o">.</span><span class="n">fixedproperty</span>
+    <span class="k">def</span> <span class="nf">is_wow_64_2</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
+        <span class="k">if</span> <span class="ow">not</span> <span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">is_implemented</span><span class="p">(</span><span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">IsWow64Process2</span><span class="p">):</span>
+            <span class="k">return</span> <span class="kc">None</span><span class="p">,</span> <span class="kc">None</span>
+        <span class="n">processMachine</span> <span class="o">=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">USHORT</span><span class="p">()</span>
+        <span class="n">nativeMachine</span> <span class="o">=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">USHORT</span><span class="p">()</span>
+        <span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">IsWow64Process2</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">processMachine</span><span class="p">,</span> <span class="n">nativeMachine</span><span class="p">)</span>
+        <span class="k">return</span> <span class="p">(</span><span class="n">gdef</span><span class="o">.</span><span class="n">IMAGE_FILE_MACHINE_MAPPER</span><span class="p">[</span><span class="n">processMachine</span><span class="o">.</span><span class="n">value</span><span class="p">],</span>
+                <span class="n">gdef</span><span class="o">.</span><span class="n">IMAGE_FILE_MACHINE_MAPPER</span><span class="p">[</span><span class="n">nativeMachine</span><span class="o">.</span><span class="n">value</span><span class="p">])</span>
+
+
+    <span class="nd">@utils</span><span class="o">.</span><span class="n">fixedproperty</span>
     <span class="k">def</span> <span class="nf">bitness</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
 <span class="w">        </span><span class="sd">&quot;&quot;&quot;The bitness of the process</span>
 
 <span class="sd">        :returns: :class:`int` -- 32 or 64</span>
 <span class="sd">		&quot;&quot;&quot;</span>
-        <span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">system</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">32</span><span class="p">:</span>
-            <span class="k">return</span> <span class="mi">32</span>
-        <span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">is_wow_64</span><span class="p">:</span>
+        <span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">system</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">32</span> <span class="ow">or</span> <span class="bp">self</span><span class="o">.</span><span class="n">is_wow_64</span><span class="p">:</span>
             <span class="k">return</span> <span class="mi">32</span>
         <span class="k">return</span> <span class="mi">64</span>
 
+    <span class="nd">@utils</span><span class="o">.</span><span class="n">fixedproperty</span>
+    <span class="k">def</span> <span class="nf">architecture</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
+        <span class="c1"># Syswow2 will exactly tell us the architecture</span>
+        <span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">is_implemented</span><span class="p">(</span><span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">IsWow64Process2</span><span class="p">):</span>
+            <span class="n">process_machine</span><span class="p">,</span> <span class="n">native_machine</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">is_wow_64_2</span>
+            <span class="k">if</span> <span class="n">process_machine</span> <span class="o">!=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">IMAGE_FILE_MACHINE_UNKNOWN</span><span class="p">:</span>
+                <span class="k">return</span> <span class="n">process_machine</span>
+
+            <span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">system</span><span class="o">.</span><span class="n">architecture</span> <span class="o">==</span> <span class="n">gdef</span><span class="o">.</span><span class="n">PROCESSOR_ARCHITECTURE_ARM64</span><span class="p">:</span>
+                <span class="c1"># May be ARM64 or AMD64 as X64TA64 is not considered WOW64</span>
+                <span class="c1"># ProcessMachineTypeInfo is from build 22000</span>
+                <span class="c1"># What if not implemented ? parse target main binary PE ?</span>
+                <span class="n">machine_archi</span> <span class="o">=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">PROCESS_MACHINE_INFORMATION</span><span class="p">()</span>
+                <span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">GetProcessInformation</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">gdef</span><span class="o">.</span><span class="n">ProcessMachineTypeInfo</span><span class="p">,</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">byref</span><span class="p">(</span><span class="n">machine_archi</span><span class="p">),</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">machine_archi</span><span class="p">))</span>
+                <span class="k">return</span> <span class="n">gdef</span><span class="o">.</span><span class="n">IMAGE_FILE_MACHINE_MAPPER</span><span class="p">[</span><span class="n">machine_archi</span><span class="o">.</span><span class="n">ProcessMachine</span><span class="p">]</span>
+
+        <span class="c1"># No IsWow64Process2 -&gt; No ARM</span>
+        <span class="c1"># So its up on x86 -&gt; x64 based on process bitness</span>
+        <span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">32</span><span class="p">:</span>
+            <span class="k">return</span> <span class="n">gdef</span><span class="o">.</span><span class="n">IMAGE_FILE_MACHINE_I386</span>
+        <span class="k">return</span> <span class="n">gdef</span><span class="o">.</span><span class="n">IMAGE_FILE_MACHINE_AMD64</span>
+
+    <span class="nd">@utils</span><span class="o">.</span><span class="n">fixedproperty</span>
+    <span class="k">def</span> <span class="nf">_is_x86_on_arm64</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
+        <span class="k">return</span> <span class="p">(</span><span class="n">windows</span><span class="o">.</span><span class="n">system</span><span class="o">.</span><span class="n">architecture</span> <span class="o">==</span> <span class="n">gdef</span><span class="o">.</span><span class="n">PROCESSOR_ARCHITECTURE_ARM64</span> <span class="ow">and</span>
+                    <span class="bp">self</span><span class="o">.</span><span class="n">architecture</span> <span class="o">==</span> <span class="n">gdef</span><span class="o">.</span><span class="n">IMAGE_FILE_MACHINE_I386</span><span class="p">)</span>
+
+    <span class="nd">@utils</span><span class="o">.</span><span class="n">fixedproperty</span>
+    <span class="k">def</span> <span class="nf">_is_x86_on_x64</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
+        <span class="k">return</span> <span class="p">(</span><span class="n">windows</span><span class="o">.</span><span class="n">system</span><span class="o">.</span><span class="n">architecture</span> <span class="o">==</span> <span class="n">gdef</span><span class="o">.</span><span class="n">PROCESSOR_ARCHITECTURE_AMD64</span> <span class="ow">and</span>
+                    <span class="bp">self</span><span class="o">.</span><span class="n">architecture</span> <span class="o">==</span> <span class="n">gdef</span><span class="o">.</span><span class="n">IMAGE_FILE_MACHINE_I386</span><span class="p">)</span>
+
+    <span class="nd">@utils</span><span class="o">.</span><span class="n">fixedproperty</span>
+    <span class="k">def</span> <span class="nf">_is_native_architecture</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
+        <span class="k">return</span> <span class="p">((</span><span class="n">windows</span><span class="o">.</span><span class="n">system</span><span class="o">.</span><span class="n">architecture</span> <span class="o">==</span> <span class="n">gdef</span><span class="o">.</span><span class="n">PROCESSOR_ARCHITECTURE_INTEL</span> <span class="ow">and</span>
+                    <span class="bp">self</span><span class="o">.</span><span class="n">architecture</span> <span class="o">==</span> <span class="n">gdef</span><span class="o">.</span><span class="n">IMAGE_FILE_MACHINE_I386</span><span class="p">)</span> <span class="ow">or</span>
+                <span class="p">(</span><span class="n">windows</span><span class="o">.</span><span class="n">system</span><span class="o">.</span><span class="n">architecture</span> <span class="o">==</span> <span class="n">gdef</span><span class="o">.</span><span class="n">PROCESSOR_ARCHITECTURE_AMD64</span> <span class="ow">and</span>
+                    <span class="bp">self</span><span class="o">.</span><span class="n">architecture</span> <span class="o">==</span> <span class="n">gdef</span><span class="o">.</span><span class="n">IMAGE_FILE_MACHINE_AMD64</span><span class="p">)</span> <span class="ow">or</span>
+                <span class="p">(</span><span class="n">windows</span><span class="o">.</span><span class="n">system</span><span class="o">.</span><span class="n">architecture</span> <span class="o">==</span> <span class="n">gdef</span><span class="o">.</span><span class="n">PROCESSOR_ARCHITECTURE_ARM64</span> <span class="ow">and</span>
+                    <span class="bp">self</span><span class="o">.</span><span class="n">architecture</span> <span class="o">==</span> <span class="n">gdef</span><span class="o">.</span><span class="n">IMAGE_FILE_MACHINE_ARM64</span><span class="p">))</span>
+
     <span class="nd">@utils</span><span class="o">.</span><span class="n">fixedpropety</span>
     <span class="k">def</span> <span class="nf">limited_handle</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
         <span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">system</span><span class="o">.</span><span class="n">version</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span> <span class="o">&lt;=</span> <span class="mi">5</span><span class="p">:</span>
@@ -134,14 +190,26 @@
             <span class="k">return</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">OpenProcess</span><span class="p">(</span><span class="n">PROCESS_QUERY_INFORMATION</span><span class="p">,</span> <span class="n">dwProcessId</span><span class="o">=</span><span class="bp">self</span><span class="o">.</span><span class="n">pid</span><span class="p">)</span>
         <span class="k">return</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">OpenProcess</span><span class="p">(</span><span class="n">PROCESS_QUERY_LIMITED_INFORMATION</span><span class="p">,</span> <span class="n">dwProcessId</span><span class="o">=</span><span class="bp">self</span><span class="o">.</span><span class="n">pid</span><span class="p">)</span>
 
+    <span class="nd">@utils</span><span class="o">.</span><span class="n">fixedproperty</span>
+    <span class="k">def</span> <span class="nf">name</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
+<span class="w">        </span><span class="sd">&quot;&quot;&quot;Name of the process</span>
 
-    <span class="nd">@utils</span><span class="o">.</span><span class="n">fixedpropety</span>
+<span class="sd">        :type: :class:`str`</span>
+<span class="sd">		&quot;&quot;&quot;</span>
+        <span class="n">buffer</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">create_unicode_buffer</span><span class="p">(</span><span class="mh">0x1024</span><span class="p">)</span>
+        <span class="n">rsize</span> <span class="o">=</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">GetProcessImageFileNameW</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">limited_handle</span><span class="p">,</span> <span class="n">buffer</span><span class="p">)</span>
+        <span class="c1"># GetProcessImageFileNameW returns the fullpath</span>
+        <span class="k">return</span> <span class="n">buffer</span><span class="p">[:</span><span class="n">rsize</span><span class="p">]</span><span class="o">.</span><span class="n">split</span><span class="p">(</span><span class="s2">&quot;</span><span class="se">\\</span><span class="s2">&quot;</span><span class="p">)[</span><span class="o">-</span><span class="mi">1</span><span class="p">]</span>
+
+    <span class="nd">@utils</span><span class="o">.</span><span class="n">fixedproperty</span>
     <span class="k">def</span> <span class="nf">ppid</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
 <span class="w">        </span><span class="sd">&quot;&quot;&quot;Parent Process ID</span>
 
 <span class="sd">        :type: :class:`int`</span>
 <span class="sd">		&quot;&quot;&quot;</span>
         <span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">32</span> <span class="ow">and</span> <span class="bp">self</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">64</span><span class="p">:</span>
+            <span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">_is_x86_on_arm64</span><span class="p">:</span>
+                <span class="k">raise</span> <span class="ne">NotImplementedError</span><span class="p">(</span><span class="s2">&quot;Crossing heaven gate x86 -&gt; arm64 not implemented&quot;</span><span class="p">)</span>
             <span class="n">xtype</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">remotectypes</span><span class="o">.</span><span class="n">transform_type_to_remote64bits</span><span class="p">(</span><span class="n">PROCESS_BASIC_INFORMATION</span><span class="p">)</span>
             <span class="c1"># Fuck-it &lt;3</span>
             <span class="n">data</span> <span class="o">=</span> <span class="p">(</span><span class="n">ctypes</span><span class="o">.</span><span class="n">c_char</span> <span class="o">*</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">xtype</span><span class="p">))()</span>
@@ -212,6 +280,8 @@
     <span class="k">def</span> <span class="nf">virtual_protect</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">addr</span><span class="p">,</span> <span class="n">size</span><span class="p">,</span> <span class="n">protect</span><span class="p">,</span> <span class="n">old_protect</span><span class="o">=</span><span class="kc">None</span><span class="p">):</span>
 <span class="w">        </span><span class="sd">&quot;&quot;&quot;Change the access right of one or more page of the process&quot;&quot;&quot;</span>
         <span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">32</span> <span class="ow">and</span> <span class="bp">self</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">64</span><span class="p">:</span>
+            <span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">_is_x86_on_arm64</span><span class="p">:</span>
+                <span class="k">raise</span> <span class="ne">NotImplementedError</span><span class="p">(</span><span class="s2">&quot;Crossing heaven gate x86 -&gt; arm64 not implemented&quot;</span><span class="p">)</span>
             <span class="k">if</span> <span class="n">size</span> <span class="o">&amp;</span> <span class="mh">0x0fff</span><span class="p">:</span>
                 <span class="n">size</span> <span class="o">=</span> <span class="p">((</span><span class="n">size</span> <span class="o">&gt;&gt;</span> <span class="mi">12</span><span class="p">)</span> <span class="o">+</span> <span class="mi">1</span><span class="p">)</span> <span class="o">&lt;&lt;</span> <span class="mi">12</span>
             <span class="k">if</span> <span class="n">old_protect</span> <span class="ow">is</span> <span class="kc">None</span><span class="p">:</span>
@@ -242,6 +312,8 @@
 <span class="sd">        :rtype: :class:`~windows.generated_def.winstructs.MEMORY_BASIC_INFORMATION`</span>
 <span class="sd">		&quot;&quot;&quot;</span>
         <span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">32</span> <span class="ow">and</span> <span class="bp">self</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">64</span><span class="p">:</span>
+            <span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">_is_x86_on_arm64</span><span class="p">:</span>
+                <span class="k">raise</span> <span class="ne">NotImplementedError</span><span class="p">(</span><span class="s2">&quot;Crossing heaven gate x86 -&gt; arm64 not implemented&quot;</span><span class="p">)</span>
             <span class="n">res</span> <span class="o">=</span> <span class="n">MEMORY_BASIC_INFORMATION64</span><span class="p">()</span>
             <span class="k">try</span><span class="p">:</span>
                 <span class="n">v</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">syswow64</span><span class="o">.</span><span class="n">NtQueryVirtualMemory_32_to_64</span><span class="p">(</span><span class="n">ProcessHandle</span><span class="o">=</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">BaseAddress</span><span class="o">=</span><span class="n">addr</span><span class="p">,</span> <span class="n">MemoryInformationClass</span><span class="o">=</span><span class="n">MemoryBasicInformation</span><span class="p">,</span> <span class="n">MemoryInformation</span><span class="o">=</span><span class="n">res</span><span class="p">)</span>
@@ -322,6 +394,8 @@
         <span class="k">for</span> <span class="n">i</span><span class="p">,</span> <span class="n">data</span> <span class="ow">in</span> <span class="nb">enumerate</span><span class="p">(</span><span class="n">info_array</span><span class="p">):</span>
             <span class="n">info_array</span><span class="p">[</span><span class="n">i</span><span class="p">]</span><span class="o">.</span><span class="n">VirtualAddress</span> <span class="o">=</span> <span class="n">addresses</span><span class="p">[</span><span class="n">i</span><span class="p">]</span>
         <span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">32</span> <span class="ow">and</span> <span class="bp">self</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">64</span><span class="p">:</span>
+            <span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">_is_x86_on_arm64</span><span class="p">:</span>
+                <span class="k">raise</span> <span class="ne">NotImplementedError</span><span class="p">(</span><span class="s2">&quot;Crossing heaven gate x86 -&gt; arm64 not implemented&quot;</span><span class="p">)</span>
             <span class="n">windows</span><span class="o">.</span><span class="n">syswow64</span><span class="o">.</span><span class="n">NtQueryVirtualMemory_32_to_64</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="mi">0</span><span class="p">,</span> <span class="n">MemoryWorkingSetListEx</span><span class="p">,</span> <span class="n">info_array</span><span class="p">)</span>
         <span class="k">else</span><span class="p">:</span>
             <span class="n">winproxy</span><span class="o">.</span><span class="n">QueryWorkingSetEx</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">byref</span><span class="p">(</span><span class="n">info_array</span><span class="p">),</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">info_array</span><span class="p">))</span>
@@ -552,11 +626,12 @@
         <span class="k">return</span> <span class="p">[</span><span class="n">h</span> <span class="k">for</span> <span class="n">h</span> <span class="ow">in</span> <span class="n">windows</span><span class="o">.</span><span class="n">system</span><span class="o">.</span><span class="n">handles</span> <span class="k">if</span> <span class="n">h</span><span class="o">.</span><span class="n">dwProcessId</span> <span class="o">==</span> <span class="n">pid</span><span class="p">]</span>
 
     <span class="k">def</span> <span class="fm">__del__</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
-        <span class="nb">super</span><span class="p">(</span><span class="n">Process</span><span class="p">,</span> <span class="bp">self</span><span class="p">)</span><span class="o">.</span><span class="fm">__del__</span><span class="p">()</span>
-        <span class="c1"># Same logic that AutoHandle.__del__ for Process.limited_handle</span>
-        <span class="c1"># Assert that Process inherit AutoHandle</span>
         <span class="c1"># sys.path is not None -&gt; check if python shutdown</span>
         <span class="k">if</span> <span class="n">sys</span><span class="o">.</span><span class="n">path</span> <span class="ow">is</span> <span class="ow">not</span> <span class="kc">None</span> <span class="ow">and</span> <span class="nb">hasattr</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="s2">&quot;_limited_handle&quot;</span><span class="p">)</span> <span class="ow">and</span> <span class="bp">self</span><span class="o">.</span><span class="n">_limited_handle</span><span class="p">:</span>
+            <span class="c1"># Same logic that AutoHandle.__del__ for Process.limited_handle</span>
+            <span class="c1"># Assert that Process inherit AutoHandle</span>
+            <span class="c1"># Call super after check as Process could be None during destruction</span>
+            <span class="nb">super</span><span class="p">(</span><span class="n">Process</span><span class="p">,</span> <span class="bp">self</span><span class="p">)</span><span class="o">.</span><span class="fm">__del__</span><span class="p">()</span>
             <span class="c1"># Prevent some bug where dbgprint might be None when __del__ is called in a closing process</span>
             <span class="c1"># This line is bad -&gt; it reopens a handle closed by &#39;super(Process, self).__del__()&#39; ._.</span>
             <span class="n">dbgprint</span><span class="p">(</span><span class="s2">&quot;Closing limited handle </span><span class="si">{0}</span><span class="s2"> for </span><span class="si">{1}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="nb">hex</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">_limited_handle</span><span class="p">),</span> <span class="bp">self</span><span class="p">),</span> <span class="s2">&quot;HANDLE&quot;</span><span class="p">)</span> <span class="k">if</span> <span class="n">dbgprint</span> <span class="ow">is</span> <span class="ow">not</span> <span class="kc">None</span> <span class="k">else</span> <span class="kc">None</span>
@@ -603,7 +678,14 @@
 <a class="viewcode-back" href="../../../process.html#windows.winobject.process.CurrentThread">[docs]</a>
 <span class="k">class</span> <span class="nc">CurrentThread</span><span class="p">(</span><span class="n">Thread</span><span class="p">):</span>
 <span class="w">    </span><span class="sd">&quot;&quot;&quot;The current thread&quot;&quot;&quot;</span>
-    <span class="nd">@property</span> <span class="c1">#It&#39;s not a fixedpropety because executing thread might change</span>
+
+    <span class="n">get_teb_code_by_architecture</span> <span class="o">=</span> <span class="p">{</span>
+        <span class="n">gdef</span><span class="o">.</span><span class="n">IMAGE_FILE_MACHINE_I386</span><span class="p">:</span> <span class="n">x86</span><span class="o">.</span><span class="n">assemble</span><span class="p">(</span><span class="s2">&quot;mov eax, fs:[0x18]; ret&quot;</span><span class="p">),</span>
+        <span class="n">gdef</span><span class="o">.</span><span class="n">IMAGE_FILE_MACHINE_AMD64</span><span class="p">:</span> <span class="n">x64</span><span class="o">.</span><span class="n">assemble</span><span class="p">(</span><span class="s2">&quot;mov rax, gs:[0x30]; ret&quot;</span><span class="p">),</span>
+        <span class="n">gdef</span><span class="o">.</span><span class="n">IMAGE_FILE_MACHINE_ARM64</span><span class="p">:</span> <span class="n">arm64</span><span class="o">.</span><span class="n">assemble</span><span class="p">(</span><span class="s2">&quot;mov x0, x18; ret&quot;</span><span class="p">)</span>
+    <span class="p">}</span>
+
+    <span class="nd">@property</span> <span class="c1">#It&#39;s not a fixedproperty because executing thread might change</span>
     <span class="k">def</span> <span class="nf">tid</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
 <span class="w">        </span><span class="sd">&quot;&quot;&quot;Thread ID</span>
 
@@ -611,6 +693,15 @@
 <span class="sd">		&quot;&quot;&quot;</span>
         <span class="k">return</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">GetCurrentThreadId</span><span class="p">()</span>
 
+    <span class="nd">@property</span> <span class="c1">#It&#39;s not a fixedproperty because executing thread might change</span>
+    <span class="k">def</span> <span class="nf">teb_base</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
+        <span class="n">get_teb_base_code</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">get_teb_code_by_architecture</span><span class="p">[</span><span class="bp">self</span><span class="o">.</span><span class="n">owner</span><span class="o">.</span><span class="n">architecture</span><span class="p">]</span>
+        <span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">owner</span><span class="o">.</span><span class="n">execute</span><span class="p">(</span><span class="n">get_teb_base_code</span><span class="p">)</span>
+
+    <span class="nd">@property</span>
+    <span class="k">def</span> <span class="nf">teb</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
+        <span class="k">return</span> <span class="n">TEB</span><span class="o">.</span><span class="n">from_address</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">teb_base</span><span class="p">)</span>
+
     <span class="nd">@property</span>
     <span class="k">def</span> <span class="nf">owner</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
 <span class="w">        </span><span class="sd">&quot;&quot;&quot;The current process</span>
@@ -632,8 +723,6 @@
         <span class="k">return</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">ExitThread</span><span class="p">(</span><span class="n">code</span><span class="p">)</span></div>
 
 
-
-
 <div class="viewcode-block" id="CurrentThread.wait">
 <a class="viewcode-back" href="../../../process.html#windows.winobject.process.CurrentThread.wait">[docs]</a>
     <span class="k">def</span> <span class="nf">wait</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">timeout</span><span class="o">=</span><span class="n">INFINITE</span><span class="p">):</span>
@@ -647,37 +736,12 @@
 <a class="viewcode-back" href="../../../process.html#windows.winobject.process.CurrentProcess">[docs]</a>
 <span class="k">class</span> <span class="nc">CurrentProcess</span><span class="p">(</span><span class="n">Process</span><span class="p">):</span>
 <span class="w">    </span><span class="sd">&quot;&quot;&quot;The current process&quot;&quot;&quot;</span>
-    <span class="n">get_peb</span> <span class="o">=</span> <span class="kc">None</span>
-
-    <span class="n">get_peb_32_code</span> <span class="o">=</span> <span class="n">x86</span><span class="o">.</span><span class="n">MultipleInstr</span><span class="p">()</span>
-    <span class="n">get_peb_32_code</span> <span class="o">+=</span> <span class="n">x86</span><span class="o">.</span><span class="n">Mov</span><span class="p">(</span><span class="s1">&#39;EAX&#39;</span><span class="p">,</span> <span class="n">x86</span><span class="o">.</span><span class="n">mem</span><span class="p">(</span><span class="s1">&#39;fs:[0x30]&#39;</span><span class="p">))</span>
-    <span class="n">get_peb_32_code</span> <span class="o">+=</span> <span class="n">x86</span><span class="o">.</span><span class="n">Ret</span><span class="p">()</span>
-    <span class="n">get_peb_32_code</span> <span class="o">=</span> <span class="n">get_peb_32_code</span><span class="o">.</span><span class="n">get_code</span><span class="p">()</span>
-
-    <span class="n">get_peb_64_code</span> <span class="o">=</span> <span class="n">x64</span><span class="o">.</span><span class="n">MultipleInstr</span><span class="p">()</span>
-    <span class="n">get_peb_64_code</span> <span class="o">+=</span> <span class="n">x64</span><span class="o">.</span><span class="n">Mov</span><span class="p">(</span><span class="s1">&#39;RAX&#39;</span><span class="p">,</span> <span class="n">x64</span><span class="o">.</span><span class="n">mem</span><span class="p">(</span><span class="s1">&#39;gs:[0x60]&#39;</span><span class="p">))</span>
-    <span class="n">get_peb_64_code</span> <span class="o">+=</span> <span class="n">x64</span><span class="o">.</span><span class="n">Ret</span><span class="p">()</span>
-    <span class="n">get_peb_64_code</span> <span class="o">=</span> <span class="n">get_peb_64_code</span><span class="o">.</span><span class="n">get_code</span><span class="p">()</span>
-
     <span class="n">allocator</span> <span class="o">=</span> <span class="n">native_exec</span><span class="o">.</span><span class="n">native_function</span><span class="o">.</span><span class="n">allocator</span>
 
-    <span class="n">name</span> <span class="o">=</span> <span class="s2">&quot;CurrentProcess&quot;</span> <span class="c1"># Used by Winthread for __repr__</span>
-
-    <span class="c1"># Use RtlGetCurrentPeb ?</span>
-    <span class="k">def</span> <span class="nf">get_peb_builtin</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
-        <span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">get_peb</span> <span class="ow">is</span> <span class="ow">not</span> <span class="kc">None</span><span class="p">:</span>
-            <span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">get_peb</span>
-        <span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">32</span><span class="p">:</span>
-            <span class="n">get_peb</span> <span class="o">=</span> <span class="n">native_exec</span><span class="o">.</span><span class="n">create_function</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">get_peb_32_code</span><span class="p">,</span> <span class="p">[</span><span class="n">PVOID</span><span class="p">])</span>
-        <span class="k">else</span><span class="p">:</span>
-            <span class="n">get_peb</span> <span class="o">=</span> <span class="n">native_exec</span><span class="o">.</span><span class="n">create_function</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">get_peb_64_code</span><span class="p">,</span> <span class="p">[</span><span class="n">PVOID</span><span class="p">])</span>
-        <span class="bp">self</span><span class="o">.</span><span class="n">get_peb</span> <span class="o">=</span> <span class="n">get_peb</span>
-        <span class="k">return</span> <span class="n">get_peb</span>
-
     <span class="k">def</span> <span class="nf">_get_handle</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
         <span class="k">return</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">GetCurrentProcess</span><span class="p">()</span>
 
-    <span class="nd">@utils</span><span class="o">.</span><span class="n">fixedpropety</span>
+    <span class="nd">@utils</span><span class="o">.</span><span class="n">fixedproperty</span>
     <span class="k">def</span> <span class="nf">limited_handle</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
         <span class="k">return</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">GetCurrentProcess</span><span class="p">()</span>
 
@@ -693,33 +757,32 @@
 <span class="sd">		&quot;&quot;&quot;</span>
         <span class="k">return</span> <span class="n">os</span><span class="o">.</span><span class="n">getpid</span><span class="p">()</span>
 
-    <span class="nd">@utils</span><span class="o">.</span><span class="n">fixedpropety</span> <span class="c1"># leave it has fixed property as we don&#39;t care if CurrentProcess is never collected</span>
+    <span class="nd">@utils</span><span class="o">.</span><span class="n">fixedproperty</span> <span class="c1"># leave it has fixed property as we don&#39;t care if CurrentProcess is never collected</span>
     <span class="k">def</span> <span class="nf">peb</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
 <span class="w">        </span><span class="sd">&quot;&quot;&quot;The Process Environment Block of the current process</span>
 
 <span class="sd">        :type: :class:`PEB`</span>
 <span class="sd">		&quot;&quot;&quot;</span>
-        <span class="k">return</span> <span class="n">PEB</span><span class="o">.</span><span class="n">from_address</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">get_peb_builtin</span><span class="p">()())</span>
+        <span class="k">return</span> <span class="n">PEB</span><span class="o">.</span><span class="n">from_address</span><span class="p">(</span><span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">RtlGetCurrentPeb</span><span class="p">())</span>
 
-    <span class="nd">@utils</span><span class="o">.</span><span class="n">fixedpropety</span>
+    <span class="nd">@utils</span><span class="o">.</span><span class="n">fixedproperty</span>
     <span class="k">def</span> <span class="nf">bitness</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
 <span class="w">        </span><span class="sd">&quot;&quot;&quot;The bitness of the process</span>
 
 <span class="sd">        :type: :class:`int` -- 32 or 64</span>
 <span class="sd">		&quot;&quot;&quot;</span>
-        <span class="kn">import</span> <span class="nn">platform</span>
-        <span class="n">bits</span> <span class="o">=</span> <span class="n">platform</span><span class="o">.</span><span class="n">architecture</span><span class="p">()[</span><span class="mi">0</span><span class="p">]</span>
-        <span class="k">return</span> <span class="nb">int</span><span class="p">(</span><span class="n">bits</span><span class="p">[:</span><span class="mi">2</span><span class="p">])</span>
+        <span class="k">return</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">gdef</span><span class="o">.</span><span class="n">PVOID</span><span class="p">)</span> <span class="o">*</span> <span class="mi">8</span> <span class="c1"># byte to bits</span>
+
 
 <div class="viewcode-block" id="CurrentProcess.virtual_alloc">
 <a class="viewcode-back" href="../../../process.html#windows.winobject.process.CurrentProcess.virtual_alloc">[docs]</a>
-    <span class="k">def</span> <span class="nf">virtual_alloc</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">size</span><span class="p">,</span> <span class="n">prot</span><span class="o">=</span><span class="n">PAGE_EXECUTE_READWRITE</span><span class="p">):</span>
+    <span class="k">def</span> <span class="nf">virtual_alloc</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">size</span><span class="p">,</span> <span class="n">prot</span><span class="o">=</span><span class="n">PAGE_EXECUTE_READWRITE</span><span class="p">,</span> <span class="n">addr</span><span class="o">=</span><span class="kc">None</span><span class="p">,</span> <span class="nb">type</span><span class="o">=</span><span class="n">gdef</span><span class="o">.</span><span class="n">MEM_COMMIT</span><span class="p">):</span>
 <span class="w">        </span><span class="sd">&quot;&quot;&quot;Allocate memory in the process</span>
 
 <span class="sd">        :return: The address of the allocated memory</span>
 <span class="sd">        :rtype: :class:`int`</span>
 <span class="sd">		&quot;&quot;&quot;</span>
-        <span class="k">return</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">VirtualAlloc</span><span class="p">(</span><span class="n">dwSize</span><span class="o">=</span><span class="n">size</span><span class="p">,</span> <span class="n">flProtect</span><span class="o">=</span><span class="n">prot</span><span class="p">)</span></div>
+        <span class="k">return</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">VirtualAlloc</span><span class="p">(</span><span class="n">lpAddress</span><span class="o">=</span><span class="n">addr</span><span class="p">,</span> <span class="n">dwSize</span><span class="o">=</span><span class="n">size</span><span class="p">,</span> <span class="n">flAllocationType</span><span class="o">=</span><span class="nb">type</span><span class="p">,</span> <span class="n">flProtect</span><span class="o">=</span><span class="n">prot</span><span class="p">)</span></div>
 
