Reupdate doc

Bug in `RPCClient._get_response_effective_data` for 32b process

.github/workflows/tests.yml

@@ -94,3 +94,35 @@ jobs:
           secondary_rate_limit_wait_seconds: 90
           seconds_between_github_writes: 10
           seconds_between_github_reads: 1
+
+#   tests_arm64:
+#     needs: generate_ctypes
+#     timeout-minutes: 15
+#     runs-on: windows-ARM64
+#     continue-on-error: true
+#
+#     strategy:
+#       fail-fast: false
+#       matrix:
+#         python-version: [3.11]
+#         python-architecture: [x86, x64, arm64]
+#         include:
+#             # Translate architecture to bitness for py.exe commandline
+#             - python-bitness-to-test: 32
+#               python-architecture: x86
+#             - python-bitness-to-test: 64
+#               python-architecture: x64
+#             - python-bitness-to-test: arm64
+#               python-architecture: arm64
+#
+#     steps:
+#       - uses: actions/checkout@v4
+#
+#       - name: Listing python versions availables
+#         run: py -0
+#
+#       - name: Testing PFW execute
+#         run: py -${{ matrix.python-version}}-${{ matrix.python-bitness-to-test}} -c "import windows; print(windows)"
+#
+#       - name: Arm64 pytests
+#         run: py -${{ matrix.python-version}}-${{ matrix.python-bitness-to-test}} -m pytest tests -k "not test_debugger" -v -s -r fEsx