 
 <div class="viewcode-block" id="CurrentProcess.virtual_free">
@@ -798,7 +861,7 @@
         <span class="k">raise</span> <span class="ne">ValueError</span><span class="p">(</span><span class="s2">&quot;wait() on current thread&quot;</span><span class="p">)</span></div>
 
 
-    <span class="nd">@utils</span><span class="o">.</span><span class="n">fixedpropety</span>
+    <span class="nd">@utils</span><span class="o">.</span><span class="n">fixedproperty</span>
     <span class="k">def</span> <span class="nf">peb_syswow</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
 <span class="w">        </span><span class="sd">&quot;&quot;&quot;The 64bits PEB of a SysWow64 process</span>
 
@@ -806,6 +869,8 @@
 <span class="sd">		&quot;&quot;&quot;</span>
         <span class="k">if</span> <span class="ow">not</span> <span class="bp">self</span><span class="o">.</span><span class="n">is_wow_64</span><span class="p">:</span>
             <span class="k">raise</span> <span class="ne">ValueError</span><span class="p">(</span><span class="s2">&quot;Not a syswow process&quot;</span><span class="p">)</span>
+        <span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">_is_x86_on_arm64</span><span class="p">:</span>
+            <span class="k">raise</span> <span class="ne">NotImplementedError</span><span class="p">(</span><span class="s2">&quot;Crossing heaven gate x86 -&gt; arm64 not implemented&quot;</span><span class="p">)</span>
         <span class="k">return</span> <span class="n">windows</span><span class="o">.</span><span class="n">syswow64</span><span class="o">.</span><span class="n">get_current_process_syswow_peb</span><span class="p">()</span>
 
     <span class="c1"># TODO: use ctypes.string_at / ctypes.wstring_at for read_string / read_wstring ?</span>
@@ -850,21 +915,21 @@
         <span class="c1"># Create a DeadThread if thread is already dead ?</span>
         <span class="k">return</span> <span class="n">WinThread</span><span class="p">(</span><span class="n">handle</span><span class="o">=</span><span class="n">handle</span><span class="p">)</span>
 
-    <span class="nd">@utils</span><span class="o">.</span><span class="n">fixedpropety</span>
+    <span class="nd">@utils</span><span class="o">.</span><span class="n">fixedproperty</span>
     <span class="k">def</span> <span class="nf">tid</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
 <span class="w">        </span><span class="sd">&quot;&quot;&quot;Thread ID</span>
 
 <span class="sd">        :type: :class:`int`&quot;&quot;&quot;</span>
         <span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">_get_thread_id</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">)</span>
 
-    <span class="nd">@utils</span><span class="o">.</span><span class="n">fixedpropety</span>
+    <span class="nd">@utils</span><span class="o">.</span><span class="n">fixedproperty</span>
     <span class="k">def</span> <span class="nf">owner_pid</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
         <span class="n">res</span> <span class="o">=</span> <span class="n">THREAD_BASIC_INFORMATION</span><span class="p">()</span>
         <span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">NtQueryInformationThread</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">ThreadBasicInformation</span><span class="p">,</span> <span class="n">byref</span><span class="p">(</span><span class="n">res</span><span class="p">),</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">res</span><span class="p">))</span>
         <span class="n">owner_id</span> <span class="o">=</span> <span class="n">res</span><span class="o">.</span><span class="n">ClientId</span><span class="o">.</span><span class="n">UniqueProcess</span>
         <span class="k">return</span> <span class="n">owner_id</span>
 
-    <span class="nd">@utils</span><span class="o">.</span><span class="n">fixedpropety</span>
+    <span class="nd">@utils</span><span class="o">.</span><span class="n">fixedproperty</span>
     <span class="k">def</span> <span class="nf">owner</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
 <span class="w">        </span><span class="sd">&quot;&quot;&quot;The Process owning the thread</span>
 
@@ -947,6 +1012,8 @@
 <span class="sd">            :type: :class:`int`</span>
 <span class="sd">		&quot;&quot;&quot;</span>
         <span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">32</span> <span class="ow">and</span> <span class="bp">self</span><span class="o">.</span><span class="n">owner</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">64</span><span class="p">:</span>
+            <span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">_is_x86_on_arm64</span><span class="p">:</span>
+                <span class="k">raise</span> <span class="ne">NotImplementedError</span><span class="p">(</span><span class="s2">&quot;Crossing heaven gate x86 -&gt; arm64 not implemented&quot;</span><span class="p">)</span>
             <span class="n">res</span> <span class="o">=</span> <span class="n">ULONGLONG</span><span class="p">()</span>
             <span class="n">windows</span><span class="o">.</span><span class="n">syswow64</span><span class="o">.</span><span class="n">NtQueryInformationThread_32_to_64</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">ThreadQuerySetWin32StartAddress</span><span class="p">,</span> <span class="n">byref</span><span class="p">(</span><span class="n">res</span><span class="p">),</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">res</span><span class="p">))</span>
             <span class="k">return</span> <span class="n">res</span><span class="o">.</span><span class="n">value</span>
@@ -966,6 +1033,9 @@
         <span class="c1"># - Want the TEB of a 64b process</span>
         <span class="c1"># - Want the TEB64 of a Wowprocess</span>
         <span class="c1"># It&#39;s the same code for both</span>
+        <span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">_is_x86_on_arm64</span><span class="p">:</span>
+            <span class="k">raise</span> <span class="ne">NotImplementedError</span><span class="p">(</span><span class="s2">&quot;Crossing heaven gate x86 -&gt; arm64 not implemented&quot;</span><span class="p">)</span>
+
         <span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">is_wow_64</span><span class="p">:</span>
             <span class="n">restype</span> <span class="o">=</span> <span class="n">rctypes</span><span class="o">.</span><span class="n">transform_type_to_remote64bits</span><span class="p">(</span><span class="n">THREAD_BASIC_INFORMATION</span><span class="p">)</span>
             <span class="n">ressize</span> <span class="o">=</span> <span class="p">(</span><span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">restype</span><span class="p">))</span>
@@ -995,7 +1065,11 @@
         <span class="c1"># TebBase-&gt;NtTib.ExceptionList = (PVOID)Teb32Base;</span>
         <span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">owner</span><span class="o">.</span><span class="n">read_dword</span><span class="p">(</span><span class="n">main_teb_addr</span><span class="p">)</span>
 
-
+    <span class="nd">@property</span>
+    <span class="k">def</span> <span class="nf">teb</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
+        <span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">owner</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">32</span><span class="p">:</span>
+            <span class="k">return</span> <span class="n">RemoteTEB32</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">teb_base</span><span class="p">,</span> <span class="n">target</span><span class="o">=</span><span class="bp">self</span><span class="o">.</span><span class="n">owner</span><span class="p">)</span>
+        <span class="k">return</span> <span class="n">RemoteTEB64</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">teb_base</span><span class="p">,</span> <span class="n">target</span><span class="o">=</span><span class="bp">self</span><span class="o">.</span><span class="n">owner</span><span class="p">)</span>
 
     <span class="nd">@property</span>
     <span class="k">def</span> <span class="nf">teb_syswow_base</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
@@ -1008,6 +1082,12 @@
         <span class="c1"># just return the main TEB</span>
         <span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">_get_principal_teb_addr</span><span class="p">()</span>
 
+    <span class="nd">@property</span>
+    <span class="k">def</span> <span class="nf">teb_syswow</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
+        <span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">64</span><span class="p">:</span>
+            <span class="k">return</span> <span class="n">RemoteTEB64</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">teb_syswow_base</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">owner</span><span class="p">)</span>
+        <span class="k">else</span><span class="p">:</span> <span class="c1">#current is 32bits</span>
+            <span class="k">return</span> <span class="n">RemoteTEB64</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">teb_syswow_base</span><span class="p">,</span> <span class="n">windows</span><span class="o">.</span><span class="n">syswow64</span><span class="o">.</span><span class="n">ReadSyswow64Process</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">owner</span><span class="p">))</span>
 
 <div class="viewcode-block" id="WinThread.exit">
 <a class="viewcode-back" href="../../../process.html#windows.winobject.process.WinThread.exit">[docs]</a>
@@ -1069,8 +1149,6 @@
 
     <span class="nd">@staticmethod</span>
     <span class="k">def</span> <span class="nf">_get_thread_id_manual</span><span class="p">(</span><span class="n">handle</span><span class="p">):</span>
-        <span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">32</span> <span class="ow">and</span> <span class="bp">self</span><span class="o">.</span><span class="n">owner</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">64</span><span class="p">:</span>
-            <span class="k">raise</span> <span class="ne">NotImplementedError</span><span class="p">(</span><span class="s2">&quot;[_get_thread_id_manual] 32 -&gt; 64 (XP64 bits + Syswow process ?)&quot;</span><span class="p">)</span>
         <span class="n">res</span> <span class="o">=</span> <span class="n">THREAD_BASIC_INFORMATION</span><span class="p">()</span>
         <span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">NtQueryInformationThread</span><span class="p">(</span><span class="n">handle</span><span class="p">,</span> <span class="n">ThreadBasicInformation</span><span class="p">,</span> <span class="n">byref</span><span class="p">(</span><span class="n">res</span><span class="p">),</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">res</span><span class="p">))</span>
         <span class="n">id2</span> <span class="o">=</span> <span class="n">res</span><span class="o">.</span><span class="n">ClientId</span><span class="o">.</span><span class="n">UniqueThread</span>
@@ -1113,18 +1191,7 @@
         <span class="k">return</span> <span class="bp">cls</span><span class="p">(</span><span class="n">pid</span><span class="o">=</span><span class="n">pid</span><span class="p">,</span> <span class="n">name</span><span class="o">=</span><span class="n">name</span><span class="p">,</span> <span class="n">ppid</span><span class="o">=</span><span class="n">ppid</span><span class="p">)</span>
 
 
-    <span class="nd">@utils</span><span class="o">.</span><span class="n">fixedpropety</span>
-    <span class="k">def</span> <span class="nf">name</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
-<span class="w">        </span><span class="sd">&quot;&quot;&quot;Name of the process</span>
-
-<span class="sd">        :type: :class:`str`</span>
-<span class="sd">		&quot;&quot;&quot;</span>
-        <span class="n">buffer</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">create_unicode_buffer</span><span class="p">(</span><span class="mh">0x1024</span><span class="p">)</span>
-        <span class="n">rsize</span> <span class="o">=</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">GetProcessImageFileNameW</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">limited_handle</span><span class="p">,</span> <span class="n">buffer</span><span class="p">)</span>
-        <span class="c1"># GetProcessImageFileNameW returns the fullpath</span>
-        <span class="k">return</span> <span class="n">buffer</span><span class="p">[:</span><span class="n">rsize</span><span class="p">]</span><span class="o">.</span><span class="n">split</span><span class="p">(</span><span class="s2">&quot;</span><span class="se">\\</span><span class="s2">&quot;</span><span class="p">)[</span><span class="o">-</span><span class="mi">1</span><span class="p">]</span>
-
-    <span class="nd">@utils</span><span class="o">.</span><span class="n">fixedpropety</span>
+    <span class="nd">@utils</span><span class="o">.</span><span class="n">fixedproperty</span>
     <span class="k">def</span> <span class="nf">pid</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
 <span class="w">        </span><span class="sd">&quot;&quot;&quot;Process ID</span>
 
@@ -1149,13 +1216,13 @@
 
 <div class="viewcode-block" id="WinProcess.virtual_alloc">
 <a class="viewcode-back" href="../../../process.html#windows.winobject.process.WinProcess.virtual_alloc">[docs]</a>
-    <span class="k">def</span> <span class="nf">virtual_alloc</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">size</span><span class="p">,</span> <span class="n">prot</span><span class="o">=</span><span class="n">PAGE_EXECUTE_READWRITE</span><span class="p">,</span> <span class="n">addr</span><span class="o">=</span><span class="kc">None</span><span class="p">):</span>
+    <span class="k">def</span> <span class="nf">virtual_alloc</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">size</span><span class="p">,</span> <span class="n">prot</span><span class="o">=</span><span class="n">PAGE_EXECUTE_READWRITE</span><span class="p">,</span> <span class="n">addr</span><span class="o">=</span><span class="kc">None</span><span class="p">,</span> <span class="nb">type</span><span class="o">=</span><span class="n">gdef</span><span class="o">.</span><span class="n">MEM_COMMIT</span><span class="p">):</span>
 <span class="w">        </span><span class="sd">&quot;&quot;&quot;Allocate memory in the process</span>
 
 <span class="sd">        :return: The address of the allocated memory</span>
 <span class="sd">        :rtype: :class:`int`</span>
 <span class="sd">		&quot;&quot;&quot;</span>
-        <span class="k">return</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">VirtualAllocEx</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">lpAddress</span><span class="o">=</span><span class="n">addr</span><span class="p">,</span> <span class="n">dwSize</span><span class="o">=</span><span class="n">size</span><span class="p">,</span> <span class="n">flProtect</span><span class="o">=</span><span class="n">prot</span><span class="p">)</span></div>
+        <span class="k">return</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">VirtualAllocEx</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">lpAddress</span><span class="o">=</span><span class="n">addr</span><span class="p">,</span> <span class="n">dwSize</span><span class="o">=</span><span class="n">size</span><span class="p">,</span> <span class="n">flAllocationType</span><span class="o">=</span><span class="nb">type</span><span class="p">,</span> <span class="n">flProtect</span><span class="o">=</span><span class="n">prot</span><span class="p">)</span></div>
 
 
 <div class="viewcode-block" id="WinProcess.virtual_free">
@@ -1236,11 +1303,16 @@
 
 <span class="sd">            :rtype: :class:`WinThread` or :class:`DeadThread`</span>
 <span class="sd">		&quot;&quot;&quot;</span>
+        <span class="c1"># We are using NtCreateThreadEx as  its more permissive about cross-bitness / cross-architecture</span>
+        <span class="c1"># And we can asume we known what we are doing -&gt; So no safeguard ;)</span>
+        <span class="n">thread_handle</span> <span class="o">=</span> <span class="n">HANDLE</span><span class="p">()</span>
         <span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">32</span> <span class="ow">and</span> <span class="bp">self</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">64</span><span class="p">:</span>
-            <span class="n">thread_handle</span> <span class="o">=</span> <span class="n">HANDLE</span><span class="p">()</span>
+            <span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">_is_x86_on_arm64</span><span class="p">:</span>
+                <span class="k">raise</span> <span class="ne">NotImplementedError</span><span class="p">(</span><span class="s2">&quot;Crossing heaven gate x86 -&gt; arm64 not implemented&quot;</span><span class="p">)</span>
             <span class="n">windows</span><span class="o">.</span><span class="n">syswow64</span><span class="o">.</span><span class="n">NtCreateThreadEx_32_to_64</span><span class="p">(</span><span class="n">ThreadHandle</span><span class="o">=</span><span class="n">byref</span><span class="p">(</span><span class="n">thread_handle</span><span class="p">)</span> <span class="p">,</span><span class="n">ProcessHandle</span><span class="o">=</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">lpStartAddress</span><span class="o">=</span><span class="n">addr</span><span class="p">,</span> <span class="n">lpParameter</span><span class="o">=</span><span class="n">param</span><span class="p">)</span>
-            <span class="k">return</span> <span class="n">WinThread</span><span class="o">.</span><span class="n">_from_handle</span><span class="p">(</span><span class="n">thread_handle</span><span class="o">.</span><span class="n">value</span><span class="p">)</span>
-        <span class="k">return</span> <span class="n">WinThread</span><span class="o">.</span><span class="n">_from_handle</span><span class="p">(</span><span class="n">winproxy</span><span class="o">.</span><span class="n">CreateRemoteThread</span><span class="p">(</span><span class="n">hProcess</span><span class="o">=</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">lpStartAddress</span><span class="o">=</span><span class="n">addr</span><span class="p">,</span> <span class="n">lpParameter</span><span class="o">=</span><span class="n">param</span><span class="p">))</span></div>
+        <span class="k">else</span><span class="p">:</span>
+            <span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">NtCreateThreadEx</span><span class="p">(</span><span class="n">ThreadHandle</span><span class="o">=</span><span class="n">byref</span><span class="p">(</span><span class="n">thread_handle</span><span class="p">)</span> <span class="p">,</span><span class="n">ProcessHandle</span><span class="o">=</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">lpStartAddress</span><span class="o">=</span><span class="n">addr</span><span class="p">,</span> <span class="n">lpParameter</span><span class="o">=</span><span class="n">param</span><span class="p">)</span>
+        <span class="k">return</span> <span class="n">WinThread</span><span class="o">.</span><span class="n">_from_handle</span><span class="p">(</span><span class="n">thread_handle</span><span class="o">.</span><span class="n">value</span><span class="p">)</span></div>
 
 
 <div class="viewcode-block" id="WinProcess.load_library">
@@ -1257,55 +1329,62 @@
 <div class="viewcode-block" id="WinProcess.execute_python">
 <a class="viewcode-back" href="../../../process.html#windows.winobject.process.WinProcess.execute_python">[docs]</a>
     <span class="k">def</span> <span class="nf">execute_python</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">pycode</span><span class="p">):</span>
-<span class="w">        </span><span class="sd">&quot;&quot;&quot;Execute Python code into the remote process.</span>
+<span class="w">        </span><span class="sd">&quot;&quot;&quot;Execute Python code in the remote process.</span>
 
 <span class="sd">        This function waits for the remote process to end and</span>
 <span class="sd">        raises an exception if the remote thread raised one</span>
-<span class="sd">		&quot;&quot;&quot;</span>
+
+<span class="sd">        .. note::</span>
+<span class="sd">            This method is incompatible with Microsoft Store builds of python, as the interpreter DLLs do not grant execute to Users.</span>
+<span class="sd">            See workaround:  https://hakril.github.io/PythonForWindows/build/html/sample.html#microsoft-store-python-injection</span>
+<span class="sd">        &quot;&quot;&quot;</span>
         <span class="k">return</span> <span class="n">injection</span><span class="o">.</span><span class="n">safe_execute_python</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">pycode</span><span class="p">)</span></div>
 
 
 <div class="viewcode-block" id="WinProcess.execute_python_unsafe">
 <a class="viewcode-back" href="../../../process.html#windows.winobject.process.WinProcess.execute_python_unsafe">[docs]</a>
     <span class="k">def</span> <span class="nf">execute_python_unsafe</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">pycode</span><span class="p">):</span>
-<span class="w">        </span><span class="sd">&quot;&quot;&quot;Execute Python code into the remote process.</span>
+<span class="w">        </span><span class="sd">&quot;&quot;&quot;Execute Python code in the remote process.</span>
 
 <span class="sd">        :rtype: :rtype: :class:`WinThread` or :class:`DeadThread` : The thread executing the python code</span>
+
+<span class="sd">        .. note::</span>
+<span class="sd">            This method is incompatible with Microsoft Store builds of python, as the interpreter DLLs do not grant execute to Users.</span>
+<span class="sd">            See workaround:  https://hakril.github.io/PythonForWindows/build/html/sample.html#microsoft-store-python-injection</span>
 <span class="sd">        &quot;&quot;&quot;</span>
         <span class="k">return</span> <span class="n">injection</span><span class="o">.</span><span class="n">execute_python_code</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">pycode</span><span class="p">)</span></div>
 
 
 
-
-
-    <span class="nd">@utils</span><span class="o">.</span><span class="n">fixedpropety</span>
+    <span class="nd">@utils</span><span class="o">.</span><span class="n">fixedproperty</span>
     <span class="k">def</span> <span class="nf">peb_addr</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
-<span class="w">        </span><span class="sd">&quot;&quot;&quot;The address of the PEB</span>
+<span class="w">        </span><span class="sd">&quot;&quot;&quot;The address of the PEB.</span>
 
 <span class="sd">            :type: :class:`int`</span>
 <span class="sd">		&quot;&quot;&quot;</span>
-        <span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">32</span> <span class="ow">and</span> <span class="bp">self</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">64</span><span class="p">:</span>
+        <span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">_is_x86_on_arm64</span> <span class="ow">and</span> <span class="ow">not</span> <span class="bp">self</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">32</span><span class="p">:</span>
+            <span class="k">raise</span> <span class="ne">NotImplementedError</span><span class="p">(</span><span class="s2">&quot;Crossing heaven gate x86 -&gt; arm64 not implemented&quot;</span><span class="p">)</span>
+
+        <span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">32</span> <span class="ow">and</span> <span class="bp">self</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">64</span><span class="p">:</span> <span class="c1"># Intel to Intel</span>
             <span class="n">x</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">remotectypes</span><span class="o">.</span><span class="n">transform_type_to_remote64bits</span><span class="p">(</span><span class="n">PROCESS_BASIC_INFORMATION</span><span class="p">)</span>
             <span class="c1"># Fuck-it &lt;3</span>
             <span class="n">data</span> <span class="o">=</span> <span class="p">(</span><span class="n">ctypes</span><span class="o">.</span><span class="n">c_char</span> <span class="o">*</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">x</span><span class="p">))()</span>
-            <span class="n">windows</span><span class="o">.</span><span class="n">syswow64</span><span class="o">.</span><span class="n">NtQueryInformationProcess_32_to_64</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">ProcessInformation</span><span class="o">=</span><span class="n">data</span><span class="p">,</span> <span class="n">ProcessInformationLength</span><span class="o">=</span><span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">x</span><span class="p">))</span>
+            <span class="n">windows</span><span class="o">.</span><span class="n">syswow64</span><span class="o">.</span><span class="n">NtQueryInformationProcess_32_to_64</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">gdef</span><span class="o">.</span><span class="n">ProcessBasicInformation</span><span class="p">,</span> <span class="n">ProcessInformation</span><span class="o">=</span><span class="n">data</span><span class="p">)</span>
             <span class="n">peb_offset</span> <span class="o">=</span> <span class="n">x</span><span class="o">.</span><span class="n">PebBaseAddress</span><span class="o">.</span><span class="n">offset</span>
             <span class="n">peb_addr</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">unpack</span><span class="p">(</span><span class="s2">&quot;&lt;Q&quot;</span><span class="p">,</span> <span class="n">data</span><span class="p">[</span><span class="n">x</span><span class="o">.</span><span class="n">PebBaseAddress</span><span class="o">.</span><span class="n">offset</span><span class="p">:</span> <span class="n">x</span><span class="o">.</span><span class="n">PebBaseAddress</span><span class="o">.</span><span class="n">offset</span><span class="o">+</span><span class="mi">8</span><span class="p">])[</span><span class="mi">0</span><span class="p">]</span>
         <span class="k">elif</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">64</span> <span class="ow">and</span> <span class="bp">self</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">32</span><span class="p">:</span>
-            <span class="n">information_type</span> <span class="o">=</span> <span class="mi">26</span>
             <span class="n">y</span> <span class="o">=</span> <span class="n">ULONGLONG</span><span class="p">()</span>
-            <span class="n">winproxy</span><span class="o">.</span><span class="n">NtQueryInformationProcess</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">information_type</span><span class="p">,</span> <span class="n">byref</span><span class="p">(</span><span class="n">y</span><span class="p">),</span> <span class="n">sizeof</span><span class="p">(</span><span class="n">y</span><span class="p">))</span>
+            <span class="n">winproxy</span><span class="o">.</span><span class="n">NtQueryInformationProcess</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">gdef</span><span class="o">.</span><span class="n">ProcessWow64Information</span><span class="p">,</span> <span class="n">byref</span><span class="p">(</span><span class="n">y</span><span class="p">),</span> <span class="n">sizeof</span><span class="p">(</span><span class="n">y</span><span class="p">))</span>
             <span class="n">peb_addr</span> <span class="o">=</span> <span class="n">y</span><span class="o">.</span><span class="n">value</span>
         <span class="k">else</span><span class="p">:</span>
-            <span class="n">information_type</span> <span class="o">=</span> <span class="mi">0</span>
             <span class="n">x</span> <span class="o">=</span> <span class="n">PROCESS_BASIC_INFORMATION</span><span class="p">()</span>
-            <span class="n">winproxy</span><span class="o">.</span><span class="n">NtQueryInformationProcess</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">information_type</span><span class="p">,</span> <span class="n">x</span><span class="p">)</span>
+            <span class="n">winproxy</span><span class="o">.</span><span class="n">NtQueryInformationProcess</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">gdef</span><span class="o">.</span><span class="n">ProcessBasicInformation</span><span class="p">,</span> <span class="n">x</span><span class="p">)</span>
             <span class="n">peb_addr</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">cast</span><span class="p">(</span><span class="n">x</span><span class="o">.</span><span class="n">PebBaseAddress</span><span class="p">,</span> <span class="n">PVOID</span><span class="p">)</span><span class="o">.</span><span class="n">value</span>
         <span class="k">if</span> <span class="n">peb_addr</span> <span class="ow">is</span> <span class="kc">None</span><span class="p">:</span>
             <span class="k">raise</span> <span class="ne">ValueError</span><span class="p">(</span><span class="s2">&quot;Could not get peb addr of process </span><span class="si">{0}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">name</span><span class="p">))</span>
         <span class="k">return</span> <span class="n">peb_addr</span>
 
-    <span class="c1"># Not a fixedpropety to prevent ref-cycle and uncollectable WinProcess</span>
+    <span class="c1"># Not a fixedproperty to prevent ref-cycle and uncollectable WinProcess</span>
     <span class="c1"># Try with a weakref ?</span>
     <span class="nd">@property</span>
     <span class="k">def</span> <span class="nf">peb</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
@@ -1319,10 +1398,14 @@
             <span class="k">return</span> <span class="n">RemotePEB32</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">peb_addr</span><span class="p">,</span> <span class="bp">self</span><span class="p">)</span>
         <span class="k">return</span> <span class="n">RemotePEB</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">peb_addr</span><span class="p">,</span> <span class="bp">self</span><span class="p">)</span>
 
-    <span class="nd">@utils</span><span class="o">.</span><span class="n">fixedpropety</span>
+    <span class="nd">@utils</span><span class="o">.</span><span class="n">fixedproperty</span>
     <span class="k">def</span> <span class="nf">peb_syswow_addr</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
         <span class="k">if</span> <span class="ow">not</span> <span class="bp">self</span><span class="o">.</span><span class="n">is_wow_64</span><span class="p">:</span>
             <span class="k">raise</span> <span class="ne">ValueError</span><span class="p">(</span><span class="s2">&quot;Not a syswow process&quot;</span><span class="p">)</span>
+
+        <span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">_is_x86_on_arm64</span><span class="p">:</span>
+            <span class="k">raise</span> <span class="ne">NotImplementedError</span><span class="p">(</span><span class="s2">&quot;Crossing heaven gate x86 -&gt; arm64 not implemented&quot;</span><span class="p">)</span>
+
         <span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">64</span><span class="p">:</span>
             <span class="n">information_type</span> <span class="o">=</span> <span class="mi">0</span>
             <span class="n">x</span> <span class="o">=</span> <span class="n">PROCESS_BASIC_INFORMATION</span><span class="p">()</span>
@@ -1338,7 +1421,7 @@
             <span class="n">peb_addr</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">unpack</span><span class="p">(</span><span class="s2">&quot;&lt;Q&quot;</span><span class="p">,</span> <span class="n">data</span><span class="p">[</span><span class="n">x</span><span class="o">.</span><span class="n">PebBaseAddress</span><span class="o">.</span><span class="n">offset</span><span class="p">:</span> <span class="n">x</span><span class="o">.</span><span class="n">PebBaseAddress</span><span class="o">.</span><span class="n">offset</span><span class="o">+</span><span class="mi">8</span><span class="p">])[</span><span class="mi">0</span><span class="p">]</span>
             <span class="k">return</span> <span class="n">peb_addr</span>
 
-    <span class="c1"># Not a fixedpropety to prevent ref-cycle and uncollectable WinProcess</span>
+    <span class="c1"># Not a fixedproperty to prevent ref-cycle and uncollectable WinProcess</span>
     <span class="c1"># Try with a weakref ?</span>
     <span class="nd">@property</span>
     <span class="k">def</span> <span class="nf">peb_syswow</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
@@ -1362,8 +1445,6 @@
 
 
 
-
-
 <span class="k">def</span> <span class="nf">transform_ctypes_fields</span><span class="p">(</span><span class="n">struct</span><span class="p">,</span> <span class="n">replacement</span><span class="p">):</span>
     <span class="k">return</span> <span class="p">[(</span><span class="n">name</span><span class="p">,</span> <span class="n">replacement</span><span class="o">.</span><span class="n">get</span><span class="p">(</span><span class="n">name</span><span class="p">,</span> <span class="nb">type</span><span class="p">))</span> <span class="k">for</span> <span class="n">name</span><span class="p">,</span> <span class="nb">type</span> <span class="ow">in</span> <span class="n">struct</span><span class="o">.</span><span class="n">_fields_</span><span class="p">]</span>
 
@@ -1409,11 +1490,6 @@
 
 
 
-<span class="k">class</span> <span class="nc">LIST_ENTRY_PTR</span><span class="p">(</span><span class="n">PVOID</span><span class="p">):</span>
-    <span class="k">def</span> <span class="nf">TO_LDR_ENTRY</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
-        <span class="k">return</span> <span class="n">LDR_DATA_TABLE_ENTRY</span><span class="o">.</span><span class="n">from_address</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">value</span> <span class="o">-</span> <span class="n">sizeof</span><span class="p">(</span><span class="n">PVOID</span><span class="p">)</span> <span class="o">*</span> <span class="mi">2</span><span class="p">)</span>
-
-
 <div class="viewcode-block" id="PEB">
 <a class="viewcode-back" href="../../../process.html#windows.winobject.process.PEB">[docs]</a>
 <span class="k">class</span> <span class="nc">PEB</span><span class="p">(</span><span class="n">gdef</span><span class="o">.</span><span class="n">PEB</span><span class="p">):</span>
@@ -1450,13 +1526,13 @@
 <span class="sd">        :type: [:class:`LoadedModule`] -- List of loaded modules</span>
 <span class="sd">		&quot;&quot;&quot;</span>
         <span class="n">res</span> <span class="o">=</span> <span class="p">[]</span>
-        <span class="n">list_entry_ptr</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">cast</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">Ldr</span><span class="o">.</span><span class="n">contents</span><span class="o">.</span><span class="n">InMemoryOrderModuleList</span><span class="o">.</span><span class="n">Flink</span><span class="p">,</span> <span class="n">LIST_ENTRY_PTR</span><span class="p">)</span>
-        <span class="n">current_dll</span> <span class="o">=</span> <span class="n">list_entry_ptr</span><span class="o">.</span><span class="n">TO_LDR_ENTRY</span><span class="p">()</span>
+        <span class="n">first_flink</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">Ldr</span><span class="o">.</span><span class="n">contents</span><span class="o">.</span><span class="n">InMemoryOrderModuleList</span><span class="o">.</span><span class="n">Flink</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span>
+        <span class="n">current_dll</span> <span class="o">=</span> <span class="n">first_flink</span><span class="o">.</span><span class="n">get_real_struct</span><span class="p">(</span><span class="n">LoadedModule</span><span class="p">,</span> <span class="n">LoadedModule</span><span class="o">.</span><span class="n">InMemoryOrderLinks</span><span class="p">)</span>
         <span class="k">while</span> <span class="n">current_dll</span><span class="o">.</span><span class="n">DllBase</span><span class="p">:</span>
             <span class="n">res</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">current_dll</span><span class="p">)</span>
-            <span class="n">list_entry_ptr</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">cast</span><span class="p">(</span><span class="n">current_dll</span><span class="o">.</span><span class="n">InMemoryOrderLinks</span><span class="o">.</span><span class="n">Flink</span><span class="p">,</span> <span class="n">LIST_ENTRY_PTR</span><span class="p">)</span>
-            <span class="n">current_dll</span> <span class="o">=</span> <span class="n">list_entry_ptr</span><span class="o">.</span><span class="n">TO_LDR_ENTRY</span><span class="p">()</span>
-        <span class="k">return</span> <span class="p">[</span><span class="n">LoadedModule</span><span class="o">.</span><span class="n">from_address</span><span class="p">(</span><span class="n">addressof</span><span class="p">(</span><span class="n">LDR</span><span class="p">))</span> <span class="k">for</span> <span class="n">LDR</span> <span class="ow">in</span> <span class="n">res</span><span class="p">]</span>
+            <span class="n">next_flink</span> <span class="o">=</span> <span class="n">current_dll</span><span class="o">.</span><span class="n">InMemoryOrderLinks</span><span class="o">.</span><span class="n">Flink</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span>
+            <span class="n">current_dll</span> <span class="o">=</span> <span class="n">next_flink</span><span class="o">.</span><span class="n">get_real_struct</span><span class="p">(</span><span class="n">LoadedModule</span><span class="p">,</span> <span class="n">LoadedModule</span><span class="o">.</span><span class="n">InMemoryOrderLinks</span><span class="p">)</span>
+        <span class="k">return</span> <span class="n">res</span>
 
     <span class="nd">@staticmethod</span>
     <span class="k">def</span> <span class="nf">_extract_environment</span><span class="p">(</span><span class="n">env_block_addr</span><span class="p">,</span> <span class="n">target</span><span class="p">):</span>
@@ -1487,7 +1563,6 @@
         <span class="k">return</span> <span class="n">apisetmap</span><span class="o">.</span><span class="n">get_api_set_map_for_current_process</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">ApiSetMap</span><span class="p">)</span></div>
 
 
-
 <span class="c1"># Memory stuff</span>
 
 <span class="k">class</span> <span class="nc">EPSAPI_WORKING_SET_BLOCK_BASE</span><span class="p">(</span><span class="nb">object</span><span class="p">):</span>
@@ -1599,9 +1674,24 @@
         <span class="k">raise</span> <span class="ne">NotImplementedError</span><span class="p">(</span><span class="s2">&quot;ApiSetMap for remote process not implemented yet&quot;</span><span class="p">)</span>
 
 
+<span class="c1"># TEB enhanced, same bitness as PEB (current process)</span>
+<span class="k">class</span> <span class="nc">TEB</span><span class="p">(</span><span class="n">gdef</span><span class="o">.</span><span class="n">TEB</span><span class="p">):</span>
+    <span class="nd">@property</span>
+    <span class="k">def</span> <span class="nf">peb</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
+        <span class="k">return</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">cast</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">ProcessEnvironmentBlock</span><span class="p">,</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">POINTER</span><span class="p">(</span><span class="n">PEB</span><span class="p">))[</span><span class="mi">0</span><span class="p">]</span>
 
+<span class="c1"># mote TEB enhanced, same bitness as PEB (current process)</span>
+<span class="k">class</span> <span class="nc">RemoteTEB</span><span class="p">(</span><span class="n">rctypes</span><span class="o">.</span><span class="n">RemoteStructure</span><span class="o">.</span><span class="n">from_structure</span><span class="p">(</span><span class="n">TEB</span><span class="p">)):</span>
+    <span class="nd">@property</span>
+    <span class="k">def</span> <span class="nf">peb</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
+        <span class="n">ctypes_peb</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">ProcessEnvironmentBlock</span><span class="o">.</span><span class="n">value</span>
+        <span class="k">return</span> <span class="n">RemotePEB</span><span class="p">(</span><span class="n">ctypes_peb</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">_target</span><span class="p">)</span>
 
 <span class="k">if</span> <span class="n">CurrentProcess</span><span class="p">()</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">32</span><span class="p">:</span>
+    <span class="n">RemoteLoadedModule32</span> <span class="o">=</span> <span class="n">RemoteLoadedModule</span>
+    <span class="n">RemotePEB32</span> <span class="o">=</span> <span class="n">RemotePEB</span>
+    <span class="n">RemoteTEB32</span> <span class="o">=</span> <span class="n">RemoteTEB</span>
+
     <span class="k">class</span> <span class="nc">RemoteLoadedModule64</span><span class="p">(</span><span class="n">rctypes</span><span class="o">.</span><span class="n">transform_type_to_remote64bits</span><span class="p">(</span><span class="n">LoadedModule</span><span class="p">)):</span>
         <span class="nd">@property</span>
         <span class="k">def</span> <span class="nf">pe</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
@@ -1616,7 +1706,6 @@
         <span class="k">def</span> <span class="nf">ptr_flink_to_remote_module</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">ptr_value</span><span class="p">):</span>
             <span class="k">return</span> <span class="n">RemoteLoadedModule64</span><span class="p">(</span><span class="n">ptr_value</span> <span class="o">-</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">rctypes</span><span class="o">.</span><span class="n">c_void_p64</span><span class="p">)</span> <span class="o">*</span> <span class="mi">2</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">_target</span><span class="p">)</span>
 
-
         <span class="nd">@property</span>
         <span class="k">def</span> <span class="nf">exe</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
 <span class="w">            </span><span class="sd">&quot;&quot;&quot;The executable of the process, as pointed by PEB.ImageBaseAddress</span>
@@ -1649,7 +1738,17 @@
 
         <span class="n">apisetmap</span> <span class="o">=</span> <span class="n">RemotePEB</span><span class="o">.</span><span class="n">apisetmap</span>
 
+    <span class="k">class</span> <span class="nc">RemoteTEB64</span><span class="p">(</span><span class="n">rctypes</span><span class="o">.</span><span class="n">transform_type_to_remote64bits</span><span class="p">(</span><span class="n">TEB</span><span class="p">)):</span>
+        <span class="nd">@property</span>
+        <span class="k">def</span> <span class="nf">peb</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
+            <span class="n">ctypes_peb</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">ProcessEnvironmentBlock</span><span class="o">.</span><span class="n">value</span>
+            <span class="k">return</span> <span class="n">RemotePEB64</span><span class="p">(</span><span class="n">ctypes_peb</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">_target</span><span class="p">)</span>
+
+
 <span class="k">if</span> <span class="n">CurrentProcess</span><span class="p">()</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">64</span><span class="p">:</span>
+    <span class="n">RemoteLoadedModule64</span> <span class="o">=</span> <span class="n">RemoteLoadedModule</span>
+    <span class="n">RemotePEB64</span> <span class="o">=</span> <span class="n">RemotePEB</span>
+    <span class="n">RemoteTEB64</span> <span class="o">=</span> <span class="n">RemoteTEB</span>
 
     <span class="k">class</span> <span class="nc">RemoteLoadedModule32</span><span class="p">(</span><span class="n">rctypes</span><span class="o">.</span><span class="n">transform_type_to_remote32bits</span><span class="p">(</span><span class="n">LoadedModule</span><span class="p">)):</span>
         <span class="nd">@property</span>
@@ -1696,6 +1795,12 @@
             <span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">_extract_environment</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">ProcessParameters</span><span class="o">.</span><span class="n">contents</span><span class="o">.</span><span class="n">Environment</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">_target</span><span class="p">)</span>
 
         <span class="n">apisetmap</span> <span class="o">=</span> <span class="n">RemotePEB</span><span class="o">.</span><span class="n">apisetmap</span>
+
+    <span class="k">class</span> <span class="nc">RemoteTEB32</span><span class="p">(</span><span class="n">rctypes</span><span class="o">.</span><span class="n">transform_type_to_remote32bits</span><span class="p">(</span><span class="n">TEB</span><span class="p">)):</span>
+        <span class="nd">@property</span>
+        <span class="k">def</span> <span class="nf">peb</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
+            <span class="n">ctypes_peb</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">ProcessEnvironmentBlock</span><span class="o">.</span><span class="n">value</span>
+            <span class="k">return</span> <span class="n">RemotePEB32</span><span class="p">(</span><span class="n">ctypes_peb</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">_target</span><span class="p">)</span>
 </pre></div>
 
             <div class="clearer"></div>
@@ -1727,7 +1832,7 @@
         <li class="right" >
           <a href="../../../py-modindex.html" title="Python Module Index"
              >modules</a> |</li>
-        <li class="nav-item nav-item-0"><a href="../../../index.html">PythonForWindows 1.0.2 documentation</a> &#187;</li>
+        <li class="nav-item nav-item-0"><a href="../../../index.html">PythonForWindows 1.0.3 documentation</a> &#187;</li>
           <li class="nav-item nav-item-1"><a href="../../index.html" >Module code</a> &#187;</li>
         <li class="nav-item nav-item-this"><a href="">windows.winobject.process</a></li> 
       </ul>

docs/build/html/_modules/windows/winobject/system.html

@@ -49,7 +49,6 @@
 <span class="kn">import</span> <span class="nn">windows.generated_def</span> <span class="k">as</span> <span class="nn">gdef</span>
 
 
-
 <span class="kn">from</span> <span class="nn">windows.winobject</span> <span class="kn">import</span> <span class="n">process</span>
 <span class="kn">from</span> <span class="nn">windows.winobject</span> <span class="kn">import</span> <span class="n">network</span>
 <span class="kn">from</span> <span class="nn">windows.winobject</span> <span class="kn">import</span> <span class="n">registry</span>
@@ -128,7 +127,7 @@
 
     <span class="nd">@property</span>
     <span class="k">def</span> <span class="nf">logicaldrives</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
-<span class="w">        </span><span class="sd">&quot;&quot;&quot;List of logical drives [C:\, ...]</span>
+<span class="w">        </span><span class="sd">&quot;&quot;&quot;List of logical drives [C:\\, ...]</span>
 
 <span class="sd">        :type: [:class:`~windows.winobject.volume.LogicalDrive`] -- A list of LogicalDrive</span>
 <span class="sd">        &quot;&quot;&quot;</span>
@@ -301,12 +300,77 @@
             <span class="n">result</span> <span class="o">=</span> <span class="nb">tuple</span><span class="p">(</span><span class="n">result_tup</span><span class="p">[:</span><span class="mi">2</span><span class="p">])</span>
         <span class="k">return</span> <span class="n">result</span>
 
+    <span class="c1"># Based on:</span>
+    <span class="c1">#   https://jrsoftware.org/ishelp/index.php?topic=winvernotes</span>
+    <span class="c1">#   https://en.wikipedia.org/wiki/List_of_Microsoft_Windows_versions</span>
+
+    <span class="n">WINDOWS_10_BUILD_NUMBER_VERSION</span> <span class="o">=</span> <span class="p">{</span>
+        <span class="c1"># (build_number, is_workstation): &quot;version_name&quot;</span>
+        <span class="p">(</span><span class="mi">10240</span><span class="p">,</span> <span class="kc">True</span><span class="p">):</span> <span class="sa">u</span><span class="s2">&quot;Windows 10 Version 1507&quot;</span><span class="p">,</span>
+        <span class="p">(</span><span class="mi">10586</span><span class="p">,</span> <span class="kc">True</span><span class="p">):</span> <span class="sa">u</span><span class="s2">&quot;Windows 10 Version 1511&quot;</span><span class="p">,</span>
+        <span class="p">(</span><span class="mi">14393</span><span class="p">,</span> <span class="kc">True</span><span class="p">):</span> <span class="sa">u</span><span class="s2">&quot;Windows 10 Version 1607&quot;</span><span class="p">,</span>
+        <span class="p">(</span><span class="mi">15063</span><span class="p">,</span> <span class="kc">True</span><span class="p">):</span> <span class="sa">u</span><span class="s2">&quot;Windows 10 Version 1703&quot;</span><span class="p">,</span>
+        <span class="p">(</span><span class="mi">16299</span><span class="p">,</span> <span class="kc">True</span><span class="p">):</span> <span class="sa">u</span><span class="s2">&quot;Windows 10 Version 1709&quot;</span><span class="p">,</span>
+        <span class="p">(</span><span class="mi">17134</span><span class="p">,</span> <span class="kc">True</span><span class="p">):</span> <span class="sa">u</span><span class="s2">&quot;Windows 10 Version 1803&quot;</span><span class="p">,</span>
+        <span class="p">(</span><span class="mi">17763</span><span class="p">,</span> <span class="kc">True</span><span class="p">):</span> <span class="sa">u</span><span class="s2">&quot;Windows 10 Version 1809&quot;</span><span class="p">,</span>
+        <span class="p">(</span><span class="mi">18362</span><span class="p">,</span> <span class="kc">True</span><span class="p">):</span> <span class="sa">u</span><span class="s2">&quot;Windows 10 Version 1903&quot;</span><span class="p">,</span>
+        <span class="p">(</span><span class="mi">18363</span><span class="p">,</span> <span class="kc">True</span><span class="p">):</span> <span class="sa">u</span><span class="s2">&quot;Windows 10 Version 1909&quot;</span><span class="p">,</span>
+        <span class="p">(</span><span class="mi">19041</span><span class="p">,</span> <span class="kc">True</span><span class="p">):</span> <span class="sa">u</span><span class="s2">&quot;Windows 10 Version 2004&quot;</span><span class="p">,</span>
+        <span class="p">(</span><span class="mi">19042</span><span class="p">,</span> <span class="kc">True</span><span class="p">):</span> <span class="sa">u</span><span class="s2">&quot;Windows 10 Version 20H2&quot;</span><span class="p">,</span>
+        <span class="p">(</span><span class="mi">19043</span><span class="p">,</span> <span class="kc">True</span><span class="p">):</span> <span class="sa">u</span><span class="s2">&quot;Windows 10 Version 21H1&quot;</span><span class="p">,</span>
+        <span class="p">(</span><span class="mi">19044</span><span class="p">,</span> <span class="kc">True</span><span class="p">):</span> <span class="sa">u</span><span class="s2">&quot;Windows 10 Version 21H2&quot;</span><span class="p">,</span>
+        <span class="p">(</span><span class="mi">19045</span><span class="p">,</span> <span class="kc">True</span><span class="p">):</span> <span class="sa">u</span><span class="s2">&quot;Windows 10 Version 22H2&quot;</span><span class="p">,</span>
+        <span class="p">(</span><span class="mi">22000</span><span class="p">,</span> <span class="kc">True</span><span class="p">):</span> <span class="sa">u</span><span class="s2">&quot;Windows 11 Version 21H2&quot;</span><span class="p">,</span>
+        <span class="p">(</span><span class="mi">22621</span><span class="p">,</span> <span class="kc">True</span><span class="p">):</span> <span class="sa">u</span><span class="s2">&quot;Windows 11 Version 22H2&quot;</span><span class="p">,</span>
+        <span class="p">(</span><span class="mi">22631</span><span class="p">,</span> <span class="kc">True</span><span class="p">):</span> <span class="sa">u</span><span class="s2">&quot;Windows 11 Version 23H2&quot;</span><span class="p">,</span>
+        <span class="p">(</span><span class="mi">26100</span><span class="p">,</span> <span class="kc">True</span><span class="p">):</span> <span class="sa">u</span><span class="s2">&quot;Windows 11 Version 24H2&quot;</span><span class="p">,</span>
+
+        <span class="p">(</span><span class="mi">14393</span><span class="p">,</span> <span class="kc">False</span><span class="p">):</span> <span class="sa">u</span><span class="s2">&quot;Windows Server 2016&quot;</span><span class="p">,</span>
+        <span class="c1"># 16299 : Windows Server, version 1709 ?</span>
+        <span class="c1"># 17134 : Windows Server, version 1803 ?</span>
+        <span class="c1"># 17134 : Windows Server, version 1803 ?</span>
+        <span class="p">(</span><span class="mi">17763</span><span class="p">,</span> <span class="kc">False</span><span class="p">):</span> <span class="sa">u</span><span class="s2">&quot;Windows Server 2019&quot;</span><span class="p">,</span>
+        <span class="c1"># 18362 : Windows Server, version 1903 ?</span>
+        <span class="c1"># 18363 : Windows Server, version 1909 ?</span>
+        <span class="c1"># 19041 : Windows Server, version 2004 ?</span>
+        <span class="c1"># 19042 : Windows Server, version 20H2 ?</span>
+        <span class="p">(</span><span class="mi">20348</span><span class="p">,</span> <span class="kc">False</span><span class="p">):</span> <span class="sa">u</span><span class="s2">&quot;Windows Server 2022&quot;</span><span class="p">,</span>
+        <span class="c1"># 25398 : Windows Server, version 23H2 ?</span>
+        <span class="p">(</span><span class="mi">26100</span><span class="p">,</span> <span class="kc">False</span><span class="p">):</span> <span class="sa">u</span><span class="s2">&quot;Windows Server 2025&quot;</span><span class="p">,</span>
+    <span class="p">}</span>
+
+    <span class="k">def</span> <span class="nf">_get_version_name_for_10_build</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">build_number</span><span class="p">,</span> <span class="n">is_workstation</span><span class="p">):</span>
+        <span class="k">try</span><span class="p">:</span>
+            <span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">WINDOWS_10_BUILD_NUMBER_VERSION</span><span class="p">[(</span><span class="n">build_number</span><span class="p">,</span> <span class="n">is_workstation</span><span class="p">)]</span>
+        <span class="k">except</span> <span class="ne">KeyError</span> <span class="k">as</span> <span class="n">e</span><span class="p">:</span>
+            <span class="k">return</span> <span class="sa">u</span><span class="s2">&quot;Unknown Windows 10+ &lt;versionstr=</span><span class="si">{0}</span><span class="s2"> | is_workstation=</span><span class="si">{1}</span><span class="s2">&gt;&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">versionstr</span><span class="p">,</span> <span class="n">is_workstation</span><span class="p">)</span>
+
     <span class="nd">@utils</span><span class="o">.</span><span class="n">fixedpropety</span>
     <span class="k">def</span> <span class="nf">version_name</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
 <span class="w">        </span><span class="sd">&quot;&quot;&quot;The name of the system version,  values are:</span>
 
+<span class="sd">            * Windows Server 2025</span>
+<span class="sd">            * Windows 11 Version 24H2</span>
+<span class="sd">            * Windows 11 Version 23H2</span>
+<span class="sd">            * Windows 11 Version 22H2</span>
+<span class="sd">            * Windows 11 Version 21H2</span>
+<span class="sd">            * Windows 10 Version 22H2</span>
+<span class="sd">            * Windows 10 Version 21H2</span>
+<span class="sd">            * Windows Server 2022</span>
+<span class="sd">            * Windows 10 Version 21H1</span>
+<span class="sd">            * Windows 10 Version 20H2</span>
+<span class="sd">            * Windows 10 Version 2004</span>
+<span class="sd">            * Windows 10 Version 1909</span>
+<span class="sd">            * Windows 10 Version 1903</span>
+<span class="sd">            * Windows Server 2019</span>
+<span class="sd">            * Windows 10 Version 1809</span>
+<span class="sd">            * Windows 10 Version 1803</span>
+<span class="sd">            * Windows 10 Version 1709</span>
+<span class="sd">            * Windows 10 Version 1703</span>
+<span class="sd">            * Windows 10 Version 1607</span>
+<span class="sd">            * Windows 10 Version 1511</span>
+<span class="sd">            * Windows 10 Version 1507</span>
 <span class="sd">            * Windows Server 2016</span>
-<span class="sd">            * Windows 10</span>
 <span class="sd">            * Windows Server 2012 R2</span>
 <span class="sd">            * Windows 8.1</span>
 <span class="sd">            * Windows Server 2012</span>
@@ -316,19 +380,20 @@
 <span class="sd">            * Windows Server 2008</span>
 <span class="sd">            * Windows Vista</span>
 <span class="sd">            * Windows XP Professional x64 Edition</span>
-<span class="sd">            * TODO: version (5.2) + is_workstation + bitness == 32 (don&#39;t even know if possible..)</span>
+<span class="sd">            * Unknown: version (5.2) + is_workstation + bitness == 32 (don&#39;t even know if possible..)</span>
 <span class="sd">            * Windows Server 2003 R2</span>
 <span class="sd">            * Windows Server 2003</span>
 <span class="sd">            * Windows XP</span>
 <span class="sd">            * Windows 2000</span>
-<span class="sd">            * &quot;Unknow Windows &lt;version={0} | is_workstation={1}&gt;&quot;.format(version, is_workstation)</span>
+<span class="sd">            * &quot;Unknown Windows 10+ &lt;versionstr={0} | is_workstation={1}&gt;&quot;.format(self.versionstr, is_workstation)</span>
+<span class="sd">            * &quot;Unknown Windows &lt;version={0} | is_workstation={1}&gt;&quot;.format(version, is_workstation)</span>
 
-<span class="sd">        :type: :class:`str`</span>
+<span class="sd">        :type: :class:`unicode`</span>
 <span class="sd">        &quot;&quot;&quot;</span>
         <span class="n">version</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">version</span>
         <span class="n">is_workstation</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">product_type</span> <span class="o">==</span> <span class="n">gdef</span><span class="o">.</span><span class="n">VER_NT_WORKSTATION</span>
         <span class="k">if</span> <span class="n">version</span> <span class="o">==</span> <span class="p">(</span><span class="mi">10</span><span class="p">,</span> <span class="mi">0</span><span class="p">):</span>
-            <span class="k">return</span> <span class="p">[</span><span class="sa">u</span><span class="s2">&quot;Windows Server 2016&quot;</span><span class="p">,</span> <span class="sa">u</span><span class="s2">&quot;Windows 10&quot;</span><span class="p">][</span><span class="n">is_workstation</span><span class="p">]</span>
+            <span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">_get_version_name_for_10_build</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">build_number</span><span class="p">,</span> <span class="n">is_workstation</span><span class="p">)</span>
         <span class="k">elif</span> <span class="n">version</span> <span class="o">==</span> <span class="p">(</span><span class="mi">6</span><span class="p">,</span> <span class="mi">3</span><span class="p">):</span>
             <span class="k">return</span>  <span class="p">[</span><span class="sa">u</span><span class="s2">&quot;Windows Server 2012 R2&quot;</span><span class="p">,</span> <span class="sa">u</span><span class="s2">&quot;Windows 8.1&quot;</span><span class="p">][</span><span class="n">is_workstation</span><span class="p">]</span>
         <span class="k">elif</span> <span class="n">version</span> <span class="o">==</span> <span class="p">(</span><span class="mi">6</span><span class="p">,</span> <span class="mi">2</span><span class="p">):</span>
@@ -343,7 +408,7 @@
                 <span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">64</span><span class="p">:</span>
                     <span class="k">return</span> <span class="sa">u</span><span class="s2">&quot;Windows XP Professional x64 Edition&quot;</span>
                 <span class="k">else</span><span class="p">:</span>
-                    <span class="k">return</span> <span class="sa">u</span><span class="s2">&quot;TODO: version (5.2) + is_workstation + bitness == 32&quot;</span>
+                    <span class="k">return</span> <span class="sa">u</span><span class="s2">&quot;Unknown: version (5.2) + is_workstation + bitness == 32&quot;</span>
             <span class="k">elif</span> <span class="n">metric</span> <span class="o">!=</span> <span class="mi">0</span><span class="p">:</span>
                 <span class="k">return</span> <span class="sa">u</span><span class="s2">&quot;Windows Server 2003 R2&quot;</span>
             <span class="k">else</span><span class="p">:</span>
@@ -353,7 +418,7 @@
         <span class="k">elif</span> <span class="n">version</span> <span class="o">==</span> <span class="p">(</span><span class="mi">5</span><span class="p">,</span> <span class="mi">0</span><span class="p">):</span>
             <span class="k">return</span> <span class="sa">u</span><span class="s2">&quot;Windows 2000&quot;</span>
         <span class="k">else</span><span class="p">:</span>
-            <span class="k">return</span> <span class="sa">u</span><span class="s2">&quot;Unknow Windows &lt;version=</span><span class="si">{0}</span><span class="s2"> | is_workstation=</span><span class="si">{1}</span><span class="s2">&gt;&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">version</span><span class="p">,</span> <span class="n">is_workstation</span><span class="p">)</span>
+            <span class="k">return</span> <span class="sa">u</span><span class="s2">&quot;Unknown Windows &lt;version=</span><span class="si">{0}</span><span class="s2"> | is_workstation=</span><span class="si">{1}</span><span class="s2">&gt;&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">version</span><span class="p">,</span> <span class="n">is_workstation</span><span class="p">)</span>
 
     <span class="n">VERSION_MAPPER</span> <span class="o">=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">FlagMapper</span><span class="p">(</span><span class="n">gdef</span><span class="o">.</span><span class="n">VER_NT_WORKSTATION</span><span class="p">,</span> <span class="n">gdef</span><span class="o">.</span><span class="n">VER_NT_DOMAIN_CONTROLLER</span><span class="p">,</span> <span class="n">gdef</span><span class="o">.</span><span class="n">VER_NT_SERVER</span><span class="p">)</span>
     <span class="nd">@utils</span><span class="o">.</span><span class="n">fixedpropety</span>
@@ -561,6 +626,24 @@
         <span class="c1"># These are the part that do not move much between XP &amp; Win10</span>
         <span class="k">return</span> <span class="n">gdef</span><span class="o">.</span><span class="n">PFW_MINIMAL_KUSER_SHARED_DATA</span><span class="o">.</span><span class="n">from_address</span><span class="p">(</span><span class="n">gdef</span><span class="o">.</span><span class="n">MM_SHARED_USER_DATA_VA</span><span class="p">)</span>
 
+    <span class="nd">@utils</span><span class="o">.</span><span class="n">fixedproperty</span>
+    <span class="k">def</span> <span class="nf">architecture</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
+        <span class="c1"># Retrieve system processor architecture</span>
+        <span class="c1"># It&#39;s not that easy as x64-on-ARM64 will lie on most API except IsWow64Process2</span>
+        <span class="c1"># EX: GetNativeSystemInfo will returns PROCESSOR_ARCHITECTURE_AMD64</span>
+        <span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">is_implemented</span><span class="p">(</span><span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">IsWow64Process2</span><span class="p">):</span>
+            <span class="n">process_machine</span><span class="p">,</span> <span class="n">native_machine</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">is_wow_64_2</span>
+            <span class="k">try</span><span class="p">:</span>
+                <span class="k">return</span> <span class="n">utils</span><span class="o">.</span><span class="n">image_file_machine_to_processor_architecture</span><span class="p">(</span><span class="n">native_machine</span><span class="p">)</span>
+            <span class="k">except</span> <span class="ne">KeyError</span> <span class="k">as</span> <span class="n">e</span><span class="p">:</span>
+                <span class="k">raise</span> <span class="ne">ValueError</span><span class="p">(</span><span class="s2">&quot;Unknown IsWow64Process2(native_machine:#x) -&gt; </span><span class="si">{0}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">native_machine</span><span class="p">))</span>
+
+        <span class="c1"># No IsWow64Process2 -&gt; assert it cannot be ARM64 and thus GetNativeSystemInfo will not lie ?</span>
+        <span class="n">sysinfo</span> <span class="o">=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">SYSTEM_INFO</span><span class="p">()</span>
+        <span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">GetNativeSystemInfo</span><span class="p">(</span><span class="n">sysinfo</span><span class="p">)</span>
+        <span class="k">return</span> <span class="n">gdef</span><span class="o">.</span><span class="n">PROCESSOR_ARCHITECTURE_MAPPER</span><span class="p">[</span><span class="n">sysinfo</span><span class="o">.</span><span class="n">wProcessorArchitecture</span><span class="p">]</span>
+
+
 
     <span class="nd">@staticmethod</span>
     <span class="k">def</span> <span class="nf">enumerate_processes</span><span class="p">():</span>
@@ -596,7 +679,7 @@
 
     <span class="nd">@staticmethod</span>
     <span class="k">def</span> <span class="nf">enumerate_threads</span><span class="p">():</span>
-        <span class="k">return</span> <span class="p">[</span><span class="n">WinThread</span><span class="o">.</span><span class="n">_from_THREADENTRY32</span><span class="p">(</span><span class="n">th</span><span class="p">)</span> <span class="k">for</span> <span class="n">th</span> <span class="ow">in</span> <span class="n">System</span><span class="o">.</span><span class="n">enumerate_threads_generator</span><span class="p">()]</span>
+        <span class="k">return</span> <span class="p">[</span><span class="n">process</span><span class="o">.</span><span class="n">WinThread</span><span class="o">.</span><span class="n">_from_THREADENTRY32</span><span class="p">(</span><span class="n">th</span><span class="p">)</span> <span class="k">for</span> <span class="n">th</span> <span class="ow">in</span> <span class="n">System</span><span class="o">.</span><span class="n">enumerate_threads_generator</span><span class="p">()]</span>
 
 
     <span class="k">def</span> <span class="nf">enumerate_threads_setup_owners</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>

docs/build/html/_modules/windows/winobject/system_module.html

@@ -4,12 +4,12 @@
   <head>
     <meta charset="utf-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-    <title>windows.winobject.system_module &#8212; PythonForWindows 1.0.2 documentation</title>
+    <title>windows.winobject.system_module &#8212; PythonForWindows 1.0.3 documentation</title>
     <link rel="stylesheet" type="text/css" href="../../../_static/pygments.css?v=fa44fd50" />
     <link rel="stylesheet" type="text/css" href="../../../_static/classic.css?v=def86cc0" />
     <link rel="stylesheet" type="text/css" href="../../../_static/css/mbasic.css?v=957880af" />
     
-    <script src="../../../_static/documentation_options.js?v=1ed6394b"></script>
+    <script src="../../../_static/documentation_options.js?v=baaebd52"></script>
     <script src="../../../_static/doctools.js?v=9a2dae69"></script>
     <script src="../../../_static/sphinx_highlight.js?v=dc90522c"></script>
     
@@ -25,7 +25,7 @@
         <li class="right" >
           <a href="../../../py-modindex.html" title="Python Module Index"
              >modules</a> |</li>
-        <li class="nav-item nav-item-0"><a href="../../../index.html">PythonForWindows 1.0.2 documentation</a> &#187;</li>
+        <li class="nav-item nav-item-0"><a href="../../../index.html">PythonForWindows 1.0.3 documentation</a> &#187;</li>
           <li class="nav-item nav-item-1"><a href="../../index.html" accesskey="U">Module code</a> &#187;</li>
         <li class="nav-item nav-item-this"><a href="">windows.winobject.system_module</a></li> 
       </ul>
@@ -92,6 +92,8 @@
     <span class="k">return</span> <span class="nb">list</span><span class="p">(</span><span class="n">modules</span><span class="p">)</span>
 
 <span class="k">def</span> <span class="nf">enumerate_kernel_modules_syswow64</span><span class="p">():</span>
+    <span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">_is_x86_on_arm64</span><span class="p">:</span>
+        <span class="k">raise</span> <span class="ne">NotImplementedError</span><span class="p">(</span><span class="s2">&quot;Crossing heaven gate x86 -&gt; arm64 not implemented&quot;</span><span class="p">)</span>
     <span class="n">cbsize</span> <span class="o">=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">DWORD</span><span class="p">()</span>
     <span class="n">windows</span><span class="o">.</span><span class="n">syswow64</span><span class="o">.</span><span class="n">NtQuerySystemInformation_32_to_64</span><span class="p">(</span><span class="n">gdef</span><span class="o">.</span><span class="n">SystemModuleInformation</span><span class="p">,</span> <span class="kc">None</span><span class="p">,</span> <span class="mi">0</span><span class="p">,</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">addressof</span><span class="p">(</span><span class="n">cbsize</span><span class="p">))</span>
     <span class="n">raw_buffer</span> <span class="o">=</span> <span class="p">(</span><span class="n">cbsize</span><span class="o">.</span><span class="n">value</span> <span class="o">*</span> <span class="n">gdef</span><span class="o">.</span><span class="n">BYTE</span><span class="p">)()</span>
@@ -130,7 +132,7 @@
         <li class="right" >
           <a href="../../../py-modindex.html" title="Python Module Index"
              >modules</a> |</li>
-        <li class="nav-item nav-item-0"><a href="../../../index.html">PythonForWindows 1.0.2 documentation</a> &#187;</li>
+        <li class="nav-item nav-item-0"><a href="../../../index.html">PythonForWindows 1.0.3 documentation</a> &#187;</li>
           <li class="nav-item nav-item-1"><a href="../../index.html" >Module code</a> &#187;</li>
         <li class="nav-item nav-item-this"><a href="">windows.winobject.system_module</a></li> 
       </ul>

docs/build/html/_modules/windows/winobject/wmi.html

@@ -4,12 +4,12 @@
   <head>
     <meta charset="utf-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-    <title>windows.winobject.wmi &#8212; PythonForWindows 1.0.2 documentation</title>
+    <title>windows.winobject.wmi &#8212; PythonForWindows 1.0.3 documentation</title>
     <link rel="stylesheet" type="text/css" href="../../../_static/pygments.css?v=fa44fd50" />
     <link rel="stylesheet" type="text/css" href="../../../_static/classic.css?v=def86cc0" />
     <link rel="stylesheet" type="text/css" href="../../../_static/css/mbasic.css?v=957880af" />
     
-    <script src="../../../_static/documentation_options.js?v=1ed6394b"></script>
+    <script src="../../../_static/documentation_options.js?v=baaebd52"></script>
     <script src="../../../_static/doctools.js?v=9a2dae69"></script>
     <script src="../../../_static/sphinx_highlight.js?v=dc90522c"></script>
     
@@ -25,7 +25,7 @@
         <li class="right" >
           <a href="../../../py-modindex.html" title="Python Module Index"
              >modules</a> |</li>
-        <li class="nav-item nav-item-0"><a href="../../../index.html">PythonForWindows 1.0.2 documentation</a> &#187;</li>
+        <li class="nav-item nav-item-0"><a href="../../../index.html">PythonForWindows 1.0.3 documentation</a> &#187;</li>
           <li class="nav-item nav-item-1"><a href="../../index.html" accesskey="U">Module code</a> &#187;</li>
         <li class="nav-item nav-item-this"><a href="">windows.winobject.wmi</a></li> 
       </ul>
@@ -602,11 +602,11 @@
 <div class="viewcode-block" id="WmiManager">
 <a class="viewcode-back" href="../../../wmi.html#windows.winobject.wmi.WmiManager">[docs]</a>
 <span class="k">class</span> <span class="nc">WmiManager</span><span class="p">(</span><span class="nb">dict</span><span class="p">):</span>
-<span class="w">    </span><span class="sd">&quot;&quot;&quot;The main WMI class exposed, used to list and access differents WMI namespace, can be used as a dict to access</span>
+<span class="w">    </span><span class="sa">r</span><span class="sd">&quot;&quot;&quot;The main WMI class exposed, used to list and access differents WMI namespace, can be used as a dict to access</span>
 <span class="sd">    :class:`WmiNamespace` by name</span>
 
 <span class="sd">    Example:</span>
-<span class="sd">        &gt;&gt;&gt; windows.system.wmi[&quot;root\\SecurityCenter2&quot;]</span>
+<span class="sd">        &gt;&gt;&gt; windows.system.wmi[r&quot;root\SecurityCenter2&quot;]</span>
 <span class="sd">        &lt;WmiNamespace &quot;root\SecurityCenter2&quot;&gt;</span>
 <span class="sd">    &quot;&quot;&quot;</span>
     <span class="n">DEFAULT_NAMESPACE</span> <span class="o">=</span> <span class="s2">&quot;root</span><span class="se">\\</span><span class="s2">cimv2&quot;</span> <span class="c1">#: The default namespace for :func:`select` &amp; :func:`query`</span>
@@ -676,7 +676,7 @@
         <li class="right" >
           <a href="../../../py-modindex.html" title="Python Module Index"
              >modules</a> |</li>
-        <li class="nav-item nav-item-0"><a href="../../../index.html">PythonForWindows 1.0.2 documentation</a> &#187;</li>
+        <li class="nav-item nav-item-0"><a href="../../../index.html">PythonForWindows 1.0.3 documentation</a> &#187;</li>
           <li class="nav-item nav-item-1"><a href="../../index.html" >Module code</a> &#187;</li>
         <li class="nav-item nav-item-this"><a href="">windows.winobject.wmi</a></li> 
       </ul>

docs/build/html/_sources/sample.rst.txt

@@ -69,6 +69,20 @@ Output
 
 .. _token_sample:
 
+
+Microsoft Store Python Injection
+''''''''''''''''''''''''''''''''
+
+Python execution in remote process fails with Microsoft Store builds of pythons (`mspython`), as the interpreter DLLs do not grant execute to Users.
+This sample shows a workaround by user https://github.com/dariushoule by copying needed mspython files to a temporary directory and injecting those instead.
+
+.. literalinclude:: ..\..\samples\process\msstore_interpreter_remote_python.py
+
+Output
+
+.. literalinclude:: samples_output\process_msstore_interpreter_remote_python.txt
+
+
 Token
 """""
 

docs/build/html/_sources/windef_generated.rst.txt

@@ -152,6 +152,9 @@ WinDef
 .. autodata:: SORF_OXRES8
 .. autodata:: SORF_NULL
 .. autodata:: SORF_NOPING
+.. autodata:: UNIQUE_FLAG_PADDING
+.. autodata:: MAINHDRSIG
+.. autodata:: ENTRYHDRSIG
 .. autodata:: CWCSTORAGENAME
 .. autodata:: STGM_DIRECT
 .. autodata:: STGM_TRANSACTED
@@ -496,6 +499,15 @@ WinDef
 .. autodata:: ERROR_SEVERITY_INFORMATIONAL
 .. autodata:: ERROR_SEVERITY_WARNING
 .. autodata:: ERROR_SEVERITY_ERROR
+.. autodata:: FACILITY_WINDOWS
+.. autodata:: FACILITY_WIN32
+.. autodata:: FACILITY_STORAGE
+.. autodata:: FACILITY_RPC
+.. autodata:: FACILITY_NULL
+.. autodata:: FACILITY_ITF
+.. autodata:: FACILITY_DISPATCH
+.. autodata:: STATUS_SEVERITY_SUCCESS
+.. autodata:: STATUS_SEVERITY_COERROR
 .. autodata:: EVENT_TRACE_FLAG_DISPATCHER
 .. autodata:: EVENT_TRACE_FLAG_VIRTUAL_ALLOC
 .. autodata:: EVENT_TRACE_FLAG_VAMAP
@@ -1133,6 +1145,89 @@ WinDef
 .. autodata:: NMPWAIT_WAIT_FOREVER
 .. autodata:: NMPWAIT_NOWAIT
 .. autodata:: NMPWAIT_USE_DEFAULT_WAIT
+.. autodata:: ProcThreadAttributeParentProcess
+.. autodata:: ProcThreadAttributeExtendedFlags
+.. autodata:: ProcThreadAttributeHandleList
+.. autodata:: ProcThreadAttributeGroupAffinity
+.. autodata:: ProcThreadAttributePreferredNode
+.. autodata:: ProcThreadAttributeIdealProcessor
+.. autodata:: ProcThreadAttributeUmsThread
+.. autodata:: ProcThreadAttributeMitigationPolicy
+.. autodata:: ProcThreadAttributePackageFullName
+.. autodata:: ProcThreadAttributeSecurityCapabilities
+.. autodata:: ProcThreadAttributeConsoleReference
+.. autodata:: ProcThreadAttributeProtectionLevel
+.. autodata:: ProcThreadAttributeOsMaxVersionTested
+.. autodata:: ProcThreadAttributeJobList
+.. autodata:: ProcThreadAttributeChildProcessPolicy
+.. autodata:: ProcThreadAttributeAllApplicationPackagesPolicy
+.. autodata:: ProcThreadAttributeWin32kFilter
+.. autodata:: ProcThreadAttributeSafeOpenPromptOriginClaim
+.. autodata:: ProcThreadAttributeDesktopAppPolicy
+.. autodata:: ProcThreadAttributeBnoIsolation
+.. autodata:: ProcThreadAttributePseudoConsole
+.. autodata:: ProcThreadAttributeIsolationManifest
+.. autodata:: ProcThreadAttributeMitigationAuditPolicy
+.. autodata:: ProcThreadAttributeMachineType
+.. autodata:: ProcThreadAttributeComponentFilter
+.. autodata:: ProcThreadAttributeEnableOptionalXStateFeatures
+.. autodata:: ProcThreadAttributeCreateStore
+.. autodata:: ProcThreadAttributeTrustedApp
+.. autodata:: ProcThreadAttributeSveVectorLength
+.. autodata:: PROC_THREAD_ATTRIBUTE_NUMBER
+.. autodata:: PROC_THREAD_ATTRIBUTE_THREAD
+.. autodata:: PROC_THREAD_ATTRIBUTE_INPUT
+.. autodata:: PROC_THREAD_ATTRIBUTE_ADDITIVE
+.. autodata:: PROC_THREAD_ATTRIBUTE_PARENT_PROCESS
+.. autodata:: PROC_THREAD_ATTRIBUTE_HANDLE_LIST
+.. autodata:: PROC_THREAD_ATTRIBUTE_GROUP_AFFINITY
+.. autodata:: PROC_THREAD_ATTRIBUTE_PREFERRED_NODE
+.. autodata:: PROC_THREAD_ATTRIBUTE_IDEAL_PROCESSOR
+.. autodata:: PROC_THREAD_ATTRIBUTE_UMS_THREAD
+.. autodata:: PROC_THREAD_ATTRIBUTE_MITIGATION_POLICY
+.. autodata:: PROC_THREAD_ATTRIBUTE_SECURITY_CAPABILITIES
+.. autodata:: PROC_THREAD_ATTRIBUTE_PROTECTION_LEVEL
+.. autodata:: PROC_THREAD_ATTRIBUTE_PSEUDOCONSOLE
+.. autodata:: PROC_THREAD_ATTRIBUTE_MACHINE_TYPE
+.. autodata:: PROC_THREAD_ATTRIBUTE_ENABLE_OPTIONAL_XSTATE_FEATURES
+.. autodata:: PROC_THREAD_ATTRIBUTE_SVE_VECTOR_LENGTH
+.. autodata:: PROCESSOR_INTEL_386
+.. autodata:: PROCESSOR_INTEL_486
+.. autodata:: PROCESSOR_INTEL_PENTIUM
+.. autodata:: PROCESSOR_INTEL_IA64
+.. autodata:: PROCESSOR_MIPS_R4000
+.. autodata:: PROCESSOR_ALPHA_21064
+.. autodata:: PROCESSOR_PPC_601
+.. autodata:: PROCESSOR_PPC_603
+.. autodata:: PROCESSOR_PPC_604
+.. autodata:: PROCESSOR_PPC_620
+.. autodata:: PROCESSOR_HITACHI_SH3
+.. autodata:: PROCESSOR_HITACHI_SH3E
+.. autodata:: PROCESSOR_HITACHI_SH4
+.. autodata:: PROCESSOR_MOTOROLA_821
+.. autodata:: PROCESSOR_SHx_SH3
+.. autodata:: PROCESSOR_SHx_SH4
+.. autodata:: PROCESSOR_STRONGARM
+.. autodata:: PROCESSOR_ARM720
+.. autodata:: PROCESSOR_ARM820
+.. autodata:: PROCESSOR_ARM920
+.. autodata:: PROCESSOR_ARM_7TDMI
+.. autodata:: PROCESSOR_OPTIL
+.. autodata:: PROCESSOR_ARCHITECTURE_INTEL
+.. autodata:: PROCESSOR_ARCHITECTURE_MIPS
+.. autodata:: PROCESSOR_ARCHITECTURE_ALPHA
+.. autodata:: PROCESSOR_ARCHITECTURE_PPC
+.. autodata:: PROCESSOR_ARCHITECTURE_SHX
+.. autodata:: PROCESSOR_ARCHITECTURE_ARM
+.. autodata:: PROCESSOR_ARCHITECTURE_IA64
+.. autodata:: PROCESSOR_ARCHITECTURE_ALPHA64
+.. autodata:: PROCESSOR_ARCHITECTURE_MSIL
+.. autodata:: PROCESSOR_ARCHITECTURE_AMD64
+.. autodata:: PROCESSOR_ARCHITECTURE_IA32_ON_WIN64
+.. autodata:: PROCESSOR_ARCHITECTURE_NEUTRAL
+.. autodata:: PROCESSOR_ARCHITECTURE_ARM64
+.. autodata:: PROCESSOR_ARCHITECTURE_ARM32_ON_WIN64
+.. autodata:: PROCESSOR_ARCHITECTURE_UNKNOWN
 .. autodata:: HKEY_CLASSES_ROOT
 .. autodata:: HKEY_CURRENT_USER
 .. autodata:: HKEY_LOCAL_MACHINE
@@ -1754,6 +1849,45 @@ WinDef
 .. autodata:: SPC_FINANCIAL_CRITERIA_OBJID
 .. autodata:: SPC_LINK_OBJID
 .. autodata:: SPC_SIGINFO_OBJID
+.. autodata:: CONTEXT_I386
+.. autodata:: CONTEXT_AMD64
+.. autodata:: CONTEXT_ARM
+.. autodata:: CONTEXT_ARM64
+.. autodata:: CONTEXT_i386
+.. autodata:: CONTEXT_i486
+.. autodata:: WOW64_CONTEXT_i386
+.. autodata:: WOW64_CONTEXT_i486
+.. autodata:: CONTEXT_CONTROL
+.. autodata:: CONTEXT_INTEGER
+.. autodata:: CONTEXT_SEGMENTS
+.. autodata:: CONTEXT_FLOATING_POINT
+.. autodata:: CONTEXT_DEBUG_REGISTERS
+.. autodata:: CONTEXT_EXTENDED_REGISTERS
+.. autodata:: CONTEXT_FULL
+.. autodata:: CONTEXT_ALL
+.. autodata:: CONTEXT_XSTATE
+.. autodata:: WOW64_CONTEXT_CONTROL
+.. autodata:: WOW64_CONTEXT_INTEGER
+.. autodata:: WOW64_CONTEXT_SEGMENTS
+.. autodata:: WOW64_CONTEXT_FLOATING_POINT
+.. autodata:: WOW64_CONTEXT_DEBUG_REGISTERS
+.. autodata:: WOW64_CONTEXT_EXTENDED_REGISTERS
+.. autodata:: WOW64_CONTEXT_FULL
+.. autodata:: WOW64_CONTEXT_ALL
+.. autodata:: WOW64_CONTEXT_XSTATE
+.. autodata:: WOW64_CONTEXT_EXCEPTION_ACTIVE
+.. autodata:: WOW64_CONTEXT_SERVICE_ACTIVE
+.. autodata:: WOW64_CONTEXT_EXCEPTION_REQUEST
+.. autodata:: WOW64_CONTEXT_EXCEPTION_REPORTING
+.. autodata:: CONTEXT_ARM64_CONTROL
+.. autodata:: CONTEXT_ARM64_INTEGER
+.. autodata:: CONTEXT_ARM64_FLOATING_POINT
+.. autodata:: CONTEXT_ARM64_DEBUG_REGISTERS
+.. autodata:: CONTEXT_ARM64_X18
+.. autodata:: CONTEXT_UNWOUND_TO_CALL
+.. autodata:: CONTEXT_RET_TO_GUEST
+.. autodata:: ARM64_MAX_BREAKPOINTS
+.. autodata:: ARM64_MAX_WATCHPOINTS
 .. autodata:: FILE_VER_GET_LOCALISED
 .. autodata:: FILE_VER_GET_NEUTRAL
 .. autodata:: FILE_VER_GET_PREFETCHED
@@ -1865,19 +1999,6 @@ WinDef
 .. autodata:: TH32CS_SNAPMODULE32
 .. autodata:: TH32CS_SNAPALL
 .. autodata:: TH32CS_INHERIT
-.. autodata:: CONTEXT_I386
-.. autodata:: CONTEXT_AMD64
-.. autodata:: CONTEXT_ARM
-.. autodata:: CONTEXT_ARM64
-.. autodata:: CONTEXT_CONTROL
-.. autodata:: CONTEXT_INTEGER
-.. autodata:: CONTEXT_SEGMENTS
-.. autodata:: CONTEXT_FLOATING_POINT
-.. autodata:: CONTEXT_DEBUG_REGISTERS
-.. autodata:: CONTEXT_EXTENDED_REGISTERS
-.. autodata:: CONTEXT_FULL
-.. autodata:: CONTEXT_ALL
-.. autodata:: CONTEXT_XSTATE
 .. autodata:: PAGE_NOACCESS
 .. autodata:: PAGE_READONLY
 .. autodata:: PAGE_READWRITE
@@ -2910,6 +3031,7 @@ WinDef
 .. autodata:: IMAGE_FILE_MACHINE_M32R
 .. autodata:: IMAGE_FILE_MACHINE_CEE
 .. autodata:: IMAGE_FILE_MACHINE_ARM64
+.. autodata:: IMAGE_FILE_MACHINE_TARGET_HOST
 .. autodata:: CERT_QUERY_OBJECT_FILE
 .. autodata:: CERT_QUERY_OBJECT_BLOB
 .. autodata:: CERT_QUERY_CONTENT_CERT
@@ -3222,6 +3344,37 @@ WinDef
 .. autodata:: CRYPT_SGCKEY
 .. autodata:: CRYPT_ARCHIVABLE
 .. autodata:: CRYPT_FORCE_KEY_PROTECTION_HIGH
+.. autodata:: CERT_RDN_ANY_TYPE
+.. autodata:: CERT_RDN_ENCODED_BLOB
+.. autodata:: CERT_RDN_OCTET_STRING
+.. autodata:: CERT_RDN_NUMERIC_STRING
+.. autodata:: CERT_RDN_PRINTABLE_STRING
+.. autodata:: CERT_RDN_TELETEX_STRING
+.. autodata:: CERT_RDN_T61_STRING
+.. autodata:: CERT_RDN_VIDEOTEX_STRING
+.. autodata:: CERT_RDN_IA5_STRING
+.. autodata:: CERT_RDN_GRAPHIC_STRING
+.. autodata:: CERT_RDN_VISIBLE_STRING
+.. autodata:: CERT_RDN_ISO646_STRING
+.. autodata:: CERT_RDN_GENERAL_STRING
+.. autodata:: CERT_RDN_UNIVERSAL_STRING
+.. autodata:: CERT_RDN_INT4_STRING
+.. autodata:: CERT_RDN_BMP_STRING
+.. autodata:: CERT_RDN_UNICODE_STRING
+.. autodata:: CERT_RDN_UTF8_STRING
+.. autodata:: CERT_RDN_TYPE_MASK
+.. autodata:: CERT_RDN_FLAGS_MASK
+.. autodata:: CERT_RDN_ENABLE_T61_UNICODE_FLAG
+.. autodata:: CERT_RDN_ENABLE_UTF8_UNICODE_FLAG
+.. autodata:: CERT_RDN_FORCE_UTF8_UNICODE_FLAG
+.. autodata:: CERT_RDN_DISABLE_CHECK_TYPE_FLAG
+.. autodata:: CERT_RDN_DISABLE_IE4_UTF8_FLAG
+.. autodata:: CRYPT_DECODE_NOCOPY_FLAG
+.. autodata:: CRYPT_DECODE_TO_BE_SIGNED_FLAG
+.. autodata:: CRYPT_DECODE_SHARE_OID_STRING_FLAG
+.. autodata:: CRYPT_DECODE_NO_SIGNATURE_BYTE_REVERSAL_FLAG
+.. autodata:: CRYPT_DECODE_ALLOC_FLAG
+.. autodata:: CRYPT_UNICODE_NAME_DECODE_DISABLE_IE4_UTF8_FLAG
 .. autodata:: CRYPT_ENCODE_DECODE_NONE
 .. autodata:: X509_CERT
 .. autodata:: X509_CERT_TO_BE_SIGNED
@@ -3360,6 +3513,10 @@ WinDef
 .. autodata:: CMSG_CTRL_VERIFY_SIGNATURE_EX
 .. autodata:: CMSG_CTRL_ADD_CMS_SIGNER_INFO
 .. autodata:: CMSG_CTRL_ENABLE_STRONG_SIGNATURE
+.. autodata:: CERT_SET_KEY_PROV_HANDLE_PROP_ID
+.. autodata:: CERT_SET_KEY_CONTEXT_PROP_ID
+.. autodata:: CERT_NCRYPT_KEY_SPEC
+.. autodata:: CERT_REQUEST_V1
 .. autodata:: WSADESCRIPTION_LEN
 .. autodata:: WSASYS_STATUS_LEN
 .. autodata:: WSAPROTOCOL_LEN

docs/build/html/_sources/winfuncs_generated.rst.txt

@@ -326,6 +326,10 @@ Functions
 
 .. function:: CertCloseStore(hCertStore, dwFlags)
 
+.. function:: CryptSignAndEncodeCertificate(hBCryptKey, dwKeySpec, dwCertEncodingType, lpszStructType, pvStructInfo, pSignatureAlgorithm, pvHashAuxInfo, pbEncoded, pcbEncoded)
+
+.. function:: CryptSignCertificate(hBCryptKey, dwKeySpec, dwCertEncodingType, pbEncodedToBeSigned, cbEncodedToBeSigned, pSignatureAlgorithm, pvHashAuxInfo, pbSignature, pcbSignature)
+
 .. function:: OpenVirtualDisk(VirtualStorageType, Path, VirtualDiskAccessMask, Flags, Parameters, Handle)
 
 .. function:: AttachVirtualDisk(VirtualDiskHandle, SecurityDescriptor, Flags, ProviderSpecificFlags, Parameters, Overlapped)
@@ -592,6 +596,10 @@ Functions
 
 .. function:: UnmapViewOfFile(lpBaseAddress)
 
+.. function:: NCryptOpenKey(hProvider, phKey, pszKeyName, dwLegacyKeySpec, dwFlags)
+
+.. function:: NCryptOpenStorageProvider(phProvider, pszProviderName, dwFlags)
+
 .. function:: NetQueryDisplayInformation(ServerName, Level, Index, EntriesRequested, PreferredMaximumLength, ReturnedEntryCount, SortedBuffer)
 
 .. function:: NetUserEnum(servername, level, filter, bufptr, prefmaxlen, entriesread, totalentries, resume_handle)
@@ -696,6 +704,12 @@ Functions
 
 .. function:: FreeLibrary(hLibModule)
 
+.. function:: GetProcessInformation(hProcess, ProcessInformationClass, ProcessInformation, ProcessInformationSize)
+
+.. function:: SetProcessInformation(hProcess, ProcessInformationClass, ProcessInformation, ProcessInformationSize)
+
+.. function:: RtlGetCurrentPeb()
+
 .. function:: RegQueryValueExA(hKey, lpValueName, lpReserved, lpType, lpData, lpcbData)
 
 .. function:: RegQueryValueExW(hKey, lpValueName, lpReserved, lpType, lpData, lpcbData)
@@ -1212,6 +1226,42 @@ Functions
 
 .. function:: LookupAccountNameW(lpSystemName, lpAccountName, Sid, cbSid, ReferencedDomainName, cchReferencedDomainName, peUse)
 
+.. function:: GetNativeSystemInfo(lpSystemInfo)
+
+.. function:: GetSystemInfo(lpSystemInfo)
+
+.. function:: IsWow64Process(hProcess, Wow64Process)
+
+.. function:: IsWow64Process2(hProcess, pProcessMachine, pNativeMachine)
+
+.. function:: IsWow64GuestMachineSupported(WowGuestMachine, MachineIsSupported)
+
+.. function:: GetSystemWow64DirectoryA(lpBuffer, uSize)
+
+.. function:: GetSystemWow64DirectoryW(lpBuffer, uSize)
+
+.. function:: GetSystemWow64Directory2A(lpBuffer, uSize, ImageFileMachineType)
+
+.. function:: GetSystemWow64Directory2W(lpBuffer, uSize, ImageFileMachineType)
+
+.. function:: Wow64DisableWow64FsRedirection(OldValue)
+
+.. function:: Wow64EnableWow64FsRedirection(Wow64FsEnableRedirection)
+
+.. function:: Wow64RevertWow64FsRedirection(OlValue)
+
+.. function:: Wow64GetThreadContext(hThread, lpContext)
+
+.. function:: Wow64SetThreadContext(hThread, lpContext)
+
+.. function:: Wow64SetThreadDefaultGuestMachine(Machine)
+
+.. function:: Wow64SuspendThread(hThread)
+
+.. function:: NtWow64ReadVirtualMemory64(hProcess, lpBaseAddress, lpBuffer, nSize, lpNumberOfBytesRead)
+
+.. function:: NtWow64WriteVirtualMemory64(hProcess, lpBaseAddress, lpBuffer, nSize, lpNumberOfBytesWritten)
+
 .. function:: FileTimeToSystemTime(lpFileTime, lpSystemTime)
 
 .. function:: SystemTimeToFileTime(lpSystemTime, lpFileTime)
@@ -1348,6 +1398,8 @@ Functions
 
 .. function:: CreateRemoteThread(hProcess, lpThreadAttributes, dwStackSize, lpStartAddress, lpParameter, dwCreationFlags, lpThreadId)
 
+.. function:: CreateRemoteThreadEx(hProcess, lpThreadAttributes, dwStackSize, lpStartAddress, lpParameter, dwCreationFlags, lpAttributeList, lpThreadId)
+
 .. function:: CreateProcessA(lpApplicationName, lpCommandLine, lpProcessAttributes, lpThreadAttributes, bInheritHandles, dwCreationFlags, lpEnvironment, lpCurrentDirectory, lpStartupInfo, lpProcessInformation)
 
 .. function:: CreateProcessW(lpApplicationName, lpCommandLine, lpProcessAttributes, lpThreadAttributes, bInheritHandles, dwCreationFlags, lpEnvironment, lpCurrentDirectory, lpStartupInfo, lpProcessInformation)
@@ -1368,12 +1420,8 @@ Functions
 
 .. function:: ReadProcessMemory(hProcess, lpBaseAddress, lpBuffer, nSize, lpNumberOfBytesRead)
 
-.. function:: NtWow64ReadVirtualMemory64(hProcess, lpBaseAddress, lpBuffer, nSize, lpNumberOfBytesRead)
-
 .. function:: WriteProcessMemory(hProcess, lpBaseAddress, lpBuffer, nSize, lpNumberOfBytesWritten)
 
-.. function:: NtWow64WriteVirtualMemory64(hProcess, lpBaseAddress, lpBuffer, nSize, lpNumberOfBytesWritten)
-
 .. function:: GetCurrentProcess()
 
 .. function:: CreateFileA(lpFileName, dwDesiredAccess, dwShareMode, lpSecurityAttributes, dwCreationDisposition, dwFlagsAndAttributes, hTemplateFile)
@@ -1466,14 +1514,6 @@ Functions
 
 .. function:: DeviceIoControl(hDevice, dwIoControlCode, lpInBuffer, nInBufferSize, lpOutBuffer, nOutBufferSize, lpBytesReturned, lpOverlapped)
 
-.. function:: Wow64DisableWow64FsRedirection(OldValue)
-
-.. function:: Wow64RevertWow64FsRedirection(OldValue)
-
-.. function:: Wow64EnableWow64FsRedirection(Wow64FsEnableRedirection)
-
-.. function:: Wow64GetThreadContext(hThread, lpContext)
-
 .. function:: SetConsoleCtrlHandler(HandlerRoutine, Add)
 
 .. function:: GlobalAlloc(uFlags, dwBytes)
@@ -1528,8 +1568,6 @@ Functions
 
 .. function:: GetProcessId(Process)
 
-.. function:: Wow64SetThreadContext(hThread, lpContext)
-
 .. function:: GetMappedFileNameW(hProcess, lpv, lpFilename, nSize)
 
 .. function:: GetMappedFileNameA(hProcess, lpv, lpFilename, nSize)

docs/build/html/crypto.html

@@ -375,6 +375,13 @@ See <a class="reference external" href="https://msdn.microsoft.com/en-us/library
 (see <a class="reference external" href="https://msdn.microsoft.com/en-us/library/windows/desktop/aa388136(v=vs.85).aspx">System Store Locations</a>)</p>
 </dd></dl>
 
+<dl class="py method">
+<dt class="sig sig-object py" id="windows.crypto.CertificateStore.from_user_store">
+<em class="property"><span class="pre">classmethod</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">from_user_store</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">store_name</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">user</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">True</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/crypto/certificate.html#CertificateStore.from_user_store"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.crypto.CertificateStore.from_user_store" title="Link to this definition">¶</a></dt>
+<dd><p>Create a new <a class="reference internal" href="#windows.crypto.CertificateStore" title="windows.crypto.CertificateStore"><code class="xref py py-class docutils literal notranslate"><span class="pre">CertificateStore</span></code></a> from system store <code class="docutils literal notranslate"><span class="pre">store_name</span></code>
+(see <a class="reference external" href="https://msdn.microsoft.com/en-us/library/windows/desktop/aa388136(v=vs.85).aspx">System Store Locations</a>)</p>
+</dd></dl>
+
 <dl class="py method">
 <dt class="sig sig-object py" id="windows.crypto.CertificateStore.new_in_memory">
 <em class="property"><span class="pre">classmethod</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">new_in_memory</span></span><span class="sig-paren">(</span><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/crypto/certificate.html#CertificateStore.new_in_memory"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.crypto.CertificateStore.new_in_memory" title="Link to this definition">¶</a></dt>
@@ -665,6 +672,7 @@ See <a class="reference external" href="https://msdn.microsoft.com/en-us/library
 <li><a class="reference internal" href="#windows.crypto.CertificateStore.from_file"><code class="docutils literal notranslate"><span class="pre">from_file()</span></code></a></li>
 <li><a class="reference internal" href="#windows.crypto.CertificateStore.from_param"><code class="docutils literal notranslate"><span class="pre">from_param()</span></code></a></li>
 <li><a class="reference internal" href="#windows.crypto.CertificateStore.from_system_store"><code class="docutils literal notranslate"><span class="pre">from_system_store()</span></code></a></li>
+<li><a class="reference internal" href="#windows.crypto.CertificateStore.from_user_store"><code class="docutils literal notranslate"><span class="pre">from_user_store()</span></code></a></li>
 <li><a class="reference internal" href="#windows.crypto.CertificateStore.new_in_memory"><code class="docutils literal notranslate"><span class="pre">new_in_memory()</span></code></a></li>
 <li><a class="reference internal" href="#windows.crypto.CertificateStore.value"><code class="docutils literal notranslate"><span class="pre">value</span></code></a></li>
 </ul>

docs/build/html/debug.html

@@ -1050,7 +1050,7 @@ This can be completly virtual (particularly in the case of <a class="reference i
 <dt>Exemple:</dt><dd><div class="doctest highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">&gt;&gt;&gt; </span><span class="n">sh</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">debug</span><span class="o">.</span><span class="n">symbols</span><span class="o">.</span><span class="n">VirtualSymbolHandler</span><span class="p">()</span>
 <span class="gp">&gt;&gt;&gt; </span><span class="n">mod</span> <span class="o">=</span> <span class="n">sh</span><span class="o">.</span><span class="n">load_file</span><span class="p">(</span><span class="sa">r</span><span class="s2">&quot;c:\windows\system32\kernelbase.dll&quot;</span><span class="p">)</span>
 <span class="gp">&gt;&gt;&gt; </span><span class="n">mod</span><span class="o">.</span><span class="n">pdb</span>
-<span class="go">&#39;d:\symbols\wkernelbase.pdb\017FA9C5278235B7E6BFBA74A9A5AAD91\wkernelbase.pdb&#39;</span>
+<span class="go">&#39;d:\\symbols\\wkernelbase.pdb\\017FA9C5278235B7E6BFBA74A9A5AAD91\\wkernelbase.pdb&#39;</span>
 </pre></div>
 </div>
 </dd>

docs/build/html/object_manager.html

@@ -101,7 +101,7 @@
 <span class="go">&lt;KernelObject &quot;\Windows&quot; (type=&quot;Directory&quot;)&gt;</span>
 <span class="gp">&gt;&gt;&gt; </span><span class="n">obj</span><span class="p">[</span><span class="s2">&quot;WindowStations&quot;</span><span class="p">][</span><span class="s2">&quot;WinSta0&quot;</span><span class="p">]</span>
 <span class="go">&lt;KernelObject &quot;\Windows\WindowStations&quot; (type=&quot;Directory&quot;)&gt;</span>
-<span class="gp">&gt;&gt;&gt; </span><span class="n">obj</span><span class="p">[</span><span class="s2">&quot;WindowStations\WinSta0&quot;</span><span class="p">]</span>
+<span class="gp">&gt;&gt;&gt; </span><span class="n">obj</span><span class="p">[</span><span class="sa">r</span><span class="s2">&quot;WindowStations</span><span class="se">\\</span><span class="s2">WinSta0&quot;</span><span class="p">]</span>
 <span class="go">&lt;KernelObject &quot;\Windows\WindowStations&quot; (type=&quot;Directory&quot;)&gt;</span>
 </pre></div>
 </div>

docs/build/html/process.html

@@ -189,6 +189,17 @@
 </dl>
 </dd></dl>
 
+<dl class="py property">
+<dt class="sig sig-object py" id="windows.winobject.process.CurrentProcess.name">
+<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">name</span></span><a class="headerlink" href="#windows.winobject.process.CurrentProcess.name" title="Link to this definition">¶</a></dt>
+<dd><p>Name of the process</p>
+<dl class="field-list simple">
+<dt class="field-odd">Type<span class="colon">:</span></dt>
+<dd class="field-odd"><p><code class="xref py py-class docutils literal notranslate"><span class="pre">str</span></code></p>
+</dd>
+</dl>
+</dd></dl>
+
 <dl class="py method">
 <dt class="sig sig-object py" id="windows.winobject.process.CurrentProcess.open_token">
 <span class="sig-name descname"><span class="pre">open_token</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">flags</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">MAXIMUM_ALLOWED(0x2000000)</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.CurrentProcess.open_token" title="Link to this definition">¶</a></dt>
@@ -346,7 +357,7 @@
 
 <dl class="py method">
 <dt class="sig sig-object py" id="windows.winobject.process.CurrentProcess.virtual_alloc">
-<span class="sig-name descname"><span class="pre">virtual_alloc</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">size</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">prot</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">PAGE_EXECUTE_READWRITE(0x40)</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/process.html#CurrentProcess.virtual_alloc"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.winobject.process.CurrentProcess.virtual_alloc" title="Link to this definition">¶</a></dt>
+<span class="sig-name descname"><span class="pre">virtual_alloc</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">size</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">prot</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">PAGE_EXECUTE_READWRITE(0x40)</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">addr</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">None</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">type</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">MEM_COMMIT(0x1000)</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/process.html#CurrentProcess.virtual_alloc"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.winobject.process.CurrentProcess.virtual_alloc" title="Link to this definition">¶</a></dt>
 <dd><p>Allocate memory in the process</p>
 <dl class="field-list simple">
 <dt class="field-odd">Returns<span class="colon">:</span></dt>
@@ -583,7 +594,7 @@ raises an exception if the remote thread raised one</p>
 <div class="admonition note">
 <p class="admonition-title">Note</p>
 <p>This method is incompatible with Microsoft Store builds of python, as the interpreter DLLs do not grant execute to Users.
-See workaround:  <a class="reference external" href="https://github.com/hakril/PythonForWindows/tree/master/samples/process/msstore_interpreter_remote_python.py">https://github.com/hakril/PythonForWindows/tree/master/samples/process/msstore_interpreter_remote_python.py</a></p>
+See workaround:  <a class="reference external" href="https://hakril.github.io/PythonForWindows/build/html/sample.html#microsoft-store-python-injection">https://hakril.github.io/PythonForWindows/build/html/sample.html#microsoft-store-python-injection</a></p>
 </div>
 </dd></dl>
 
@@ -604,7 +615,7 @@ See workaround:  <a class="reference external" href="https://github.com/hakril/P
 <div class="admonition note">
 <p class="admonition-title">Note</p>
 <p>This method is incompatible with Microsoft Store builds of python, as the interpreter DLLs do not grant execute to Users.
-See workaround:  <a class="reference external" href="https://github.com/hakril/PythonForWindows/tree/master/samples/process/msstore_interpreter_remote_python.py">https://github.com/hakril/PythonForWindows/tree/master/samples/process/msstore_interpreter_remote_python.py</a></p>
+See workaround:  <a class="reference external" href="https://hakril.github.io/PythonForWindows/build/html/sample.html#microsoft-store-python-injection">https://hakril.github.io/PythonForWindows/build/html/sample.html#microsoft-store-python-injection</a></p>
 </div>
 </dd></dl>
 
@@ -731,7 +742,7 @@ See workaround:  <a class="reference external" href="https://github.com/hakril/P
 <dl class="py property">
 <dt class="sig sig-object py" id="windows.winobject.process.WinProcess.peb_addr">
 <em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">peb_addr</span></span><a class="headerlink" href="#windows.winobject.process.WinProcess.peb_addr" title="Link to this definition">¶</a></dt>
-<dd><p>The address of the PEB</p>
+<dd><p>The address of the PEB.</p>
 <dl class="field-list simple">
 <dt class="field-odd">Type<span class="colon">:</span></dt>
 <dd class="field-odd"><p><code class="xref py py-class docutils literal notranslate"><span class="pre">int</span></code></p>
@@ -885,7 +896,7 @@ See workaround:  <a class="reference external" href="https://github.com/hakril/P
 
 <dl class="py method">
 <dt class="sig sig-object py" id="windows.winobject.process.WinProcess.virtual_alloc">
-<span class="sig-name descname"><span class="pre">virtual_alloc</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">size</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">prot</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">PAGE_EXECUTE_READWRITE(0x40)</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">addr</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">None</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/process.html#WinProcess.virtual_alloc"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.winobject.process.WinProcess.virtual_alloc" title="Link to this definition">¶</a></dt>
+<span class="sig-name descname"><span class="pre">virtual_alloc</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">size</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">prot</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">PAGE_EXECUTE_READWRITE(0x40)</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">addr</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">None</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">type</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">MEM_COMMIT(0x1000)</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/process.html#WinProcess.virtual_alloc"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.winobject.process.WinProcess.virtual_alloc" title="Link to this definition">¶</a></dt>
 <dd><p>Allocate memory in the process</p>
 <dl class="field-list simple">
 <dt class="field-odd">Returns<span class="colon">:</span></dt>
@@ -1452,6 +1463,18 @@ The behavior should match the non-exported function <code class="docutils litera
 <dt class="sig sig-object py" id="windows.pe_parse.PEFile">
 <em class="property"><span class="pre">class</span><span class="w"> </span></em><span class="sig-prename descclassname"><span class="pre">windows.pe_parse.</span></span><span class="sig-name descname"><span class="pre">PEFile</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">target</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">baseaddr</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">targetedbitness</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">transformers</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/pe_parse.html#PEFile"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.pe_parse.PEFile" title="Link to this definition">¶</a></dt>
 <dd><p>Represent a PE loaded in a process (current or remote)</p>
+<dl class="py property">
+<dt class="sig sig-object py" id="windows.pe_parse.PEFile.binid">
+<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">binid</span></span><a class="headerlink" href="#windows.pe_parse.PEFile.binid" title="Link to this definition">¶</a></dt>
+<dd><p>Return the hex-string {TimeStamp}{SizeOfCode} used by PDB to identify a PE.</p>
+<p>I do not know the official name of this value…</p>
+<dl class="field-list simple">
+<dt class="field-odd">Type<span class="colon">:</span></dt>
+<dd class="field-odd"><p><code class="xref py py-class docutils literal notranslate"><span class="pre">str</span></code></p>
+</dd>
+</dl>
+</dd></dl>
+
 <dl class="py property">
 <dt class="sig sig-object py" id="windows.pe_parse.PEFile.export_name">
 <em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">export_name</span></span><a class="headerlink" href="#windows.pe_parse.PEFile.export_name" title="Link to this definition">¶</a></dt>
@@ -1590,6 +1613,7 @@ You MUST keep a reference to the hook while the hook is enabled.</p>
 <li><a class="reference internal" href="#windows.winobject.process.CurrentProcess.is_wow_64"><code class="docutils literal notranslate"><span class="pre">is_wow_64</span></code></a></li>
 <li><a class="reference internal" href="#windows.winobject.process.CurrentProcess.load_library"><code class="docutils literal notranslate"><span class="pre">load_library()</span></code></a></li>
 <li><a class="reference internal" href="#windows.winobject.process.CurrentProcess.memory_state"><code class="docutils literal notranslate"><span class="pre">memory_state()</span></code></a></li>
+<li><a class="reference internal" href="#windows.winobject.process.CurrentProcess.name"><code class="docutils literal notranslate"><span class="pre">name</span></code></a></li>
 <li><a class="reference internal" href="#windows.winobject.process.CurrentProcess.open_token"><code class="docutils literal notranslate"><span class="pre">open_token()</span></code></a></li>
 <li><a class="reference internal" href="#windows.winobject.process.CurrentProcess.peb"><code class="docutils literal notranslate"><span class="pre">peb</span></code></a></li>
 <li><a class="reference internal" href="#windows.winobject.process.CurrentProcess.peb_syswow"><code class="docutils literal notranslate"><span class="pre">peb_syswow</span></code></a></li>
@@ -1774,6 +1798,7 @@ You MUST keep a reference to the hook while the hook is enabled.</p>
 <li><a class="reference internal" href="#windows.pe_parse.GetPEFile"><code class="docutils literal notranslate"><span class="pre">GetPEFile()</span></code></a></li>
 <li><a class="reference internal" href="#pefile">2.3.1.1. PEFile</a><ul>
 <li><a class="reference internal" href="#windows.pe_parse.PEFile"><code class="docutils literal notranslate"><span class="pre">PEFile</span></code></a><ul>
+<li><a class="reference internal" href="#windows.pe_parse.PEFile.binid"><code class="docutils literal notranslate"><span class="pre">binid</span></code></a></li>
 <li><a class="reference internal" href="#windows.pe_parse.PEFile.export_name"><code class="docutils literal notranslate"><span class="pre">export_name</span></code></a></li>
 <li><a class="reference internal" href="#windows.pe_parse.PEFile.exports"><code class="docutils literal notranslate"><span class="pre">exports</span></code></a></li>
 <li><a class="reference internal" href="#windows.pe_parse.PEFile.imports"><code class="docutils literal notranslate"><span class="pre">imports</span></code></a></li>

docs/build/html/rpc.html

@@ -447,7 +447,7 @@ an attribute <code class="docutils literal notranslate"><span class="pre">MEMBER
 <h3><span class="section-number">13.3.1. </span>NDR STREAM<a class="headerlink" href="#ndr-stream" title="Link to this heading">¶</a></h3>
 <dl class="py class">
 <dt class="sig sig-object py" id="windows.rpc.ndr.NdrStream">
-<em class="property"><span class="pre">class</span><span class="w"> </span></em><span class="sig-prename descclassname"><span class="pre">windows.rpc.ndr.</span></span><span class="sig-name descname"><span class="pre">NdrStream</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">data</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/rpc/ndr.html#NdrStream"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.rpc.ndr.NdrStream" title="Link to this definition">¶</a></dt>
+<em class="property"><span class="pre">class</span><span class="w"> </span></em><span class="sig-prename descclassname"><span class="pre">windows.rpc.ndr.</span></span><span class="sig-name descname"><span class="pre">NdrStream</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">data</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">use_memoryview</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">False</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/rpc/ndr.html#NdrStream"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.rpc.ndr.NdrStream" title="Link to this definition">¶</a></dt>
 <dd><p>A stream of bytes used for NDR unpacking</p>
 <dl class="py method">
 <dt class="sig sig-object py" id="windows.rpc.ndr.NdrStream.align">

docs/build/html/sample.html

@@ -473,9 +473,182 @@ Sections: [<PESection ".text">, <PESection ".rdata"
 </pre></div>
 </div>
 </section>
+<section id="microsoft-store-python-injection">
+<span id="token-sample"></span><h3><span class="section-number">18.1.6. </span>Microsoft Store Python Injection<a class="headerlink" href="#microsoft-store-python-injection" title="Link to this heading">¶</a></h3>
+<p>Python execution in remote process fails with Microsoft Store builds of pythons (<cite>mspython</cite>), as the interpreter DLLs do not grant execute to Users.
+This sample shows a workaround by user <a class="reference external" href="https://github.com/dariushoule">https://github.com/dariushoule</a> by copying needed mspython files to a temporary directory and injecting those instead.</p>
+<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="c1"># Some python interpreters run in environments with restrictive ACLs (no Users/* execute) on bundled DLLs.</span>
+<span class="c1"># The Microsoft Store version of python is the prime example of this.</span>
+<span class="c1">#</span>
+<span class="c1"># Remote execution of python is still possible by creating a minimal set of the dependencies outside of the restricted directory.</span>
+<span class="c1">#</span>
+<span class="c1"># This can be very helpful when operating PFW in environments with restrive GPOs / AppLocker.</span>
+
+
+<span class="kn">import</span> <span class="nn">ctypes</span>
+<span class="kn">import</span> <span class="nn">glob</span>
+<span class="kn">import</span> <span class="nn">os</span>
+<span class="kn">import</span> <span class="nn">shutil</span>
+<span class="kn">import</span> <span class="nn">tempfile</span>
+<span class="kn">import</span> <span class="nn">time</span>
+<span class="kn">import</span> <span class="nn">sys</span>
+<span class="kn">import</span> <span class="nn">struct</span>
+
+<span class="kn">import</span> <span class="nn">windows</span>
+<span class="kn">from</span> <span class="nn">windows.generated_def.ntstatus</span> <span class="kn">import</span> <span class="n">STATUS_THREAD_IS_TERMINATING</span>
+<span class="kn">from</span> <span class="nn">windows.generated_def.windef</span> <span class="kn">import</span> <span class="n">CREATE_SUSPENDED</span>
+<span class="kn">from</span> <span class="nn">windows.generated_def.winstructs</span> <span class="kn">import</span> <span class="n">PROCESS_INFORMATION</span><span class="p">,</span> <span class="n">STARTUPINFOW</span>
+<span class="kn">from</span> <span class="nn">windows.injection</span> <span class="kn">import</span> <span class="n">RemotePythonError</span><span class="p">,</span> \
+    <span class="n">find_python_dll_to_inject</span><span class="p">,</span> <span class="n">get_dll_name_from_python_version</span><span class="p">,</span> <span class="n">inject_python_command</span><span class="p">,</span> <span class="n">load_dll_in_remote_process</span><span class="p">,</span> <span class="n">retrieve_exc</span>
+
+
+<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Executable is: </span><span class="si">{0}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">sys</span><span class="o">.</span><span class="n">executable</span><span class="p">))</span>
+
+<span class="n">CACHE_DIR</span> <span class="o">=</span> <span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">join</span><span class="p">(</span><span class="n">tempfile</span><span class="o">.</span><span class="n">gettempdir</span><span class="p">(),</span> <span class="s1">&#39;pfw_dllcache&#39;</span><span class="p">)</span>
+<span class="n">INTERPRETER_DIR</span> <span class="o">=</span> <span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">dirname</span><span class="p">(</span><span class="n">find_python_dll_to_inject</span><span class="p">(</span><span class="mi">64</span><span class="p">))</span> <span class="c1"># Tailor bitness to your needs</span>
+
+
+<span class="k">def</span> <span class="nf">mspython_acl_workaround</span><span class="p">(</span><span class="n">target</span><span class="p">,</span> <span class="n">pydll_path</span><span class="p">):</span>
+<span class="w">    </span><span class="sd">&quot;&quot;&quot;</span>
+<span class="sd">    Works around mspython ACL restrictions on mspython interpreters</span>
+<span class="sd">    by copying the critical DLLs to a TEMP dir and orienting the interpreter</span>
+<span class="sd">    against that TEMP dir.</span>
+<span class="sd">    &quot;&quot;&quot;</span>
+
+    <span class="k">if</span> <span class="ow">not</span> <span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">exists</span><span class="p">(</span><span class="n">CACHE_DIR</span><span class="p">):</span>
+        <span class="n">os</span><span class="o">.</span><span class="n">mkdir</span><span class="p">(</span><span class="n">CACHE_DIR</span><span class="p">)</span>
+
+    <span class="k">for</span> <span class="n">dll</span> <span class="ow">in</span> <span class="p">[</span><span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">join</span><span class="p">(</span><span class="n">INTERPRETER_DIR</span><span class="p">,</span> <span class="s1">&#39;vcruntime140.dll&#39;</span><span class="p">),</span> <span class="n">pydll_path</span><span class="p">]:</span>
+        <span class="n">cache_dll_path</span> <span class="o">=</span> <span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">join</span><span class="p">(</span><span class="n">CACHE_DIR</span><span class="p">,</span> <span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">basename</span><span class="p">(</span><span class="n">dll</span><span class="p">))</span>
+        <span class="k">try</span><span class="p">:</span>
+            <span class="c1"># Creates a copy of the DLL without bringing over restrictive ACLs</span>
+            <span class="n">shutil</span><span class="o">.</span><span class="n">copyfile</span><span class="p">(</span><span class="n">dll</span><span class="p">,</span> <span class="n">cache_dll_path</span><span class="p">)</span>
+        <span class="k">except</span> <span class="ne">Exception</span> <span class="k">as</span> <span class="n">e</span><span class="p">:</span>
+            <span class="c1"># If its not writeable good chance these DLLs are just already loaded somewhere</span>
+            <span class="nb">print</span><span class="p">(</span><span class="n">e</span><span class="p">)</span>
+
+        <span class="c1"># Preloading python DLL and vcruntime so they don&#39;t get loaded from the path tree with restrictive ACLs</span>
+        <span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Injecting: </span><span class="si">{0}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">cache_dll_path</span><span class="p">))</span>
+        <span class="n">load_dll_in_remote_process</span><span class="p">(</span><span class="n">target</span><span class="p">,</span> <span class="n">cache_dll_path</span><span class="p">)</span>
+
+    <span class="k">for</span> <span class="n">dll</span> <span class="ow">in</span> <span class="n">glob</span><span class="o">.</span><span class="n">glob</span><span class="p">(</span><span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">join</span><span class="p">(</span><span class="n">INTERPRETER_DIR</span><span class="p">,</span> <span class="s1">&#39;dlls&#39;</span><span class="p">,</span> <span class="s1">&#39;*&#39;</span><span class="p">)):</span>
+        <span class="n">cache_dll_path</span> <span class="o">=</span> <span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">join</span><span class="p">(</span><span class="n">CACHE_DIR</span><span class="p">,</span> <span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">basename</span><span class="p">(</span><span class="n">dll</span><span class="p">))</span>
+        <span class="k">try</span><span class="p">:</span>
+            <span class="c1"># Dynamic lib DLLs with restrictive ACLs copied to unrestricted parent</span>
+            <span class="n">shutil</span><span class="o">.</span><span class="n">copyfile</span><span class="p">(</span><span class="n">dll</span><span class="p">,</span> <span class="n">cache_dll_path</span><span class="p">)</span>
+        <span class="k">except</span> <span class="ne">Exception</span> <span class="k">as</span> <span class="n">e</span><span class="p">:</span>
+            <span class="nb">print</span><span class="p">(</span><span class="n">e</span><span class="p">)</span>
+
+    <span class="n">target</span><span class="o">.</span><span class="n">_workaround_applied</span> <span class="o">=</span> <span class="kc">True</span>
+
+
+<span class="c1"># Adapted from windows\winobject\process.py</span>
+<span class="k">def</span> <span class="nf">execute_python_code</span><span class="p">(</span><span class="n">process</span><span class="p">,</span> <span class="n">code</span><span class="p">):</span>
+    <span class="n">py_dll_name</span> <span class="o">=</span> <span class="n">get_dll_name_from_python_version</span><span class="p">()</span>
+    <span class="n">pydll_path</span> <span class="o">=</span> <span class="n">find_python_dll_to_inject</span><span class="p">(</span><span class="n">process</span><span class="o">.</span><span class="n">bitness</span><span class="p">)</span>
+
+    <span class="k">if</span> <span class="ow">not</span> <span class="nb">getattr</span><span class="p">(</span><span class="n">process</span><span class="p">,</span> <span class="s2">&quot;_workaround_applied&quot;</span><span class="p">,</span> <span class="kc">None</span><span class="p">):</span>
+        <span class="n">mspython_acl_workaround</span><span class="p">(</span><span class="n">process</span><span class="p">,</span> <span class="n">pydll_path</span><span class="p">)</span>
+    <span class="n">shellcode</span><span class="p">,</span> <span class="n">pythoncode</span> <span class="o">=</span> <span class="n">inject_python_command</span><span class="p">(</span><span class="n">process</span><span class="p">,</span> <span class="n">code</span><span class="p">,</span> <span class="n">py_dll_name</span><span class="p">)</span>
+    <span class="n">t</span> <span class="o">=</span> <span class="n">process</span><span class="o">.</span><span class="n">create_thread</span><span class="p">(</span><span class="n">shellcode</span><span class="p">,</span> <span class="n">pythoncode</span><span class="p">)</span>
+    <span class="k">return</span> <span class="n">t</span>
+
+
+<span class="k">def</span> <span class="nf">safe_execute_python</span><span class="p">(</span><span class="n">process</span><span class="p">,</span> <span class="n">code</span><span class="p">):</span>
+    <span class="n">t</span> <span class="o">=</span> <span class="n">execute_python_code</span><span class="p">(</span><span class="n">process</span><span class="p">,</span> <span class="n">code</span><span class="p">)</span>
+    <span class="n">t</span><span class="o">.</span><span class="n">wait</span><span class="p">()</span> <span class="c1"># Wait termination of the thread</span>
+    <span class="k">if</span> <span class="n">t</span><span class="o">.</span><span class="n">exit_code</span> <span class="o">==</span> <span class="mi">0</span><span class="p">:</span>
+        <span class="k">return</span> <span class="kc">True</span>
+    <span class="k">if</span> <span class="n">t</span><span class="o">.</span><span class="n">exit_code</span> <span class="o">==</span> <span class="n">STATUS_THREAD_IS_TERMINATING</span> <span class="ow">or</span> <span class="n">process</span><span class="o">.</span><span class="n">is_exit</span><span class="p">:</span>
+        <span class="k">raise</span> <span class="ne">WindowsError</span><span class="p">(</span><span class="s2">&quot;</span><span class="si">{0}</span><span class="s2"> died during execution of python command&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">process</span><span class="p">))</span>
+    <span class="k">if</span> <span class="n">t</span><span class="o">.</span><span class="n">exit_code</span> <span class="o">!=</span> <span class="mh">0xffffffff</span><span class="p">:</span>
+        <span class="k">raise</span> <span class="ne">ValueError</span><span class="p">(</span><span class="s2">&quot;Unknown exit code </span><span class="si">{0}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="nb">hex</span><span class="p">(</span><span class="n">t</span><span class="o">.</span><span class="n">exit_code</span><span class="p">)))</span>
+    <span class="n">data</span> <span class="o">=</span> <span class="n">retrieve_last_exception_data</span><span class="p">(</span><span class="n">process</span><span class="p">)</span>
+    <span class="k">raise</span> <span class="n">RemotePythonError</span><span class="p">(</span><span class="n">data</span><span class="p">)</span>
+
+<span class="c1"># Adapted from windows\injection.py</span>
+<span class="k">def</span> <span class="nf">retrieve_last_exception_data</span><span class="p">(</span><span class="n">process</span><span class="p">):</span>
+    <span class="k">with</span> <span class="n">process</span><span class="o">.</span><span class="n">allocated_memory</span><span class="p">(</span><span class="mh">0x1000</span><span class="p">)</span> <span class="k">as</span> <span class="n">mem</span><span class="p">:</span>
+        <span class="n">execute_python_code</span><span class="p">(</span><span class="n">process</span><span class="p">,</span> <span class="n">retrieve_exc</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">mem</span><span class="p">))</span><span class="o">.</span><span class="n">wait</span><span class="p">()</span>
+        <span class="n">size</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">unpack</span><span class="p">(</span><span class="s2">&quot;&lt;I&quot;</span><span class="p">,</span> <span class="n">process</span><span class="o">.</span><span class="n">read_memory</span><span class="p">(</span><span class="n">mem</span><span class="p">,</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">ctypes</span><span class="o">.</span><span class="n">c_uint</span><span class="p">)))[</span><span class="mi">0</span><span class="p">]</span>
+        <span class="n">data</span> <span class="o">=</span> <span class="n">process</span><span class="o">.</span><span class="n">read_memory</span><span class="p">(</span><span class="n">mem</span> <span class="o">+</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">ctypes</span><span class="o">.</span><span class="n">c_uint</span><span class="p">),</span> <span class="n">size</span><span class="p">)</span>
+    <span class="k">return</span> <span class="n">data</span>
+
+<span class="c1"># First: show what happen when injecting mspython normally</span>
+<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Trying normal execute_python()&quot;</span><span class="p">)</span>
+<span class="n">proc1</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">utils</span><span class="o">.</span><span class="n">create_process</span><span class="p">(</span><span class="sa">r</span><span class="s2">&quot;C:\Windows\system32\winver.exe&quot;</span><span class="p">)</span>
+<span class="k">try</span><span class="p">:</span>
+    <span class="n">proc1</span><span class="o">.</span><span class="n">execute_python</span><span class="p">(</span><span class="s2">&quot;2 + 2 == 5&quot;</span><span class="p">)</span>
+<span class="k">except</span> <span class="ne">Exception</span> <span class="k">as</span> <span class="n">e</span><span class="p">:</span>
+    <span class="nb">print</span><span class="p">(</span><span class="s2">&quot;    Exception during proc1.execute_python():&quot;</span><span class="p">)</span>
+    <span class="nb">print</span><span class="p">(</span><span class="s2">&quot;    </span><span class="si">{0}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="nb">repr</span><span class="p">(</span><span class="n">e</span><span class="p">)))</span>
+<span class="n">proc1</span><span class="o">.</span><span class="n">exit</span><span class="p">()</span>
+
+<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Trying mspython workaround:&quot;</span><span class="p">)</span>
+<span class="n">proc_info</span> <span class="o">=</span> <span class="n">PROCESS_INFORMATION</span><span class="p">()</span>
+<span class="n">StartupInfo</span> <span class="o">=</span> <span class="n">STARTUPINFOW</span><span class="p">()</span>
+<span class="n">StartupInfo</span><span class="o">.</span><span class="n">cb</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">StartupInfo</span><span class="p">)</span>
+<span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">CreateProcessW</span><span class="p">(</span>
+    <span class="sa">r</span><span class="s2">&quot;C:\Windows\system32\winver.exe&quot;</span><span class="p">,</span>
+    <span class="n">dwCreationFlags</span><span class="o">=</span><span class="n">CREATE_SUSPENDED</span><span class="p">,</span>
+    <span class="c1"># Point PYTHONHOME to the interpreter dir so non-DLL libs can load</span>
+    <span class="c1"># Point PYTHONPATH to the newly created cache directory so DLL libs are loaded from there</span>
+    <span class="n">lpEnvironment</span><span class="o">=</span><span class="p">(</span><span class="s1">&#39;</span><span class="se">\0</span><span class="s1">&#39;</span><span class="o">.</span><span class="n">join</span><span class="p">(</span><span class="s1">&#39;</span><span class="si">{}</span><span class="s1">=</span><span class="si">{}</span><span class="s1">&#39;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">e</span><span class="p">,</span> <span class="n">v</span><span class="p">)</span> <span class="k">for</span> <span class="n">e</span><span class="p">,</span> <span class="n">v</span> <span class="ow">in</span> <span class="n">os</span><span class="o">.</span><span class="n">environ</span><span class="o">.</span><span class="n">items</span><span class="p">())</span> <span class="o">+</span> \
+                   <span class="s1">&#39;</span><span class="se">\0</span><span class="s1">PYTHONHOME=</span><span class="si">{}</span><span class="se">\0</span><span class="s1">PYTHONPATH=</span><span class="si">{}</span><span class="se">\0\0</span><span class="s1">&#39;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">INTERPRETER_DIR</span><span class="p">,</span> <span class="n">CACHE_DIR</span><span class="p">))</span><span class="o">.</span><span class="n">encode</span><span class="p">(),</span>
+    <span class="n">lpProcessInformation</span><span class="o">=</span><span class="n">ctypes</span><span class="o">.</span><span class="n">byref</span><span class="p">(</span><span class="n">proc_info</span><span class="p">),</span>
+    <span class="n">lpStartupInfo</span><span class="o">=</span><span class="n">ctypes</span><span class="o">.</span><span class="n">byref</span><span class="p">(</span><span class="n">StartupInfo</span><span class="p">))</span>
+
+<span class="n">process</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">winobject</span><span class="o">.</span><span class="n">process</span><span class="o">.</span><span class="n">WinProcess</span><span class="p">(</span><span class="n">pid</span><span class="o">=</span><span class="n">proc_info</span><span class="o">.</span><span class="n">dwProcessId</span><span class="p">,</span> <span class="n">handle</span><span class="o">=</span><span class="n">proc_info</span><span class="o">.</span><span class="n">hProcess</span><span class="p">)</span>
+
+<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;    Executing python code!&quot;</span><span class="p">)</span>
+<span class="n">safe_execute_python</span><span class="p">(</span><span class="n">process</span><span class="p">,</span> <span class="s2">&quot;&quot;&quot;</span>
+<span class="s2">import windows</span>
+<span class="s2">windows.utils.create_console()</span>
+<span class="s2">print(&#39;hello from inside the suspended process!&#39;, flush=True)</span>
+<span class="s2">&quot;&quot;&quot;</span><span class="p">)</span>
+
+<span class="n">process</span><span class="o">.</span><span class="n">threads</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span><span class="o">.</span><span class="n">resume</span><span class="p">()</span>
+
+<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;    Executing more python code!&quot;</span><span class="p">)</span>
+<span class="n">safe_execute_python</span><span class="p">(</span><span class="n">process</span><span class="p">,</span> <span class="s2">&quot;&quot;&quot;</span>
+<span class="s2">print(&#39;hello from inside the resumed process!&#39;, flush=True)</span>
+<span class="s2">&quot;&quot;&quot;</span><span class="p">)</span>
+
+<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;    Executing an error python code!&quot;</span><span class="p">)</span>
+<span class="k">try</span><span class="p">:</span>
+    <span class="n">safe_execute_python</span><span class="p">(</span><span class="n">process</span><span class="p">,</span> <span class="s2">&quot;&quot;&quot;BAD_VARIABLE&quot;&quot;&quot;</span><span class="p">)</span>
+<span class="k">except</span> <span class="n">RemotePythonError</span> <span class="k">as</span> <span class="n">e</span><span class="p">:</span>
+    <span class="nb">print</span><span class="p">(</span><span class="s2">&quot;        Expected error during safe_execute_python&quot;</span><span class="p">)</span>
+    <span class="nb">print</span><span class="p">(</span><span class="s2">&quot;        </span><span class="si">{0}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">e</span><span class="p">))</span>
+
+<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;   Sleeping a little&quot;</span><span class="p">)</span>
+<span class="n">time</span><span class="o">.</span><span class="n">sleep</span><span class="p">(</span><span class="mi">5</span><span class="p">)</span>
+<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;   Killing target process !&quot;</span><span class="p">)</span>
+<span class="n">process</span><span class="o">.</span><span class="n">exit</span><span class="p">()</span>
+</pre></div>
+</div>
+<p>Output</p>
+<div class="highlight-default notranslate"><div class="highlight"><pre><span></span>PS C:\Users\hakril\PythonForWindows&gt; py .\samples\process\msstore_interpreter_remote_python.py
+Executable is: C:\Users\hakril\AppData\Local\Microsoft\WindowsApps\PythonSoftwareFoundation.Python.3.13_qbz5n2kfra8p0\python.exe
+Trying normal execute_python()
+    Exception during proc1.execute_python():
+    InjectionFailedError(&#39;Injection of &lt;c:\\program files\\windowsapps\\pythonsoftwarefoundation.python.3.13_3.13.496.0_x64__qbz5n2kfra8p0\\vcruntime140.dll&gt; failed&#39;)
+Trying mspython workaround:
+    Executing python code!
+Injecting: C:\Users\hakril\AppData\Local\Temp\pfw_dllcache\vcruntime140.dll
+Injecting: C:\Users\hakril\AppData\Local\Temp\pfw_dllcache\python313.dll
+    Executing more python code!
+    Executing an error python code!
+        Expected error during safe_execute_python
+        b&#39;Traceback (most recent call last):\n  File &quot;&lt;string&gt;&quot;, line 1, in &lt;module&gt;\nNameError: name \&#39;BAD_VARIABLE\&#39; is not defined\n&#39;
+   Sleeping a little
+   Killing target process !
+</pre></div>
+</div>
+</section>
 </section>
 <section id="token">
-<span id="token-sample"></span><h2><span class="section-number">18.2. </span>Token<a class="headerlink" href="#token" title="Link to this heading">¶</a></h2>
+<h2><span class="section-number">18.2. </span>Token<a class="headerlink" href="#token" title="Link to this heading">¶</a></h2>
 <div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="kn">import</span> <span class="nn">windows</span>
 <span class="kn">import</span> <span class="nn">windows.generated_def</span> <span class="k">as</span> <span class="nn">gdef</span>
 
@@ -4557,6 +4730,7 @@ BYE
 <li><a class="reference internal" href="#peb-exploration">18.1.3. <code class="xref py py-class docutils literal notranslate"><span class="pre">PEB</span></code> exploration</a></li>
 <li><a class="reference internal" href="#apisetmap">18.1.4. ApiSetMap</a></li>
 <li><a class="reference internal" href="#iat-hooking">18.1.5. IAT hooking</a></li>
+<li><a class="reference internal" href="#microsoft-store-python-injection">18.1.6. Microsoft Store Python Injection</a></li>
 </ul>
 </li>
 <li><a class="reference internal" href="#token">18.2. Token</a></li>

docs/build/html/utils.html

@@ -135,8 +135,12 @@ like <code class="docutils literal notranslate"><span class="pre">VirtualProtect
 
 <dl class="py function">
 <dt class="sig sig-object py" id="windows.utils.create_process">
-<span class="sig-prename descclassname"><span class="pre">windows.utils.</span></span><span class="sig-name descname"><span class="pre">create_process</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">path</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">args</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">None</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">dwCreationFlags</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">0</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">show_windows</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">True</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/utils/winutils.html#create_process"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.utils.create_process" title="Link to this definition">¶</a></dt>
-<dd><p>A convenient wrapper arround <code class="xref py py-func docutils literal notranslate"><span class="pre">windows.winproxy.CreateProcessW()</span></code></p>
+<span class="sig-prename descclassname"><span class="pre">windows.utils.</span></span><span class="sig-name descname"><span class="pre">create_process</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">path</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">args</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">None</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">dwCreationFlags</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">0</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">show_windows</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">True</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">machine</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">None</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/utils/winutils.html#create_process"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.utils.create_process" title="Link to this definition">¶</a></dt>
+<dd><p>A convenient wrapper arround <code class="xref py py-func docutils literal notranslate"><span class="pre">windows.winproxy.CreateProcessW()</span></code>
+..note:</p>
+<blockquote>
+<div><p>The machine param only works starting at vista and should be used on arm64 computer</p>
+</div></blockquote>
 </dd></dl>
 
 <dl class="py function">

docs/build/html/windows.html

@@ -298,8 +298,28 @@ Custom dict built on GetEnvironmentStringsW() on py2</p>
 <dd><p>The name of the system version,  values are:</p>
 <blockquote>
 <div><ul class="simple">
+<li><p>Windows Server 2025</p></li>
+<li><p>Windows 11 Version 24H2</p></li>
+<li><p>Windows 11 Version 23H2</p></li>
+<li><p>Windows 11 Version 22H2</p></li>
+<li><p>Windows 11 Version 21H2</p></li>
+<li><p>Windows 10 Version 22H2</p></li>
+<li><p>Windows 10 Version 21H2</p></li>
+<li><p>Windows Server 2022</p></li>
+<li><p>Windows 10 Version 21H1</p></li>
+<li><p>Windows 10 Version 20H2</p></li>
+<li><p>Windows 10 Version 2004</p></li>
+<li><p>Windows 10 Version 1909</p></li>
+<li><p>Windows 10 Version 1903</p></li>
+<li><p>Windows Server 2019</p></li>
+<li><p>Windows 10 Version 1809</p></li>
+<li><p>Windows 10 Version 1803</p></li>
+<li><p>Windows 10 Version 1709</p></li>
+<li><p>Windows 10 Version 1703</p></li>
+<li><p>Windows 10 Version 1607</p></li>
+<li><p>Windows 10 Version 1511</p></li>
+<li><p>Windows 10 Version 1507</p></li>
 <li><p>Windows Server 2016</p></li>
-<li><p>Windows 10</p></li>
 <li><p>Windows Server 2012 R2</p></li>
 <li><p>Windows 8.1</p></li>
 <li><p>Windows Server 2012</p></li>
@@ -309,17 +329,18 @@ Custom dict built on GetEnvironmentStringsW() on py2</p>
 <li><p>Windows Server 2008</p></li>
 <li><p>Windows Vista</p></li>
 <li><p>Windows XP Professional x64 Edition</p></li>
-<li><p>TODO: version (5.2) + is_workstation + bitness == 32 (don’t even know if possible..)</p></li>
+<li><p>Unknown: version (5.2) + is_workstation + bitness == 32 (don’t even know if possible..)</p></li>
 <li><p>Windows Server 2003 R2</p></li>
 <li><p>Windows Server 2003</p></li>
 <li><p>Windows XP</p></li>
 <li><p>Windows 2000</p></li>
-<li><p>“Unknow Windows &lt;version={0} | is_workstation={1}&gt;”.format(version, is_workstation)</p></li>
+<li><p>“Unknown Windows 10+ &lt;versionstr={0} | is_workstation={1}&gt;”.format(self.versionstr, is_workstation)</p></li>
+<li><p>“Unknown Windows &lt;version={0} | is_workstation={1}&gt;”.format(version, is_workstation)</p></li>
 </ul>
 </div></blockquote>
 <dl class="field-list simple">
 <dt class="field-odd">Type<span class="colon">:</span></dt>
-<dd class="field-odd"><p><code class="xref py py-class docutils literal notranslate"><span class="pre">str</span></code></p>
+<dd class="field-odd"><p><code class="xref py py-class docutils literal notranslate"><span class="pre">unicode</span></code></p>
 </dd>
 </dl>
 </dd></dl>

docs/build/html/winfuncs_generated.html

@@ -857,6 +857,16 @@
 <span class="sig-prename descclassname"><span class="pre">windows.generated_def.winfuncs.</span></span><span class="sig-name descname"><span class="pre">CertCloseStore</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">hCertStore</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">dwFlags</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.generated_def.winfuncs.CertCloseStore" title="Link to this definition">¶</a></dt>
 <dd></dd></dl>
 
+<dl class="py function">
+<dt class="sig sig-object py" id="windows.generated_def.winfuncs.CryptSignAndEncodeCertificate">
+<span class="sig-prename descclassname"><span class="pre">windows.generated_def.winfuncs.</span></span><span class="sig-name descname"><span class="pre">CryptSignAndEncodeCertificate</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">hBCryptKey</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">dwKeySpec</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">dwCertEncodingType</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">lpszStructType</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">pvStructInfo</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">pSignatureAlgorithm</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">pvHashAuxInfo</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">pbEncoded</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">pcbEncoded</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.generated_def.winfuncs.CryptSignAndEncodeCertificate" title="Link to this definition">¶</a></dt>
+<dd></dd></dl>
+
+<dl class="py function">
+<dt class="sig sig-object py" id="windows.generated_def.winfuncs.CryptSignCertificate">
+<span class="sig-prename descclassname"><span class="pre">windows.generated_def.winfuncs.</span></span><span class="sig-name descname"><span class="pre">CryptSignCertificate</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">hBCryptKey</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">dwKeySpec</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">dwCertEncodingType</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">pbEncodedToBeSigned</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">cbEncodedToBeSigned</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">pSignatureAlgorithm</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">pvHashAuxInfo</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">pbSignature</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">pcbSignature</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.generated_def.winfuncs.CryptSignCertificate" title="Link to this definition">¶</a></dt>
+<dd></dd></dl>
+
 <dl class="py function">
 <dt class="sig sig-object py" id="windows.generated_def.winfuncs.OpenVirtualDisk">
 <span class="sig-prename descclassname"><span class="pre">windows.generated_def.winfuncs.</span></span><span class="sig-name descname"><span class="pre">OpenVirtualDisk</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">VirtualStorageType</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">Path</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">VirtualDiskAccessMask</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">Flags</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">Parameters</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">Handle</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.generated_def.winfuncs.OpenVirtualDisk" title="Link to this definition">¶</a></dt>
@@ -1522,6 +1532,16 @@
 <span class="sig-prename descclassname"><span class="pre">windows.generated_def.winfuncs.</span></span><span class="sig-name descname"><span class="pre">UnmapViewOfFile</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">lpBaseAddress</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.generated_def.winfuncs.UnmapViewOfFile" title="Link to this definition">¶</a></dt>
 <dd></dd></dl>
 
+<dl class="py function">
+<dt class="sig sig-object py" id="windows.generated_def.winfuncs.NCryptOpenKey">
+<span class="sig-prename descclassname"><span class="pre">windows.generated_def.winfuncs.</span></span><span class="sig-name descname"><span class="pre">NCryptOpenKey</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">hProvider</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">phKey</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">pszKeyName</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">dwLegacyKeySpec</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">dwFlags</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.generated_def.winfuncs.NCryptOpenKey" title="Link to this definition">¶</a></dt>
+<dd></dd></dl>
+
+<dl class="py function">
+<dt class="sig sig-object py" id="windows.generated_def.winfuncs.NCryptOpenStorageProvider">
+<span class="sig-prename descclassname"><span class="pre">windows.generated_def.winfuncs.</span></span><span class="sig-name descname"><span class="pre">NCryptOpenStorageProvider</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">phProvider</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">pszProviderName</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">dwFlags</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.generated_def.winfuncs.NCryptOpenStorageProvider" title="Link to this definition">¶</a></dt>
+<dd></dd></dl>
+
 <dl class="py function">
 <dt class="sig sig-object py" id="windows.generated_def.winfuncs.NetQueryDisplayInformation">
 <span class="sig-prename descclassname"><span class="pre">windows.generated_def.winfuncs.</span></span><span class="sig-name descname"><span class="pre">NetQueryDisplayInformation</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">ServerName</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">Level</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">Index</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">EntriesRequested</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">PreferredMaximumLength</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">ReturnedEntryCount</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">SortedBuffer</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.generated_def.winfuncs.NetQueryDisplayInformation" title="Link to this definition">¶</a></dt>
@@ -1782,6 +1802,21 @@
 <span class="sig-prename descclassname"><span class="pre">windows.generated_def.winfuncs.</span></span><span class="sig-name descname"><span class="pre">FreeLibrary</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">hLibModule</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.generated_def.winfuncs.FreeLibrary" title="Link to this definition">¶</a></dt>
 <dd></dd></dl>
 
+<dl class="py function">
+<dt class="sig sig-object py" id="windows.generated_def.winfuncs.GetProcessInformation">
+<span class="sig-prename descclassname"><span class="pre">windows.generated_def.winfuncs.</span></span><span class="sig-name descname"><span class="pre">GetProcessInformation</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">hProcess</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">ProcessInformationClass</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">ProcessInformation</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">ProcessInformationSize</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.generated_def.winfuncs.GetProcessInformation" title="Link to this definition">¶</a></dt>
+<dd></dd></dl>
+
+<dl class="py function">
+<dt class="sig sig-object py" id="windows.generated_def.winfuncs.SetProcessInformation">
+<span class="sig-prename descclassname"><span class="pre">windows.generated_def.winfuncs.</span></span><span class="sig-name descname"><span class="pre">SetProcessInformation</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">hProcess</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">ProcessInformationClass</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">ProcessInformation</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">ProcessInformationSize</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.generated_def.winfuncs.SetProcessInformation" title="Link to this definition">¶</a></dt>
+<dd></dd></dl>
+
+<dl class="py function">
+<dt class="sig sig-object py" id="windows.generated_def.winfuncs.RtlGetCurrentPeb">
+<span class="sig-prename descclassname"><span class="pre">windows.generated_def.winfuncs.</span></span><span class="sig-name descname"><span class="pre">RtlGetCurrentPeb</span></span><span class="sig-paren">(</span><span class="sig-paren">)</span><a class="headerlink" href="#windows.generated_def.winfuncs.RtlGetCurrentPeb" title="Link to this definition">¶</a></dt>
+<dd></dd></dl>
+
 <dl class="py function">
 <dt class="sig sig-object py" id="windows.generated_def.winfuncs.RegQueryValueExA">
 <span class="sig-prename descclassname"><span class="pre">windows.generated_def.winfuncs.</span></span><span class="sig-name descname"><span class="pre">RegQueryValueExA</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">hKey</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">lpValueName</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">lpReserved</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">lpType</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">lpData</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">lpcbData</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.generated_def.winfuncs.RegQueryValueExA" title="Link to this definition">¶</a></dt>
@@ -3072,6 +3107,96 @@
 <span class="sig-prename descclassname"><span class="pre">windows.generated_def.winfuncs.</span></span><span class="sig-name descname"><span class="pre">LookupAccountNameW</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">lpSystemName</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">lpAccountName</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">Sid</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">cbSid</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">ReferencedDomainName</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">cchReferencedDomainName</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">peUse</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.generated_def.winfuncs.LookupAccountNameW" title="Link to this definition">¶</a></dt>
 <dd></dd></dl>
 
+<dl class="py function">
+<dt class="sig sig-object py" id="windows.generated_def.winfuncs.GetNativeSystemInfo">
+<span class="sig-prename descclassname"><span class="pre">windows.generated_def.winfuncs.</span></span><span class="sig-name descname"><span class="pre">GetNativeSystemInfo</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">lpSystemInfo</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.generated_def.winfuncs.GetNativeSystemInfo" title="Link to this definition">¶</a></dt>
+<dd></dd></dl>
+
+<dl class="py function">
+<dt class="sig sig-object py" id="windows.generated_def.winfuncs.GetSystemInfo">
+<span class="sig-prename descclassname"><span class="pre">windows.generated_def.winfuncs.</span></span><span class="sig-name descname"><span class="pre">GetSystemInfo</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">lpSystemInfo</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.generated_def.winfuncs.GetSystemInfo" title="Link to this definition">¶</a></dt>
+<dd></dd></dl>
+
+<dl class="py function">
+<dt class="sig sig-object py" id="windows.generated_def.winfuncs.IsWow64Process">
+<span class="sig-prename descclassname"><span class="pre">windows.generated_def.winfuncs.</span></span><span class="sig-name descname"><span class="pre">IsWow64Process</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">hProcess</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">Wow64Process</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.generated_def.winfuncs.IsWow64Process" title="Link to this definition">¶</a></dt>
+<dd></dd></dl>
+
+<dl class="py function">
+<dt class="sig sig-object py" id="windows.generated_def.winfuncs.IsWow64Process2">
+<span class="sig-prename descclassname"><span class="pre">windows.generated_def.winfuncs.</span></span><span class="sig-name descname"><span class="pre">IsWow64Process2</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">hProcess</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">pProcessMachine</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">pNativeMachine</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.generated_def.winfuncs.IsWow64Process2" title="Link to this definition">¶</a></dt>
+<dd></dd></dl>
+
+<dl class="py function">
+<dt class="sig sig-object py" id="windows.generated_def.winfuncs.IsWow64GuestMachineSupported">
+<span class="sig-prename descclassname"><span class="pre">windows.generated_def.winfuncs.</span></span><span class="sig-name descname"><span class="pre">IsWow64GuestMachineSupported</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">WowGuestMachine</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">MachineIsSupported</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.generated_def.winfuncs.IsWow64GuestMachineSupported" title="Link to this definition">¶</a></dt>
+<dd></dd></dl>
+
+<dl class="py function">
+<dt class="sig sig-object py" id="windows.generated_def.winfuncs.GetSystemWow64DirectoryA">
+<span class="sig-prename descclassname"><span class="pre">windows.generated_def.winfuncs.</span></span><span class="sig-name descname"><span class="pre">GetSystemWow64DirectoryA</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">lpBuffer</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">uSize</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.generated_def.winfuncs.GetSystemWow64DirectoryA" title="Link to this definition">¶</a></dt>
+<dd></dd></dl>
+
+<dl class="py function">
+<dt class="sig sig-object py" id="windows.generated_def.winfuncs.GetSystemWow64DirectoryW">
+<span class="sig-prename descclassname"><span class="pre">windows.generated_def.winfuncs.</span></span><span class="sig-name descname"><span class="pre">GetSystemWow64DirectoryW</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">lpBuffer</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">uSize</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.generated_def.winfuncs.GetSystemWow64DirectoryW" title="Link to this definition">¶</a></dt>
+<dd></dd></dl>
+
+<dl class="py function">
+<dt class="sig sig-object py" id="windows.generated_def.winfuncs.GetSystemWow64Directory2A">
+<span class="sig-prename descclassname"><span class="pre">windows.generated_def.winfuncs.</span></span><span class="sig-name descname"><span class="pre">GetSystemWow64Directory2A</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">lpBuffer</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">uSize</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">ImageFileMachineType</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.generated_def.winfuncs.GetSystemWow64Directory2A" title="Link to this definition">¶</a></dt>
+<dd></dd></dl>
+
+<dl class="py function">
+<dt class="sig sig-object py" id="windows.generated_def.winfuncs.GetSystemWow64Directory2W">
+<span class="sig-prename descclassname"><span class="pre">windows.generated_def.winfuncs.</span></span><span class="sig-name descname"><span class="pre">GetSystemWow64Directory2W</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">lpBuffer</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">uSize</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">ImageFileMachineType</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.generated_def.winfuncs.GetSystemWow64Directory2W" title="Link to this definition">¶</a></dt>
+<dd></dd></dl>
+
+<dl class="py function">
+<dt class="sig sig-object py" id="windows.generated_def.winfuncs.Wow64DisableWow64FsRedirection">
+<span class="sig-prename descclassname"><span class="pre">windows.generated_def.winfuncs.</span></span><span class="sig-name descname"><span class="pre">Wow64DisableWow64FsRedirection</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">OldValue</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.generated_def.winfuncs.Wow64DisableWow64FsRedirection" title="Link to this definition">¶</a></dt>
+<dd></dd></dl>
+
+<dl class="py function">
+<dt class="sig sig-object py" id="windows.generated_def.winfuncs.Wow64EnableWow64FsRedirection">
+<span class="sig-prename descclassname"><span class="pre">windows.generated_def.winfuncs.</span></span><span class="sig-name descname"><span class="pre">Wow64EnableWow64FsRedirection</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">Wow64FsEnableRedirection</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.generated_def.winfuncs.Wow64EnableWow64FsRedirection" title="Link to this definition">¶</a></dt>
+<dd></dd></dl>
+
+<dl class="py function">
+<dt class="sig sig-object py" id="windows.generated_def.winfuncs.Wow64RevertWow64FsRedirection">
+<span class="sig-prename descclassname"><span class="pre">windows.generated_def.winfuncs.</span></span><span class="sig-name descname"><span class="pre">Wow64RevertWow64FsRedirection</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">OlValue</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.generated_def.winfuncs.Wow64RevertWow64FsRedirection" title="Link to this definition">¶</a></dt>
+<dd></dd></dl>
+
+<dl class="py function">
+<dt class="sig sig-object py" id="windows.generated_def.winfuncs.Wow64GetThreadContext">
+<span class="sig-prename descclassname"><span class="pre">windows.generated_def.winfuncs.</span></span><span class="sig-name descname"><span class="pre">Wow64GetThreadContext</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">hThread</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">lpContext</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.generated_def.winfuncs.Wow64GetThreadContext" title="Link to this definition">¶</a></dt>
+<dd></dd></dl>
+
+<dl class="py function">
+<dt class="sig sig-object py" id="windows.generated_def.winfuncs.Wow64SetThreadContext">
+<span class="sig-prename descclassname"><span class="pre">windows.generated_def.winfuncs.</span></span><span class="sig-name descname"><span class="pre">Wow64SetThreadContext</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">hThread</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">lpContext</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.generated_def.winfuncs.Wow64SetThreadContext" title="Link to this definition">¶</a></dt>
+<dd></dd></dl>
+
+<dl class="py function">
+<dt class="sig sig-object py" id="windows.generated_def.winfuncs.Wow64SetThreadDefaultGuestMachine">
+<span class="sig-prename descclassname"><span class="pre">windows.generated_def.winfuncs.</span></span><span class="sig-name descname"><span class="pre">Wow64SetThreadDefaultGuestMachine</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">Machine</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.generated_def.winfuncs.Wow64SetThreadDefaultGuestMachine" title="Link to this definition">¶</a></dt>
+<dd></dd></dl>
+
+<dl class="py function">
+<dt class="sig sig-object py" id="windows.generated_def.winfuncs.Wow64SuspendThread">
+<span class="sig-prename descclassname"><span class="pre">windows.generated_def.winfuncs.</span></span><span class="sig-name descname"><span class="pre">Wow64SuspendThread</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">hThread</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.generated_def.winfuncs.Wow64SuspendThread" title="Link to this definition">¶</a></dt>
+<dd></dd></dl>
+
+<dl class="py function">
+<dt class="sig sig-object py" id="windows.generated_def.winfuncs.NtWow64ReadVirtualMemory64">
+<span class="sig-prename descclassname"><span class="pre">windows.generated_def.winfuncs.</span></span><span class="sig-name descname"><span class="pre">NtWow64ReadVirtualMemory64</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">hProcess</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">lpBaseAddress</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">lpBuffer</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">nSize</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">lpNumberOfBytesRead</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.generated_def.winfuncs.NtWow64ReadVirtualMemory64" title="Link to this definition">¶</a></dt>
+<dd></dd></dl>
+
+<dl class="py function">
+<dt class="sig sig-object py" id="windows.generated_def.winfuncs.NtWow64WriteVirtualMemory64">
+<span class="sig-prename descclassname"><span class="pre">windows.generated_def.winfuncs.</span></span><span class="sig-name descname"><span class="pre">NtWow64WriteVirtualMemory64</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">hProcess</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">lpBaseAddress</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">lpBuffer</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">nSize</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">lpNumberOfBytesWritten</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.generated_def.winfuncs.NtWow64WriteVirtualMemory64" title="Link to this definition">¶</a></dt>
+<dd></dd></dl>
+
 <dl class="py function">
 <dt class="sig sig-object py" id="windows.generated_def.winfuncs.FileTimeToSystemTime">
 <span class="sig-prename descclassname"><span class="pre">windows.generated_def.winfuncs.</span></span><span class="sig-name descname"><span class="pre">FileTimeToSystemTime</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">lpFileTime</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">lpSystemTime</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.generated_def.winfuncs.FileTimeToSystemTime" title="Link to this definition">¶</a></dt>
@@ -3412,6 +3537,11 @@
 <span class="sig-prename descclassname"><span class="pre">windows.generated_def.winfuncs.</span></span><span class="sig-name descname"><span class="pre">CreateRemoteThread</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">hProcess</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">lpThreadAttributes</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">dwStackSize</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">lpStartAddress</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">lpParameter</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">dwCreationFlags</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">lpThreadId</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.generated_def.winfuncs.CreateRemoteThread" title="Link to this definition">¶</a></dt>
 <dd></dd></dl>
 
+<dl class="py function">
+<dt class="sig sig-object py" id="windows.generated_def.winfuncs.CreateRemoteThreadEx">
+<span class="sig-prename descclassname"><span class="pre">windows.generated_def.winfuncs.</span></span><span class="sig-name descname"><span class="pre">CreateRemoteThreadEx</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">hProcess</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">lpThreadAttributes</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">dwStackSize</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">lpStartAddress</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">lpParameter</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">dwCreationFlags</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">lpAttributeList</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">lpThreadId</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.generated_def.winfuncs.CreateRemoteThreadEx" title="Link to this definition">¶</a></dt>
+<dd></dd></dl>
+
 <dl class="py function">
 <dt class="sig sig-object py" id="windows.generated_def.winfuncs.CreateProcessA">
 <span class="sig-prename descclassname"><span class="pre">windows.generated_def.winfuncs.</span></span><span class="sig-name descname"><span class="pre">CreateProcessA</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">lpApplicationName</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">lpCommandLine</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">lpProcessAttributes</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">lpThreadAttributes</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">bInheritHandles</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">dwCreationFlags</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">lpEnvironment</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">lpCurrentDirectory</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">lpStartupInfo</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">lpProcessInformation</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.generated_def.winfuncs.CreateProcessA" title="Link to this definition">¶</a></dt>
@@ -3462,21 +3592,11 @@
 <span class="sig-prename descclassname"><span class="pre">windows.generated_def.winfuncs.</span></span><span class="sig-name descname"><span class="pre">ReadProcessMemory</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">hProcess</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">lpBaseAddress</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">lpBuffer</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">nSize</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">lpNumberOfBytesRead</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.generated_def.winfuncs.ReadProcessMemory" title="Link to this definition">¶</a></dt>
 <dd></dd></dl>
 
-<dl class="py function">
-<dt class="sig sig-object py" id="windows.generated_def.winfuncs.NtWow64ReadVirtualMemory64">
-<span class="sig-prename descclassname"><span class="pre">windows.generated_def.winfuncs.</span></span><span class="sig-name descname"><span class="pre">NtWow64ReadVirtualMemory64</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">hProcess</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">lpBaseAddress</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">lpBuffer</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">nSize</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">lpNumberOfBytesRead</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.generated_def.winfuncs.NtWow64ReadVirtualMemory64" title="Link to this definition">¶</a></dt>
-<dd></dd></dl>
-
 <dl class="py function">
 <dt class="sig sig-object py" id="windows.generated_def.winfuncs.WriteProcessMemory">
 <span class="sig-prename descclassname"><span class="pre">windows.generated_def.winfuncs.</span></span><span class="sig-name descname"><span class="pre">WriteProcessMemory</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">hProcess</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">lpBaseAddress</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">lpBuffer</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">nSize</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">lpNumberOfBytesWritten</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.generated_def.winfuncs.WriteProcessMemory" title="Link to this definition">¶</a></dt>
 <dd></dd></dl>
 
-<dl class="py function">
-<dt class="sig sig-object py" id="windows.generated_def.winfuncs.NtWow64WriteVirtualMemory64">
-<span class="sig-prename descclassname"><span class="pre">windows.generated_def.winfuncs.</span></span><span class="sig-name descname"><span class="pre">NtWow64WriteVirtualMemory64</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">hProcess</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">lpBaseAddress</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">lpBuffer</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">nSize</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">lpNumberOfBytesWritten</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.generated_def.winfuncs.NtWow64WriteVirtualMemory64" title="Link to this definition">¶</a></dt>
-<dd></dd></dl>
-
 <dl class="py function">
 <dt class="sig sig-object py" id="windows.generated_def.winfuncs.GetCurrentProcess">
 <span class="sig-prename descclassname"><span class="pre">windows.generated_def.winfuncs.</span></span><span class="sig-name descname"><span class="pre">GetCurrentProcess</span></span><span class="sig-paren">(</span><span class="sig-paren">)</span><a class="headerlink" href="#windows.generated_def.winfuncs.GetCurrentProcess" title="Link to this definition">¶</a></dt>
@@ -3707,26 +3827,6 @@
 <span class="sig-prename descclassname"><span class="pre">windows.generated_def.winfuncs.</span></span><span class="sig-name descname"><span class="pre">DeviceIoControl</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">hDevice</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">dwIoControlCode</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">lpInBuffer</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">nInBufferSize</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">lpOutBuffer</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">nOutBufferSize</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">lpBytesReturned</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">lpOverlapped</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.generated_def.winfuncs.DeviceIoControl" title="Link to this definition">¶</a></dt>
 <dd></dd></dl>
 
-<dl class="py function">
-<dt class="sig sig-object py" id="windows.generated_def.winfuncs.Wow64DisableWow64FsRedirection">
-<span class="sig-prename descclassname"><span class="pre">windows.generated_def.winfuncs.</span></span><span class="sig-name descname"><span class="pre">Wow64DisableWow64FsRedirection</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">OldValue</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.generated_def.winfuncs.Wow64DisableWow64FsRedirection" title="Link to this definition">¶</a></dt>
-<dd></dd></dl>
-
-<dl class="py function">
-<dt class="sig sig-object py" id="windows.generated_def.winfuncs.Wow64RevertWow64FsRedirection">
-<span class="sig-prename descclassname"><span class="pre">windows.generated_def.winfuncs.</span></span><span class="sig-name descname"><span class="pre">Wow64RevertWow64FsRedirection</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">OldValue</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.generated_def.winfuncs.Wow64RevertWow64FsRedirection" title="Link to this definition">¶</a></dt>
-<dd></dd></dl>
-
-<dl class="py function">
-<dt class="sig sig-object py" id="windows.generated_def.winfuncs.Wow64EnableWow64FsRedirection">
-<span class="sig-prename descclassname"><span class="pre">windows.generated_def.winfuncs.</span></span><span class="sig-name descname"><span class="pre">Wow64EnableWow64FsRedirection</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">Wow64FsEnableRedirection</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.generated_def.winfuncs.Wow64EnableWow64FsRedirection" title="Link to this definition">¶</a></dt>
-<dd></dd></dl>
-
-<dl class="py function">
-<dt class="sig sig-object py" id="windows.generated_def.winfuncs.Wow64GetThreadContext">
-<span class="sig-prename descclassname"><span class="pre">windows.generated_def.winfuncs.</span></span><span class="sig-name descname"><span class="pre">Wow64GetThreadContext</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">hThread</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">lpContext</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.generated_def.winfuncs.Wow64GetThreadContext" title="Link to this definition">¶</a></dt>
-<dd></dd></dl>
-
 <dl class="py function">
 <dt class="sig sig-object py" id="windows.generated_def.winfuncs.SetConsoleCtrlHandler">
 <span class="sig-prename descclassname"><span class="pre">windows.generated_def.winfuncs.</span></span><span class="sig-name descname"><span class="pre">SetConsoleCtrlHandler</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">HandlerRoutine</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">Add</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.generated_def.winfuncs.SetConsoleCtrlHandler" title="Link to this definition">¶</a></dt>
@@ -3862,11 +3962,6 @@
 <span class="sig-prename descclassname"><span class="pre">windows.generated_def.winfuncs.</span></span><span class="sig-name descname"><span class="pre">GetProcessId</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">Process</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.generated_def.winfuncs.GetProcessId" title="Link to this definition">¶</a></dt>
 <dd></dd></dl>
 
-<dl class="py function">
-<dt class="sig sig-object py" id="windows.generated_def.winfuncs.Wow64SetThreadContext">
-<span class="sig-prename descclassname"><span class="pre">windows.generated_def.winfuncs.</span></span><span class="sig-name descname"><span class="pre">Wow64SetThreadContext</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">hThread</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">lpContext</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.generated_def.winfuncs.Wow64SetThreadContext" title="Link to this definition">¶</a></dt>
-<dd></dd></dl>
-
 <dl class="py function">
 <dt class="sig sig-object py" id="windows.generated_def.winfuncs.GetMappedFileNameW">
 <span class="sig-prename descclassname"><span class="pre">windows.generated_def.winfuncs.</span></span><span class="sig-name descname"><span class="pre">GetMappedFileNameW</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">hProcess</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">lpv</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">lpFilename</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">nSize</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.generated_def.winfuncs.GetMappedFileNameW" title="Link to this definition">¶</a></dt>
@@ -4477,6 +4572,8 @@
 <li><a class="reference internal" href="#windows.generated_def.winfuncs.CryptEnumOIDFunction"><code class="docutils literal notranslate"><span class="pre">CryptEnumOIDFunction()</span></code></a></li>
 <li><a class="reference internal" href="#windows.generated_def.winfuncs.CryptGetOIDFunctionValue"><code class="docutils literal notranslate"><span class="pre">CryptGetOIDFunctionValue()</span></code></a></li>
 <li><a class="reference internal" href="#windows.generated_def.winfuncs.CertCloseStore"><code class="docutils literal notranslate"><span class="pre">CertCloseStore()</span></code></a></li>
+<li><a class="reference internal" href="#windows.generated_def.winfuncs.CryptSignAndEncodeCertificate"><code class="docutils literal notranslate"><span class="pre">CryptSignAndEncodeCertificate()</span></code></a></li>
+<li><a class="reference internal" href="#windows.generated_def.winfuncs.CryptSignCertificate"><code class="docutils literal notranslate"><span class="pre">CryptSignCertificate()</span></code></a></li>
 <li><a class="reference internal" href="#windows.generated_def.winfuncs.OpenVirtualDisk"><code class="docutils literal notranslate"><span class="pre">OpenVirtualDisk()</span></code></a></li>
 <li><a class="reference internal" href="#windows.generated_def.winfuncs.AttachVirtualDisk"><code class="docutils literal notranslate"><span class="pre">AttachVirtualDisk()</span></code></a></li>
 <li><a class="reference internal" href="#windows.generated_def.winfuncs.CryptProtectData"><code class="docutils literal notranslate"><span class="pre">CryptProtectData()</span></code></a></li>
@@ -4610,6 +4707,8 @@
 <li><a class="reference internal" href="#windows.generated_def.winfuncs.OpenFileMappingW"><code class="docutils literal notranslate"><span class="pre">OpenFileMappingW()</span></code></a></li>
 <li><a class="reference internal" href="#windows.generated_def.winfuncs.OpenFileMappingA"><code class="docutils literal notranslate"><span class="pre">OpenFileMappingA()</span></code></a></li>
 <li><a class="reference internal" href="#windows.generated_def.winfuncs.UnmapViewOfFile"><code class="docutils literal notranslate"><span class="pre">UnmapViewOfFile()</span></code></a></li>
+<li><a class="reference internal" href="#windows.generated_def.winfuncs.NCryptOpenKey"><code class="docutils literal notranslate"><span class="pre">NCryptOpenKey()</span></code></a></li>
+<li><a class="reference internal" href="#windows.generated_def.winfuncs.NCryptOpenStorageProvider"><code class="docutils literal notranslate"><span class="pre">NCryptOpenStorageProvider()</span></code></a></li>
 <li><a class="reference internal" href="#windows.generated_def.winfuncs.NetQueryDisplayInformation"><code class="docutils literal notranslate"><span class="pre">NetQueryDisplayInformation()</span></code></a></li>
 <li><a class="reference internal" href="#windows.generated_def.winfuncs.NetUserEnum"><code class="docutils literal notranslate"><span class="pre">NetUserEnum()</span></code></a></li>
 <li><a class="reference internal" href="#windows.generated_def.winfuncs.NetGroupEnum"><code class="docutils literal notranslate"><span class="pre">NetGroupEnum()</span></code></a></li>
@@ -4662,6 +4761,9 @@
 <li><a class="reference internal" href="#windows.generated_def.winfuncs.LoadLibraryExA"><code class="docutils literal notranslate"><span class="pre">LoadLibraryExA()</span></code></a></li>
 <li><a class="reference internal" href="#windows.generated_def.winfuncs.LoadLibraryExW"><code class="docutils literal notranslate"><span class="pre">LoadLibraryExW()</span></code></a></li>
 <li><a class="reference internal" href="#windows.generated_def.winfuncs.FreeLibrary"><code class="docutils literal notranslate"><span class="pre">FreeLibrary()</span></code></a></li>
+<li><a class="reference internal" href="#windows.generated_def.winfuncs.GetProcessInformation"><code class="docutils literal notranslate"><span class="pre">GetProcessInformation()</span></code></a></li>
+<li><a class="reference internal" href="#windows.generated_def.winfuncs.SetProcessInformation"><code class="docutils literal notranslate"><span class="pre">SetProcessInformation()</span></code></a></li>
+<li><a class="reference internal" href="#windows.generated_def.winfuncs.RtlGetCurrentPeb"><code class="docutils literal notranslate"><span class="pre">RtlGetCurrentPeb()</span></code></a></li>
 <li><a class="reference internal" href="#windows.generated_def.winfuncs.RegQueryValueExA"><code class="docutils literal notranslate"><span class="pre">RegQueryValueExA()</span></code></a></li>
 <li><a class="reference internal" href="#windows.generated_def.winfuncs.RegQueryValueExW"><code class="docutils literal notranslate"><span class="pre">RegQueryValueExW()</span></code></a></li>
 <li><a class="reference internal" href="#windows.generated_def.winfuncs.RegOpenKeyExA"><code class="docutils literal notranslate"><span class="pre">RegOpenKeyExA()</span></code></a></li>
@@ -4920,6 +5022,24 @@
 <li><a class="reference internal" href="#windows.generated_def.winfuncs.LookupAccountSidW"><code class="docutils literal notranslate"><span class="pre">LookupAccountSidW()</span></code></a></li>
 <li><a class="reference internal" href="#windows.generated_def.winfuncs.LookupAccountNameA"><code class="docutils literal notranslate"><span class="pre">LookupAccountNameA()</span></code></a></li>
 <li><a class="reference internal" href="#windows.generated_def.winfuncs.LookupAccountNameW"><code class="docutils literal notranslate"><span class="pre">LookupAccountNameW()</span></code></a></li>
+<li><a class="reference internal" href="#windows.generated_def.winfuncs.GetNativeSystemInfo"><code class="docutils literal notranslate"><span class="pre">GetNativeSystemInfo()</span></code></a></li>
+<li><a class="reference internal" href="#windows.generated_def.winfuncs.GetSystemInfo"><code class="docutils literal notranslate"><span class="pre">GetSystemInfo()</span></code></a></li>
+<li><a class="reference internal" href="#windows.generated_def.winfuncs.IsWow64Process"><code class="docutils literal notranslate"><span class="pre">IsWow64Process()</span></code></a></li>
+<li><a class="reference internal" href="#windows.generated_def.winfuncs.IsWow64Process2"><code class="docutils literal notranslate"><span class="pre">IsWow64Process2()</span></code></a></li>
+<li><a class="reference internal" href="#windows.generated_def.winfuncs.IsWow64GuestMachineSupported"><code class="docutils literal notranslate"><span class="pre">IsWow64GuestMachineSupported()</span></code></a></li>
+<li><a class="reference internal" href="#windows.generated_def.winfuncs.GetSystemWow64DirectoryA"><code class="docutils literal notranslate"><span class="pre">GetSystemWow64DirectoryA()</span></code></a></li>
+<li><a class="reference internal" href="#windows.generated_def.winfuncs.GetSystemWow64DirectoryW"><code class="docutils literal notranslate"><span class="pre">GetSystemWow64DirectoryW()</span></code></a></li>
+<li><a class="reference internal" href="#windows.generated_def.winfuncs.GetSystemWow64Directory2A"><code class="docutils literal notranslate"><span class="pre">GetSystemWow64Directory2A()</span></code></a></li>
+<li><a class="reference internal" href="#windows.generated_def.winfuncs.GetSystemWow64Directory2W"><code class="docutils literal notranslate"><span class="pre">GetSystemWow64Directory2W()</span></code></a></li>
+<li><a class="reference internal" href="#windows.generated_def.winfuncs.Wow64DisableWow64FsRedirection"><code class="docutils literal notranslate"><span class="pre">Wow64DisableWow64FsRedirection()</span></code></a></li>
+<li><a class="reference internal" href="#windows.generated_def.winfuncs.Wow64EnableWow64FsRedirection"><code class="docutils literal notranslate"><span class="pre">Wow64EnableWow64FsRedirection()</span></code></a></li>
+<li><a class="reference internal" href="#windows.generated_def.winfuncs.Wow64RevertWow64FsRedirection"><code class="docutils literal notranslate"><span class="pre">Wow64RevertWow64FsRedirection()</span></code></a></li>
+<li><a class="reference internal" href="#windows.generated_def.winfuncs.Wow64GetThreadContext"><code class="docutils literal notranslate"><span class="pre">Wow64GetThreadContext()</span></code></a></li>
+<li><a class="reference internal" href="#windows.generated_def.winfuncs.Wow64SetThreadContext"><code class="docutils literal notranslate"><span class="pre">Wow64SetThreadContext()</span></code></a></li>
+<li><a class="reference internal" href="#windows.generated_def.winfuncs.Wow64SetThreadDefaultGuestMachine"><code class="docutils literal notranslate"><span class="pre">Wow64SetThreadDefaultGuestMachine()</span></code></a></li>
+<li><a class="reference internal" href="#windows.generated_def.winfuncs.Wow64SuspendThread"><code class="docutils literal notranslate"><span class="pre">Wow64SuspendThread()</span></code></a></li>
+<li><a class="reference internal" href="#windows.generated_def.winfuncs.NtWow64ReadVirtualMemory64"><code class="docutils literal notranslate"><span class="pre">NtWow64ReadVirtualMemory64()</span></code></a></li>
+<li><a class="reference internal" href="#windows.generated_def.winfuncs.NtWow64WriteVirtualMemory64"><code class="docutils literal notranslate"><span class="pre">NtWow64WriteVirtualMemory64()</span></code></a></li>
 <li><a class="reference internal" href="#windows.generated_def.winfuncs.FileTimeToSystemTime"><code class="docutils literal notranslate"><span class="pre">FileTimeToSystemTime()</span></code></a></li>
 <li><a class="reference internal" href="#windows.generated_def.winfuncs.SystemTimeToFileTime"><code class="docutils literal notranslate"><span class="pre">SystemTimeToFileTime()</span></code></a></li>
 <li><a class="reference internal" href="#windows.generated_def.winfuncs.GetSystemTime"><code class="docutils literal notranslate"><span class="pre">GetSystemTime()</span></code></a></li>
@@ -4988,6 +5108,7 @@
 <li><a class="reference internal" href="#windows.generated_def.winfuncs.GetModuleFileNameW"><code class="docutils literal notranslate"><span class="pre">GetModuleFileNameW()</span></code></a></li>
 <li><a class="reference internal" href="#windows.generated_def.winfuncs.CreateThread"><code class="docutils literal notranslate"><span class="pre">CreateThread()</span></code></a></li>
 <li><a class="reference internal" href="#windows.generated_def.winfuncs.CreateRemoteThread"><code class="docutils literal notranslate"><span class="pre">CreateRemoteThread()</span></code></a></li>
+<li><a class="reference internal" href="#windows.generated_def.winfuncs.CreateRemoteThreadEx"><code class="docutils literal notranslate"><span class="pre">CreateRemoteThreadEx()</span></code></a></li>
 <li><a class="reference internal" href="#windows.generated_def.winfuncs.CreateProcessA"><code class="docutils literal notranslate"><span class="pre">CreateProcessA()</span></code></a></li>
 <li><a class="reference internal" href="#windows.generated_def.winfuncs.CreateProcessW"><code class="docutils literal notranslate"><span class="pre">CreateProcessW()</span></code></a></li>
 <li><a class="reference internal" href="#windows.generated_def.winfuncs.CreateProcessAsUserA"><code class="docutils literal notranslate"><span class="pre">CreateProcessAsUserA()</span></code></a></li>
@@ -4998,9 +5119,7 @@
 <li><a class="reference internal" href="#windows.generated_def.winfuncs.OpenProcess"><code class="docutils literal notranslate"><span class="pre">OpenProcess()</span></code></a></li>
 <li><a class="reference internal" href="#windows.generated_def.winfuncs.CloseHandle"><code class="docutils literal notranslate"><span class="pre">CloseHandle()</span></code></a></li>
 <li><a class="reference internal" href="#windows.generated_def.winfuncs.ReadProcessMemory"><code class="docutils literal notranslate"><span class="pre">ReadProcessMemory()</span></code></a></li>
-<li><a class="reference internal" href="#windows.generated_def.winfuncs.NtWow64ReadVirtualMemory64"><code class="docutils literal notranslate"><span class="pre">NtWow64ReadVirtualMemory64()</span></code></a></li>
 <li><a class="reference internal" href="#windows.generated_def.winfuncs.WriteProcessMemory"><code class="docutils literal notranslate"><span class="pre">WriteProcessMemory()</span></code></a></li>
-<li><a class="reference internal" href="#windows.generated_def.winfuncs.NtWow64WriteVirtualMemory64"><code class="docutils literal notranslate"><span class="pre">NtWow64WriteVirtualMemory64()</span></code></a></li>
 <li><a class="reference internal" href="#windows.generated_def.winfuncs.GetCurrentProcess"><code class="docutils literal notranslate"><span class="pre">GetCurrentProcess()</span></code></a></li>
 <li><a class="reference internal" href="#windows.generated_def.winfuncs.CreateFileA"><code class="docutils literal notranslate"><span class="pre">CreateFileA()</span></code></a></li>
 <li><a class="reference internal" href="#windows.generated_def.winfuncs.CreateFileW"><code class="docutils literal notranslate"><span class="pre">CreateFileW()</span></code></a></li>
@@ -5047,10 +5166,6 @@
 <li><a class="reference internal" href="#windows.generated_def.winfuncs.WaitForSingleObject"><code class="docutils literal notranslate"><span class="pre">WaitForSingleObject()</span></code></a></li>
 <li><a class="reference internal" href="#windows.generated_def.winfuncs.GetThreadId"><code class="docutils literal notranslate"><span class="pre">GetThreadId()</span></code></a></li>
 <li><a class="reference internal" href="#windows.generated_def.winfuncs.DeviceIoControl"><code class="docutils literal notranslate"><span class="pre">DeviceIoControl()</span></code></a></li>
-<li><a class="reference internal" href="#windows.generated_def.winfuncs.Wow64DisableWow64FsRedirection"><code class="docutils literal notranslate"><span class="pre">Wow64DisableWow64FsRedirection()</span></code></a></li>
-<li><a class="reference internal" href="#windows.generated_def.winfuncs.Wow64RevertWow64FsRedirection"><code class="docutils literal notranslate"><span class="pre">Wow64RevertWow64FsRedirection()</span></code></a></li>
-<li><a class="reference internal" href="#windows.generated_def.winfuncs.Wow64EnableWow64FsRedirection"><code class="docutils literal notranslate"><span class="pre">Wow64EnableWow64FsRedirection()</span></code></a></li>
-<li><a class="reference internal" href="#windows.generated_def.winfuncs.Wow64GetThreadContext"><code class="docutils literal notranslate"><span class="pre">Wow64GetThreadContext()</span></code></a></li>
 <li><a class="reference internal" href="#windows.generated_def.winfuncs.SetConsoleCtrlHandler"><code class="docutils literal notranslate"><span class="pre">SetConsoleCtrlHandler()</span></code></a></li>
 <li><a class="reference internal" href="#windows.generated_def.winfuncs.GlobalAlloc"><code class="docutils literal notranslate"><span class="pre">GlobalAlloc()</span></code></a></li>
 <li><a class="reference internal" href="#windows.generated_def.winfuncs.GlobalFree"><code class="docutils literal notranslate"><span class="pre">GlobalFree()</span></code></a></li>
@@ -5078,7 +5193,6 @@
 <li><a class="reference internal" href="#windows.generated_def.winfuncs.DebugSetProcessKillOnExit"><code class="docutils literal notranslate"><span class="pre">DebugSetProcessKillOnExit()</span></code></a></li>
 <li><a class="reference internal" href="#windows.generated_def.winfuncs.DebugBreakProcess"><code class="docutils literal notranslate"><span class="pre">DebugBreakProcess()</span></code></a></li>
 <li><a class="reference internal" href="#windows.generated_def.winfuncs.GetProcessId"><code class="docutils literal notranslate"><span class="pre">GetProcessId()</span></code></a></li>
-<li><a class="reference internal" href="#windows.generated_def.winfuncs.Wow64SetThreadContext"><code class="docutils literal notranslate"><span class="pre">Wow64SetThreadContext()</span></code></a></li>
 <li><a class="reference internal" href="#windows.generated_def.winfuncs.GetMappedFileNameW"><code class="docutils literal notranslate"><span class="pre">GetMappedFileNameW()</span></code></a></li>
 <li><a class="reference internal" href="#windows.generated_def.winfuncs.GetMappedFileNameA"><code class="docutils literal notranslate"><span class="pre">GetMappedFileNameA()</span></code></a></li>
 <li><a class="reference internal" href="#windows.generated_def.winfuncs.RtlInitString"><code class="docutils literal notranslate"><span class="pre">RtlInitString()</span></code></a></li>

docs/build/html/wmi.html

@@ -60,7 +60,7 @@
 <dd><p>The main WMI class exposed, used to list and access differents WMI namespace, can be used as a dict to access
 <a class="reference internal" href="#windows.winobject.wmi.WmiNamespace" title="windows.winobject.wmi.WmiNamespace"><code class="xref py py-class docutils literal notranslate"><span class="pre">WmiNamespace</span></code></a> by name</p>
 <dl>
-<dt>Example:</dt><dd><div class="doctest highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">&gt;&gt;&gt; </span><span class="n">windows</span><span class="o">.</span><span class="n">system</span><span class="o">.</span><span class="n">wmi</span><span class="p">[</span><span class="s2">&quot;root\SecurityCenter2&quot;</span><span class="p">]</span>
+<dt>Example:</dt><dd><div class="doctest highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">&gt;&gt;&gt; </span><span class="n">windows</span><span class="o">.</span><span class="n">system</span><span class="o">.</span><span class="n">wmi</span><span class="p">[</span><span class="sa">r</span><span class="s2">&quot;root\SecurityCenter2&quot;</span><span class="p">]</span>
 <span class="go">&lt;WmiNamespace &quot;root\SecurityCenter2&quot;&gt;</span>
 </pre></div>
 </div>

docs/source/windef_generated.rst

@@ -3344,6 +3344,37 @@ WinDef
 .. autodata:: CRYPT_SGCKEY
 .. autodata:: CRYPT_ARCHIVABLE
 .. autodata:: CRYPT_FORCE_KEY_PROTECTION_HIGH
+.. autodata:: CERT_RDN_ANY_TYPE
+.. autodata:: CERT_RDN_ENCODED_BLOB
+.. autodata:: CERT_RDN_OCTET_STRING
+.. autodata:: CERT_RDN_NUMERIC_STRING
+.. autodata:: CERT_RDN_PRINTABLE_STRING
+.. autodata:: CERT_RDN_TELETEX_STRING
+.. autodata:: CERT_RDN_T61_STRING
+.. autodata:: CERT_RDN_VIDEOTEX_STRING
+.. autodata:: CERT_RDN_IA5_STRING
+.. autodata:: CERT_RDN_GRAPHIC_STRING
+.. autodata:: CERT_RDN_VISIBLE_STRING
+.. autodata:: CERT_RDN_ISO646_STRING
+.. autodata:: CERT_RDN_GENERAL_STRING
+.. autodata:: CERT_RDN_UNIVERSAL_STRING
+.. autodata:: CERT_RDN_INT4_STRING
+.. autodata:: CERT_RDN_BMP_STRING
+.. autodata:: CERT_RDN_UNICODE_STRING
+.. autodata:: CERT_RDN_UTF8_STRING
+.. autodata:: CERT_RDN_TYPE_MASK
+.. autodata:: CERT_RDN_FLAGS_MASK
+.. autodata:: CERT_RDN_ENABLE_T61_UNICODE_FLAG
+.. autodata:: CERT_RDN_ENABLE_UTF8_UNICODE_FLAG
+.. autodata:: CERT_RDN_FORCE_UTF8_UNICODE_FLAG
+.. autodata:: CERT_RDN_DISABLE_CHECK_TYPE_FLAG
+.. autodata:: CERT_RDN_DISABLE_IE4_UTF8_FLAG
+.. autodata:: CRYPT_DECODE_NOCOPY_FLAG
+.. autodata:: CRYPT_DECODE_TO_BE_SIGNED_FLAG
+.. autodata:: CRYPT_DECODE_SHARE_OID_STRING_FLAG
+.. autodata:: CRYPT_DECODE_NO_SIGNATURE_BYTE_REVERSAL_FLAG
+.. autodata:: CRYPT_DECODE_ALLOC_FLAG
+.. autodata:: CRYPT_UNICODE_NAME_DECODE_DISABLE_IE4_UTF8_FLAG
 .. autodata:: CRYPT_ENCODE_DECODE_NONE
 .. autodata:: X509_CERT
 .. autodata:: X509_CERT_TO_BE_SIGNED
@@ -3482,6 +3513,10 @@ WinDef
 .. autodata:: CMSG_CTRL_VERIFY_SIGNATURE_EX
 .. autodata:: CMSG_CTRL_ADD_CMS_SIGNER_INFO
 .. autodata:: CMSG_CTRL_ENABLE_STRONG_SIGNATURE
+.. autodata:: CERT_SET_KEY_PROV_HANDLE_PROP_ID
+.. autodata:: CERT_SET_KEY_CONTEXT_PROP_ID
+.. autodata:: CERT_NCRYPT_KEY_SPEC
+.. autodata:: CERT_REQUEST_V1
 .. autodata:: WSADESCRIPTION_LEN
 .. autodata:: WSASYS_STATUS_LEN
 .. autodata:: WSAPROTOCOL_LEN

docs/source/winfuncs_generated.rst

@@ -326,6 +326,10 @@ Functions
 
 .. function:: CertCloseStore(hCertStore, dwFlags)
 
+.. function:: CryptSignAndEncodeCertificate(hBCryptKey, dwKeySpec, dwCertEncodingType, lpszStructType, pvStructInfo, pSignatureAlgorithm, pvHashAuxInfo, pbEncoded, pcbEncoded)
+
+.. function:: CryptSignCertificate(hBCryptKey, dwKeySpec, dwCertEncodingType, pbEncodedToBeSigned, cbEncodedToBeSigned, pSignatureAlgorithm, pvHashAuxInfo, pbSignature, pcbSignature)
+
 .. function:: OpenVirtualDisk(VirtualStorageType, Path, VirtualDiskAccessMask, Flags, Parameters, Handle)
 
 .. function:: AttachVirtualDisk(VirtualDiskHandle, SecurityDescriptor, Flags, ProviderSpecificFlags, Parameters, Overlapped)
@@ -592,6 +596,10 @@ Functions
 
 .. function:: UnmapViewOfFile(lpBaseAddress)
 
+.. function:: NCryptOpenKey(hProvider, phKey, pszKeyName, dwLegacyKeySpec, dwFlags)
+
+.. function:: NCryptOpenStorageProvider(phProvider, pszProviderName, dwFlags)
+
 .. function:: NetQueryDisplayInformation(ServerName, Level, Index, EntriesRequested, PreferredMaximumLength, ReturnedEntryCount, SortedBuffer)
 
 .. function:: NetUserEnum(servername, level, filter, bufptr, prefmaxlen, entriesread, totalentries, resume_handle)

docs/source/winstructs_generated.rst

@@ -247,6 +247,8 @@ Simple types
 
 .. autoclass:: NET_API_STATUS
 
+.. autoclass:: SECURITY_STATUS
+
 .. autoclass:: PVOID32
 
 .. autoclass:: PVOID64
@@ -255,6 +257,8 @@ Simple types
 
 .. autoclass:: NCRYPT_PROV_HANDLE
 
+.. autoclass:: BCRYPT_KEY_HANDLE
+
 .. autoclass:: NCRYPT_KEY_HANDLE
 
 .. autoclass:: NCRYPT_HASH_HANDLE
@@ -21113,6 +21117,42 @@ _STRUCT_PLAINTEXTKEYBLOB
 
         :class:`BYTE` ``[0]``
 
+_CERT_REQUEST_INFO
+''''''''''''''''''
+.. class:: CERT_REQUEST_INFO
+
+    Alias for :class:`_CERT_REQUEST_INFO`
+
+.. class:: PCERT_REQUEST_INFO
+
+    Pointer to :class:`_CERT_REQUEST_INFO`
+
+.. class:: _CERT_REQUEST_INFO
+
+    .. attribute:: dwVersion
+
+        :class:`DWORD`
+
+
+    .. attribute:: Subject
+
+        :class:`CERT_NAME_BLOB`
+
+
+    .. attribute:: SubjectPublicKeyInfo
+
+        :class:`CERT_PUBLIC_KEY_INFO`
+
+
+    .. attribute:: cAttribute
+
+        :class:`DWORD`
+
+
+    .. attribute:: rgAttribute
+
+        :class:`PCRYPT_ATTRIBUTE`
+
 _EXCEPTION_DEBUG_INFO
 '''''''''''''''''''''
 .. class:: EXCEPTION_DEBUG_INFO

tests/test_evtlog.py

@@ -65,7 +65,7 @@ def test_new_event():
     pre_events = chan.events
     p = windows.utils.create_process(POWERSHELL_PATH, POWERSHELL_ARG, show_windows=False)
     p.wait()
-    import time; time.sleep(1) # It seems to take some time to log the event
+    import time; time.sleep(5) # It seems to take some time to log the event
     post_events = chan.events
     assert len(post_events) > len(pre_events)
     nb_new_events = len(post_events) - len(pre_events)

tests/test_process.py

@@ -170,6 +170,40 @@ class TestProcessWithCheckGarbage(object):
                 current_proc.read_memory(waddr, 0x20) # Check that Reading dumbly fails
             assert current_proc.read_wstring(waddr) ==  test_string
 
+    def test_virtual_alloc_current_process(self):
+        current_proc = windows.current_process
+        addr1 = current_proc.virtual_alloc(0x1000, prot=gdef.PAGE_EXECUTE_READWRITE)
+        meminfo = current_proc.query_memory(addr1)
+        assert meminfo.AllocationBase == addr1
+        assert meminfo.AllocationProtect == gdef.PAGE_EXECUTE_READWRITE
+        assert meminfo.Type == gdef.MEM_PRIVATE
+        assert meminfo.State == gdef.MEM_COMMIT
+        assert meminfo.Protect == gdef.PAGE_EXECUTE_READWRITE
+        del meminfo
+
+        addr2 = current_proc.virtual_alloc(0x1000, prot=gdef.PAGE_READONLY, type=gdef.MEM_RESERVE)
+        meminfo = current_proc.query_memory(addr2)
+        assert meminfo.AllocationBase == addr2
+        assert meminfo.AllocationProtect == gdef.PAGE_READONLY
+        assert meminfo.Type == gdef.MEM_PRIVATE
+        assert meminfo.State == gdef.MEM_RESERVE
+
+    def test_virtual_alloc(self, proc32_64):
+        addr1 = proc32_64.virtual_alloc(0x1000, prot=gdef.PAGE_EXECUTE_READWRITE)
+        meminfo = proc32_64.query_memory(addr1)
+        assert meminfo.AllocationBase == addr1
+        assert meminfo.AllocationProtect == gdef.PAGE_EXECUTE_READWRITE
+        assert meminfo.Type == gdef.MEM_PRIVATE
+        assert meminfo.State == gdef.MEM_COMMIT
+        assert meminfo.Protect == gdef.PAGE_EXECUTE_READWRITE
+
+        addr2 = proc32_64.virtual_alloc(0x1000, prot=gdef.PAGE_READONLY, type=gdef.MEM_RESERVE)
+        meminfo = proc32_64.query_memory(addr2)
+        assert meminfo.AllocationBase == addr2
+        assert meminfo.AllocationProtect == gdef.PAGE_READONLY
+        assert meminfo.Type == gdef.MEM_PRIVATE
+        assert meminfo.State == gdef.MEM_RESERVE
+
     def test_query_memory(self, proc32_64):
         addr = proc32_64.virtual_alloc(0x2000, prot=gdef.PAGE_EXECUTE_READWRITE)
         proc32_64.virtual_protect(addr, 0x2000, gdef.PAGE_READONLY)

tests/test_rpc.py

@@ -157,3 +157,42 @@ def test_rpc_response_as_view():
     # Flags = 7 ?
     resp2 = client.call(iid, Proc9_RPC_FWEnumFirewallRules, params=rawpolstore + b"\x00\x00\x03\x00\xff\xff\xff\x7f\x07\x00")
     assert client.last_response_was_view
+
+# This cannot work as is: as juste calling NtAlpcDeleteSectionView does not works.
+# We need to disconnect from the port or (guess) reuse the message (based on ID ?) so that the serv known we are done with the message and can suppress it.
+# More alpc client/serer test need to be done
+
+# def test_rpc_response_as_view_is_unmapped():
+#     """Test that when a RCP client response as a view, it is unmapped and does not take place in memory ater the call
+#     It's not private memory, but it take some place in the AS : which can be problematic in 32b python"""
+#     # The logic we use : make a LOT of call to an API known to send response as a view. And monitor the evolution of WorkingSetSize
+#     client = windows.rpc.find_alpc_endpoint_and_connect(FIREWALL_RPC_IID, sid=gdef.WinLocalSid)
+#     client.__class__ = DbgRpcClient
+#     iid = client.bind(FIREWALL_RPC_IID)
+#
+#     # https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-fasp/230d1ae7-b42e-4d9c-b997-b1463aaa0ded
+#     # !\x02\x02\x00\x01\x00\x00\x00\x00\x00\x00\x00
+#     # Binaryversion : 0x022f
+#     # FW_STORE_TYPE_LOCAL
+#     # FW_POLICY_ACCESS_RIGHT_READ
+#     # Flags = 0
+#     resp1 = client.call(iid, Proc0_RPC_FWOpenPolicyStore, params=b"!\x02\x02\x00\x01\x00\x00\x00\x00\x00\x00\x00")
+#     rawpolstore = resp1[:20]
+#     assert not client.last_response_was_view
+#     initial_ws_size = windows.current_process.memory_info.WorkingSetSize
+#     ws_sizes = []
+#
+#     for i in range(100):
+#         # Proc9_RPC_FWEnumFirewallRules
+#         # \x00\x00\x03\x00\xff\xff\xff\x7f\x07\x00
+#         # https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-fasp/36cddff4-c427-4863-a58d-3d913a12b221
+#         # FW_PROFILE_TYPE_ALL : 0x7FFFFFFF
+#         # FW_RULE_STATUS_CLASS_OK +  FW_RULE_STATUS_PARTIALLY_IGNORED = 0x00010000 + 0x00020000
+#         # Flags = 7 ?
+#         resp2 = client.call(iid, Proc9_RPC_FWEnumFirewallRules, params=rawpolstore + b"\x00\x00\x03\x00\xff\xff\xff\x7f\x07\x00")
+#         assert client.last_response_was_view
+#         ws_sizes.append(windows.current_process.memory_info.WorkingSetSize - initial_ws_size)
+#         print("WorkingSetSize: {0}".format(windows.current_process.memory_info.WorkingSetSize))
+#     assert max(ws_sizes) - min(ws_sizes) < (1024 ** 2) # We should not vary more than 1 MO ?
+#     # Check if not all ws_size is not 4k bigger that the last one
+#     assert not all((ws_sizes[i+1] - ws_sizes[i] > 0x1000) for i in range(len(ws_sizes) - 1))

windows/crypto/certificate.py

@@ -152,6 +152,14 @@ class CertificateStore(gdef.HCERTSTORE):
         res = winproxy.CertOpenStore(gdef.CERT_STORE_PROV_SYSTEM_A, DEFAULT_ENCODING, None, gdef.CERT_SYSTEM_STORE_LOCAL_MACHINE | gdef.CERT_STORE_READONLY_FLAG, store_name)
         return ctypes.cast(res, cls)
 
+    @classmethod
+    def from_user_store(cls, store_name, user=True):
+        """Create a new :class:`CertificateStore` from system store ``store_name``
+        (see `System Store Locations <https://msdn.microsoft.com/en-us/library/windows/desktop/aa388136(v=vs.85).aspx>`_)
+        """
+        res = winproxy.CertOpenStore(gdef.CERT_STORE_PROV_SYSTEM_A, DEFAULT_ENCODING, None, gdef.CERT_SYSTEM_STORE_CURRENT_USER | gdef.CERT_STORE_READONLY_FLAG, store_name)
+        return ctypes.cast(res, cls)
+
     @classmethod
     def new_in_memory(cls):
         """Create a new temporary :class:`CertificateStore` in memory"""

windows/generated_def/meta.py

@@ -391,6 +391,7 @@ windef = {'ABOVE_NORMAL_PRIORITY_CLASS',
 'CERT_NAME_SIMPLE_DISPLAY_TYPE',
 'CERT_NAME_UPN_TYPE',
 'CERT_NAME_URL_TYPE',
+'CERT_NCRYPT_KEY_SPEC',
 'CERT_NEXT_UPDATE_LOCATION_PROP_ID',
 'CERT_OCSP_RESPONSE_PROP_ID',
 'CERT_OID_NAME_STR',
@@ -435,8 +436,36 @@ windef = {'ABOVE_NORMAL_PRIORITY_CLASS',
 'CERT_QUERY_FORMAT_FLAG_BINARY',
 'CERT_QUERY_OBJECT_BLOB',
 'CERT_QUERY_OBJECT_FILE',
+'CERT_RDN_ANY_TYPE',
+'CERT_RDN_BMP_STRING',
+'CERT_RDN_DISABLE_CHECK_TYPE_FLAG',
+'CERT_RDN_DISABLE_IE4_UTF8_FLAG',
+'CERT_RDN_ENABLE_T61_UNICODE_FLAG',
+'CERT_RDN_ENABLE_UTF8_UNICODE_FLAG',
+'CERT_RDN_ENCODED_BLOB',
+'CERT_RDN_FLAGS_MASK',
+'CERT_RDN_FORCE_UTF8_UNICODE_FLAG',
+'CERT_RDN_GENERAL_STRING',
+'CERT_RDN_GRAPHIC_STRING',
+'CERT_RDN_IA5_STRING',
+'CERT_RDN_INT4_STRING',
+'CERT_RDN_ISO646_STRING',
+'CERT_RDN_NUMERIC_STRING',
+'CERT_RDN_OCTET_STRING',
+'CERT_RDN_PRINTABLE_STRING',
+'CERT_RDN_T61_STRING',
+'CERT_RDN_TELETEX_STRING',
+'CERT_RDN_TYPE_MASK',
+'CERT_RDN_UNICODE_STRING',
+'CERT_RDN_UNIVERSAL_STRING',
+'CERT_RDN_UTF8_STRING',
+'CERT_RDN_VIDEOTEX_STRING',
+'CERT_RDN_VISIBLE_STRING',
 'CERT_RENEWAL_PROP_ID',
 'CERT_REQUEST_ORIGINATOR_PROP_ID',
+'CERT_REQUEST_V1',
+'CERT_SET_KEY_CONTEXT_PROP_ID',
+'CERT_SET_KEY_PROV_HANDLE_PROP_ID',
 'CERT_SHA1_HASH_PROP_ID',
 'CERT_SIGNATURE_HASH_PROP_ID',
 'CERT_SIMPLE_NAME_STR',
@@ -731,6 +760,11 @@ windef = {'ABOVE_NORMAL_PRIORITY_CLASS',
 'CRYPT_CREATE_IV',
 'CRYPT_CREATE_SALT',
 'CRYPT_DATA_KEY',
+'CRYPT_DECODE_ALLOC_FLAG',
+'CRYPT_DECODE_NOCOPY_FLAG',
+'CRYPT_DECODE_NO_SIGNATURE_BYTE_REVERSAL_FLAG',
+'CRYPT_DECODE_SHARE_OID_STRING_FLAG',
+'CRYPT_DECODE_TO_BE_SIGNED_FLAG',
 'CRYPT_DEFAULT_CONTAINER_OPTIONAL',
 'CRYPT_DELETEKEYSET',
 'CRYPT_ENCODE_DECODE_NONE',
@@ -754,6 +788,7 @@ windef = {'ABOVE_NORMAL_PRIORITY_CLASS',
 'CRYPT_SF',
 'CRYPT_SGCKEY',
 'CRYPT_SILENT',
+'CRYPT_UNICODE_NAME_DECODE_DISABLE_IE4_UTF8_FLAG',
 'CRYPT_UPDATE_KEY',
 'CRYPT_USER_KEYSET',
 'CRYPT_USER_PROTECTED',
@@ -12333,6 +12368,7 @@ structs = {'ACCESS_ALLOWED_ACE',
 'CERT_NAME_BLOB',
 'CERT_PUBLIC_KEY_INFO',
 'CERT_RDN_VALUE_BLOB',
+'CERT_REQUEST_INFO',
 'CERT_REVOCATION_CRL_INFO',
 'CERT_REVOCATION_INFO',
 'CERT_SIMPLE_CHAIN',
@@ -12954,6 +12990,7 @@ structs = {'ACCESS_ALLOWED_ACE',
 'PCERT_NAME_BLOB',
 'PCERT_PUBLIC_KEY_INFO',
 'PCERT_RDN_VALUE_BLOB',
+'PCERT_REQUEST_INFO',
 'PCERT_REVOCATION_CRL_INFO',
 'PCERT_REVOCATION_INFO',
 'PCERT_SIMPLE_CHAIN',
@@ -13765,6 +13802,7 @@ structs = {'ACCESS_ALLOWED_ACE',
 '_CERT_ISSUER_SERIAL_NUMBER',
 '_CERT_KEY_CONTEXT',
 '_CERT_PUBLIC_KEY_INFO',
+'_CERT_REQUEST_INFO',
 '_CERT_REVOCATION_CRL_INFO',
 '_CERT_REVOCATION_INFO',
 '_CERT_SIMPLE_CHAIN',
@@ -14762,7 +14800,9 @@ functions = {'AccessCheck',
 'CryptProtectMemory',
 'CryptQueryObject',
 'CryptReleaseContext',
+'CryptSignAndEncodeCertificate',
 'CryptSignAndEncryptMessage',
+'CryptSignCertificate',
 'CryptSignHashA',
 'CryptSignHashW',
 'CryptSignMessage',
@@ -15068,6 +15108,8 @@ functions = {'AccessCheck',
 'MessageBoxA',
 'MessageBoxW',
 'MoveWindow',
+'NCryptOpenKey',
+'NCryptOpenStorageProvider',
 'NetApiBufferFree',
 'NetGroupEnum',
 'NetGroupGetInfo',

windows/generated_def/windef.py

@@ -3384,6 +3384,37 @@ CRYPT_VOLATILE = make_flag("CRYPT_VOLATILE", 0x00001000)
 CRYPT_SGCKEY = make_flag("CRYPT_SGCKEY", 0x00002000)
 CRYPT_ARCHIVABLE = make_flag("CRYPT_ARCHIVABLE", 0x00004000)
 CRYPT_FORCE_KEY_PROTECTION_HIGH = make_flag("CRYPT_FORCE_KEY_PROTECTION_HIGH", 0x00008000)
+CERT_RDN_ANY_TYPE = make_flag("CERT_RDN_ANY_TYPE", 0)
+CERT_RDN_ENCODED_BLOB = make_flag("CERT_RDN_ENCODED_BLOB", 1)
+CERT_RDN_OCTET_STRING = make_flag("CERT_RDN_OCTET_STRING", 2)
+CERT_RDN_NUMERIC_STRING = make_flag("CERT_RDN_NUMERIC_STRING", 3)
+CERT_RDN_PRINTABLE_STRING = make_flag("CERT_RDN_PRINTABLE_STRING", 4)
+CERT_RDN_TELETEX_STRING = make_flag("CERT_RDN_TELETEX_STRING", 5)
+CERT_RDN_T61_STRING = make_flag("CERT_RDN_T61_STRING", 5)
+CERT_RDN_VIDEOTEX_STRING = make_flag("CERT_RDN_VIDEOTEX_STRING", 6)
+CERT_RDN_IA5_STRING = make_flag("CERT_RDN_IA5_STRING", 7)
+CERT_RDN_GRAPHIC_STRING = make_flag("CERT_RDN_GRAPHIC_STRING", 8)
+CERT_RDN_VISIBLE_STRING = make_flag("CERT_RDN_VISIBLE_STRING", 9)
+CERT_RDN_ISO646_STRING = make_flag("CERT_RDN_ISO646_STRING", 9)
+CERT_RDN_GENERAL_STRING = make_flag("CERT_RDN_GENERAL_STRING", 10)
+CERT_RDN_UNIVERSAL_STRING = make_flag("CERT_RDN_UNIVERSAL_STRING", 11)
+CERT_RDN_INT4_STRING = make_flag("CERT_RDN_INT4_STRING", 11)
+CERT_RDN_BMP_STRING = make_flag("CERT_RDN_BMP_STRING", 12)
+CERT_RDN_UNICODE_STRING = make_flag("CERT_RDN_UNICODE_STRING", 12)
+CERT_RDN_UTF8_STRING = make_flag("CERT_RDN_UTF8_STRING", 13)
+CERT_RDN_TYPE_MASK = make_flag("CERT_RDN_TYPE_MASK", 0xff)
+CERT_RDN_FLAGS_MASK = make_flag("CERT_RDN_FLAGS_MASK", 0xff000000)
+CERT_RDN_ENABLE_T61_UNICODE_FLAG = make_flag("CERT_RDN_ENABLE_T61_UNICODE_FLAG", 0x80000000)
+CERT_RDN_ENABLE_UTF8_UNICODE_FLAG = make_flag("CERT_RDN_ENABLE_UTF8_UNICODE_FLAG", 0x20000000)
+CERT_RDN_FORCE_UTF8_UNICODE_FLAG = make_flag("CERT_RDN_FORCE_UTF8_UNICODE_FLAG", 0x10000000)
+CERT_RDN_DISABLE_CHECK_TYPE_FLAG = make_flag("CERT_RDN_DISABLE_CHECK_TYPE_FLAG", 0x40000000)
+CERT_RDN_DISABLE_IE4_UTF8_FLAG = make_flag("CERT_RDN_DISABLE_IE4_UTF8_FLAG", 0x1000000)
+CRYPT_DECODE_NOCOPY_FLAG = make_flag("CRYPT_DECODE_NOCOPY_FLAG", 0x1)
+CRYPT_DECODE_TO_BE_SIGNED_FLAG = make_flag("CRYPT_DECODE_TO_BE_SIGNED_FLAG", 0x2)
+CRYPT_DECODE_SHARE_OID_STRING_FLAG = make_flag("CRYPT_DECODE_SHARE_OID_STRING_FLAG", 0x4)
+CRYPT_DECODE_NO_SIGNATURE_BYTE_REVERSAL_FLAG = make_flag("CRYPT_DECODE_NO_SIGNATURE_BYTE_REVERSAL_FLAG", 0x8)
+CRYPT_DECODE_ALLOC_FLAG = make_flag("CRYPT_DECODE_ALLOC_FLAG", 0x8000)
+CRYPT_UNICODE_NAME_DECODE_DISABLE_IE4_UTF8_FLAG = make_flag("CRYPT_UNICODE_NAME_DECODE_DISABLE_IE4_UTF8_FLAG", CERT_RDN_DISABLE_IE4_UTF8_FLAG)
 CRYPT_ENCODE_DECODE_NONE = make_flag("CRYPT_ENCODE_DECODE_NONE", 0)
 X509_CERT = make_flag("X509_CERT", ( 1 ))
 X509_CERT_TO_BE_SIGNED = make_flag("X509_CERT_TO_BE_SIGNED", ( 2 ))
@@ -3522,6 +3553,10 @@ CMSG_CTRL_MAIL_LIST_DECRYPT = make_flag("CMSG_CTRL_MAIL_LIST_DECRYPT", 18)
 CMSG_CTRL_VERIFY_SIGNATURE_EX = make_flag("CMSG_CTRL_VERIFY_SIGNATURE_EX", 19)
 CMSG_CTRL_ADD_CMS_SIGNER_INFO = make_flag("CMSG_CTRL_ADD_CMS_SIGNER_INFO", 20)
 CMSG_CTRL_ENABLE_STRONG_SIGNATURE = make_flag("CMSG_CTRL_ENABLE_STRONG_SIGNATURE", 21)
+CERT_SET_KEY_PROV_HANDLE_PROP_ID = make_flag("CERT_SET_KEY_PROV_HANDLE_PROP_ID", 0x00000001)
+CERT_SET_KEY_CONTEXT_PROP_ID = make_flag("CERT_SET_KEY_CONTEXT_PROP_ID", 0x00000001)
+CERT_NCRYPT_KEY_SPEC = make_flag("CERT_NCRYPT_KEY_SPEC", 0xFFFFFFFF)
+CERT_REQUEST_V1 = make_flag("CERT_REQUEST_V1", 0)
 WSADESCRIPTION_LEN = make_flag("WSADESCRIPTION_LEN", 256)
 WSASYS_STATUS_LEN = make_flag("WSASYS_STATUS_LEN", 128)
 WSAPROTOCOL_LEN = make_flag("WSAPROTOCOL_LEN", 255)

windows/generated_def/winfuncs.py

@@ -810,6 +810,16 @@ CryptGetOIDFunctionValueParams = ((1, 'dwEncodingType'), (1, 'pszFuncName'), (1,
 CertCloseStorePrototype = WINFUNCTYPE(BOOL, HCERTSTORE, DWORD)
 CertCloseStoreParams = ((1, 'hCertStore'), (1, 'dwFlags'))
 
+#def CryptSignAndEncodeCertificate(hBCryptKey, dwKeySpec, dwCertEncodingType, lpszStructType, pvStructInfo, pSignatureAlgorithm, pvHashAuxInfo, pbEncoded, pcbEncoded):
+#    return CryptSignAndEncodeCertificate.ctypes_function(hBCryptKey, dwKeySpec, dwCertEncodingType, lpszStructType, pvStructInfo, pSignatureAlgorithm, pvHashAuxInfo, pbEncoded, pcbEncoded)
+CryptSignAndEncodeCertificatePrototype = WINFUNCTYPE(BOOL, BCRYPT_KEY_HANDLE, DWORD, DWORD, LPCSTR, PVOID, PCRYPT_ALGORITHM_IDENTIFIER, PVOID, POINTER(BYTE), POINTER(DWORD))
+CryptSignAndEncodeCertificateParams = ((1, 'hBCryptKey'), (1, 'dwKeySpec'), (1, 'dwCertEncodingType'), (1, 'lpszStructType'), (1, 'pvStructInfo'), (1, 'pSignatureAlgorithm'), (1, 'pvHashAuxInfo'), (1, 'pbEncoded'), (1, 'pcbEncoded'))
+
+#def CryptSignCertificate(hBCryptKey, dwKeySpec, dwCertEncodingType, pbEncodedToBeSigned, cbEncodedToBeSigned, pSignatureAlgorithm, pvHashAuxInfo, pbSignature, pcbSignature):
+#    return CryptSignCertificate.ctypes_function(hBCryptKey, dwKeySpec, dwCertEncodingType, pbEncodedToBeSigned, cbEncodedToBeSigned, pSignatureAlgorithm, pvHashAuxInfo, pbSignature, pcbSignature)
+CryptSignCertificatePrototype = WINFUNCTYPE(BOOL, BCRYPT_KEY_HANDLE, DWORD, DWORD, POINTER(BYTE), DWORD, PCRYPT_ALGORITHM_IDENTIFIER, PVOID, POINTER(BYTE), POINTER(DWORD))
+CryptSignCertificateParams = ((1, 'hBCryptKey'), (1, 'dwKeySpec'), (1, 'dwCertEncodingType'), (1, 'pbEncodedToBeSigned'), (1, 'cbEncodedToBeSigned'), (1, 'pSignatureAlgorithm'), (1, 'pvHashAuxInfo'), (1, 'pbSignature'), (1, 'pcbSignature'))
+
 #def OpenVirtualDisk(VirtualStorageType, Path, VirtualDiskAccessMask, Flags, Parameters, Handle):
 #    return OpenVirtualDisk.ctypes_function(VirtualStorageType, Path, VirtualDiskAccessMask, Flags, Parameters, Handle)
 OpenVirtualDiskPrototype = WINFUNCTYPE(DWORD, PVIRTUAL_STORAGE_TYPE, PCWSTR, VIRTUAL_DISK_ACCESS_MASK, OPEN_VIRTUAL_DISK_FLAG, POPEN_VIRTUAL_DISK_PARAMETERS, PHANDLE)
@@ -1475,6 +1485,16 @@ OpenFileMappingAParams = ((1, 'dwDesiredAccess'), (1, 'bInheritHandle'), (1, 'lp
 UnmapViewOfFilePrototype = WINFUNCTYPE(BOOL, LPCVOID)
 UnmapViewOfFileParams = ((1, 'lpBaseAddress'),)
 
+#def NCryptOpenKey(hProvider, phKey, pszKeyName, dwLegacyKeySpec, dwFlags):
+#    return NCryptOpenKey.ctypes_function(hProvider, phKey, pszKeyName, dwLegacyKeySpec, dwFlags)
+NCryptOpenKeyPrototype = WINFUNCTYPE(SECURITY_STATUS, NCRYPT_PROV_HANDLE, POINTER(NCRYPT_KEY_HANDLE), LPCWSTR, DWORD, DWORD)
+NCryptOpenKeyParams = ((1, 'hProvider'), (1, 'phKey'), (1, 'pszKeyName'), (1, 'dwLegacyKeySpec'), (1, 'dwFlags'))
+
+#def NCryptOpenStorageProvider(phProvider, pszProviderName, dwFlags):
+#    return NCryptOpenStorageProvider.ctypes_function(phProvider, pszProviderName, dwFlags)
+NCryptOpenStorageProviderPrototype = WINFUNCTYPE(SECURITY_STATUS, POINTER(NCRYPT_PROV_HANDLE), LPCWSTR, DWORD)
+NCryptOpenStorageProviderParams = ((1, 'phProvider'), (1, 'pszProviderName'), (1, 'dwFlags'))
+
 #def NetQueryDisplayInformation(ServerName, Level, Index, EntriesRequested, PreferredMaximumLength, ReturnedEntryCount, SortedBuffer):
 #    return NetQueryDisplayInformation.ctypes_function(ServerName, Level, Index, EntriesRequested, PreferredMaximumLength, ReturnedEntryCount, SortedBuffer)
 NetQueryDisplayInformationPrototype = WINFUNCTYPE(NET_API_STATUS, LPCWSTR, DWORD, DWORD, DWORD, DWORD, LPDWORD, POINTER(PVOID))

windows/generated_def/winstructs.py

@@ -138,10 +138,12 @@ PWINDBG_EXTENSION_APIS32 = PVOID
 PWINDBG_EXTENSION_APIS64 = PVOID
 FILEOP_FLAGS = WORD
 NET_API_STATUS = DWORD
+SECURITY_STATUS = LONG
 PVOID32 = DWORD
 PVOID64 = DWORD64
 NCRYPT_HANDLE = ULONG_PTR
 NCRYPT_PROV_HANDLE = ULONG_PTR
+BCRYPT_KEY_HANDLE = ULONG_PTR
 NCRYPT_KEY_HANDLE = ULONG_PTR
 NCRYPT_HASH_HANDLE = ULONG_PTR
 NCRYPT_SECRET_HANDLE = ULONG_PTR
@@ -9282,6 +9284,17 @@ class _STRUCT_PLAINTEXTKEYBLOB(Structure):
 PSTRUCT_PLAINTEXTKEYBLOB = POINTER(_STRUCT_PLAINTEXTKEYBLOB)
 STRUCT_PLAINTEXTKEYBLOB = _STRUCT_PLAINTEXTKEYBLOB
 
+class _CERT_REQUEST_INFO(Structure):
+    _fields_ = [
+        ("dwVersion", DWORD),
+        ("Subject", CERT_NAME_BLOB),
+        ("SubjectPublicKeyInfo", CERT_PUBLIC_KEY_INFO),
+        ("cAttribute", DWORD),
+        ("rgAttribute", PCRYPT_ATTRIBUTE),
+    ]
+CERT_REQUEST_INFO = _CERT_REQUEST_INFO
+PCERT_REQUEST_INFO = POINTER(_CERT_REQUEST_INFO)
+
 class _EXCEPTION_DEBUG_INFO(Structure):
     _fields_ = [
         ("ExceptionRecord", EXCEPTION_RECORD),

windows/rpc/client.py

@@ -225,6 +225,11 @@ class RPCClient(object):
             viewattr = response.view_attribute
             assert viewattr.ViewSize >= rpcdatasize
             data = windows.current_process.read_memory(viewattr.ViewBase, rpcdatasize)
+            # We have copied the data from the view: free it
+            # It looks like:
+            # windows.winproxy.NtAlpcDeleteSectionView(self.alpc_client.handle, 0, viewattr.ViewBase)
+            # Will ne be enough, as it will wait for the message to be reused to unmap the section..
+            # And the current architecture encourage creating new message every time
         if response_header.request_id == self.REQUEST_IDENTIFIER_ORPC:
             # Parse & remove ORPC headers (orpcthat + LocalThat)
             data = self._pass_orpc_response_structures(data)

windows/rpc/ndr.py

@@ -173,6 +173,8 @@ class NdrWString(object):
         assert size1 == size2
         assert zero == 0
         s = stream.read(size1 * 2)
+        if stream.use_memoryview:
+            return bytearray(s).decode("utf-16-le")
         return s.decode("utf-16-le")
 
     @classmethod
@@ -551,10 +553,14 @@ class NdrGuidConformantArray(NdrConformantArray):
 
 class NdrStream(object):
     """A stream of bytes used for NDR unpacking"""
-    def __init__(self, data):
+    def __init__(self, data, use_memoryview=False):
+        """"""
         self.fulldata = data
-        self.data = data
-        # self.data = memoryview(data) # FAST but need some code rewrite at some places
+        self.use_memoryview = use_memoryview
+        if use_memoryview:
+            self.data = memoryview(data) # FAST but need some code rewrite at some places
+        else:
+            self.data = data
 
     def partial_unpack(self, format):
         size = struct.calcsize(format)

windows/winobject/process.py

@@ -720,13 +720,14 @@ class CurrentProcess(Process):
 		"""
         return ctypes.sizeof(gdef.PVOID) * 8 # byte to bits
 
-    def virtual_alloc(self, size, prot=PAGE_EXECUTE_READWRITE):
+
+    def virtual_alloc(self, size, prot=PAGE_EXECUTE_READWRITE, addr=None, type=gdef.MEM_COMMIT):
         """Allocate memory in the process
 
         :return: The address of the allocated memory
         :rtype: :class:`int`
 		"""
-        return winproxy.VirtualAlloc(dwSize=size, flProtect=prot)
+        return winproxy.VirtualAlloc(lpAddress=addr, dwSize=size, flAllocationType=type, flProtect=prot)
 
     def virtual_free(self, addr):
         """Free memory in the process by virtual_alloc"""
@@ -1106,13 +1107,13 @@ class WinProcess(Process):
             pass
         return urepr_encode(u'<{0} "{1}" pid {2} at {3}>'.format(self.__class__.__name__, exe_name, self.pid, hex(id(self))))
 
-    def virtual_alloc(self, size, prot=PAGE_EXECUTE_READWRITE, addr=None):
+    def virtual_alloc(self, size, prot=PAGE_EXECUTE_READWRITE, addr=None, type=gdef.MEM_COMMIT):
         """Allocate memory in the process
 
         :return: The address of the allocated memory
         :rtype: :class:`int`
 		"""
-        return winproxy.VirtualAllocEx(self.handle, lpAddress=addr, dwSize=size, flProtect=prot)
+        return winproxy.VirtualAllocEx(self.handle, lpAddress=addr, dwSize=size, flAllocationType=type, flProtect=prot)
 
     def virtual_free(self, addr):
         """Free memory in the process by virtual_alloc"""

windows/winproxy/apis/__init__.py

@@ -7,6 +7,7 @@ from .dnsapi import *
 from .iphlpapi import *
 from .kernel32 import *
 from .ktmw32 import *
+from .ncrypt import *
 from .ntdll import *
 from .netapi32 import *
 from .ole32 import *

windows/winproxy/apis/crypt32.py

@@ -147,6 +147,10 @@ def CryptSignMessage(pSignPara, fDetachedSignature, cToBeSigned, rgpbToBeSigned,
 def CryptSignAndEncryptMessage(pSignPara, pEncryptPara, cRecipientCert, rgpRecipientCert, pbToBeSignedAndEncrypted, cbToBeSignedAndEncrypted, pbSignedAndEncryptedBlob, pcbSignedAndEncryptedBlob):
     return CryptSignAndEncryptMessage.ctypes_function(pSignPara, pEncryptPara, cRecipientCert, rgpRecipientCert, pbToBeSignedAndEncrypted, cbToBeSignedAndEncrypted, pbSignedAndEncryptedBlob, pcbSignedAndEncryptedBlob)
 
+@Crypt32Proxy()
+def CryptSignAndEncodeCertificate(hBCryptKey, dwKeySpec, dwCertEncodingType, lpszStructType, pvStructInfo, pSignatureAlgorithm, pvHashAuxInfo, pbEncoded, pcbEncoded):
+   lpszStructType = gdef.LPCSTR(lpszStructType) if isinstance(lpszStructType, int_types) else lpszStructType
+   return CryptSignAndEncodeCertificate.ctypes_function(hBCryptKey, dwKeySpec, dwCertEncodingType, lpszStructType, pvStructInfo, pSignatureAlgorithm, pvHashAuxInfo, pbEncoded, pcbEncoded)
 
 @Crypt32Proxy()
 def CryptVerifyMessageSignature(pVerifyPara, dwSignerIndex, pbSignedBlob, cbSignedBlob, pbDecoded, pcbDecoded, ppSignerCert):
@@ -176,6 +180,7 @@ def CryptQueryObject(dwObjectType, pvObject, dwExpectedContentTypeFlags, dwExpec
 
 @Crypt32Proxy()
 def CryptDecodeObject(dwCertEncodingType, lpszStructType, pbEncoded, cbEncoded, dwFlags, pvStructInfo, pcbStructInfo):
+    lpszStructType = gdef.LPCSTR(lpszStructType) if isinstance(lpszStructType, int_types) else lpszStructType
     return CryptDecodeObject.ctypes_function(dwCertEncodingType, lpszStructType, pbEncoded, cbEncoded, dwFlags, pvStructInfo, pcbStructInfo)
 
 @Crypt32Proxy()

windows/winproxy/apis/ncrypt.py

@@ -0,0 +1,23 @@
+
+import ctypes
+import windows.generated_def as gdef
+
+from ..apiproxy import ApiProxy, NeededParameter
+from ..error import no_error_check, succeed_on_zero
+
+import windows.pycompat
+from windows.pycompat import int_types
+
+class NCryptProxy(ApiProxy):
+    APIDLL = "ncrypt"
+    default_error_check = staticmethod(succeed_on_zero)
+
+
+@NCryptProxy()
+def NCryptOpenKey(hProvider, phKey, pszKeyName, dwLegacyKeySpec, dwFlags):
+   return NCryptOpenKey.ctypes_function(hProvider, phKey, pszKeyName, dwLegacyKeySpec, dwFlags)
+
+
+@NCryptProxy()
+def NCryptOpenStorageProvider(phProvider, pszProviderName, dwFlags):
+   return NCryptOpenStorageProvider.ctypes_function(phProvider, pszProviderName, dwFlags)