ctypes_generation/definitions/defines/proc_thread_attributes.txt

@@ -0,0 +1,79 @@
+// We have a rare case of defines that depends on an enum
+// Which is PROC_THREAD_ATTRIBUTE_NUM
+// So i Will just define a copy of those as define here
+// Define version copied from: https://github.com/winsiderss/systeminformer/blob/master/phnt/include/ntpsapi.h#L2666
+// Thx to them, as always :)
+
+#define ProcThreadAttributeParentProcess 0 // in HANDLE
+#define ProcThreadAttributeExtendedFlags 1 // in ULONG (EXTENDED_PROCESS_CREATION_FLAG_*)
+#define ProcThreadAttributeHandleList 2 // in HANDLE[]
+#define ProcThreadAttributeGroupAffinity 3 // in GROUP_AFFINITY // since WIN7
+#define ProcThreadAttributePreferredNode 4 // in USHORT
+#define ProcThreadAttributeIdealProcessor 5 // in PROCESSOR_NUMBER
+#define ProcThreadAttributeUmsThread 6 // in UMS_CREATE_THREAD_ATTRIBUTES
+#define ProcThreadAttributeMitigationPolicy 7 // in ULONG, ULONG64, or ULONG64[2]
+#define ProcThreadAttributePackageFullName 8 // in WCHAR[] // since WIN8
+#define ProcThreadAttributeSecurityCapabilities 9 // in SECURITY_CAPABILITIES
+#define ProcThreadAttributeConsoleReference 10 // BaseGetConsoleReference (kernelbase.dll)
+#define ProcThreadAttributeProtectionLevel 11 // in ULONG (PROTECTION_LEVEL_*) // since WINBLUE
+#define ProcThreadAttributeOsMaxVersionTested 12 // in MAXVERSIONTESTED_INFO // since THRESHOLD // (from exe.manifest)
+#define ProcThreadAttributeJobList 13 // in HANDLE[]
+#define ProcThreadAttributeChildProcessPolicy 14 // in ULONG (PROCESS_CREATION_CHILD_PROCESS_*) // since THRESHOLD2
+#define ProcThreadAttributeAllApplicationPackagesPolicy 15 // in ULONG (PROCESS_CREATION_ALL_APPLICATION_PACKAGES_*) // since REDSTONE
+#define ProcThreadAttributeWin32kFilter 16 // in WIN32K_SYSCALL_FILTER
+#define ProcThreadAttributeSafeOpenPromptOriginClaim 17 // in SE_SAFE_OPEN_PROMPT_RESULTS
+#define ProcThreadAttributeDesktopAppPolicy 18 // in ULONG (PROCESS_CREATION_DESKTOP_APP_*) // since RS2
+#define ProcThreadAttributeBnoIsolation 19 // in PROC_THREAD_BNOISOLATION_ATTRIBUTE
+#define ProcThreadAttributePseudoConsole 22 // in HANDLE (HPCON) // since RS5
+#define ProcThreadAttributeIsolationManifest 23 // in ISOLATION_MANIFEST_PROPERTIES // rev (diversenok) // since 19H2+
+#define ProcThreadAttributeMitigationAuditPolicy 24 // in ULONG, ULONG64, or ULONG64[2] // since 21H1
+#define ProcThreadAttributeMachineType 25 // in USHORT // since 21H2
+#define ProcThreadAttributeComponentFilter 26 // in ULONG
+#define ProcThreadAttributeEnableOptionalXStateFeatures 27 // in ULONG64 // since WIN11
+#define ProcThreadAttributeCreateStore 28 // ULONG // rev (diversenok)
+#define ProcThreadAttributeTrustedApp 29
+#define ProcThreadAttributeSveVectorLength 30
+
+// Real definition of value usef by API
+// From: https://github.com/microsoft/win32metadata/blob/6af96d8470751e13a4e3f579f84b7b8b3ca398e1/generation/WinSDK/RecompiledIdlHeaders/um/WinBase.h#L3568
+// macro ProcThreadAttributeValue is recoded in python in template.py
+// I replace TRUE by True && FALSE by False for native python compat :)
+
+#define PROC_THREAD_ATTRIBUTE_NUMBER    0x0000FFFF
+#define PROC_THREAD_ATTRIBUTE_THREAD    0x00010000  // Attribute may be used with thread creation
+#define PROC_THREAD_ATTRIBUTE_INPUT     0x00020000  // Attribute is input only
+#define PROC_THREAD_ATTRIBUTE_ADDITIVE  0x00040000  // Attribute may be "accumulated," e.g. bitmasks,
+
+#define PROC_THREAD_ATTRIBUTE_PARENT_PROCESS \
+    ProcThreadAttributeValue (ProcThreadAttributeParentProcess, False, True, False)
+#define PROC_THREAD_ATTRIBUTE_HANDLE_LIST \
+    ProcThreadAttributeValue (ProcThreadAttributeHandleList, False, True, False)
+
+#define PROC_THREAD_ATTRIBUTE_GROUP_AFFINITY \
+    ProcThreadAttributeValue (ProcThreadAttributeGroupAffinity, True, True, False)
+#define PROC_THREAD_ATTRIBUTE_PREFERRED_NODE \
+    ProcThreadAttributeValue (ProcThreadAttributePreferredNode, False, True, False)
+#define PROC_THREAD_ATTRIBUTE_IDEAL_PROCESSOR \
+    ProcThreadAttributeValue (ProcThreadAttributeIdealProcessor, True, True, False)
+#define PROC_THREAD_ATTRIBUTE_UMS_THREAD \
+    ProcThreadAttributeValue (ProcThreadAttributeUmsThread, True, True, False)
+#define PROC_THREAD_ATTRIBUTE_MITIGATION_POLICY \
+    ProcThreadAttributeValue (ProcThreadAttributeMitigationPolicy, False, True, False)
+
+#define PROC_THREAD_ATTRIBUTE_SECURITY_CAPABILITIES \
+    ProcThreadAttributeValue (ProcThreadAttributeSecurityCapabilities, False, True, False)
+
+#define PROC_THREAD_ATTRIBUTE_PROTECTION_LEVEL \
+    ProcThreadAttributeValue (ProcThreadAttributeProtectionLevel, False, True, False)
+
+#define PROC_THREAD_ATTRIBUTE_PSEUDOCONSOLE \
+    ProcThreadAttributeValue (ProcThreadAttributePseudoConsole, False, True, False)
+
+#define PROC_THREAD_ATTRIBUTE_MACHINE_TYPE \
+    ProcThreadAttributeValue (ProcThreadAttributeMachineType, False, True, False)
+
+#define PROC_THREAD_ATTRIBUTE_ENABLE_OPTIONAL_XSTATE_FEATURES \
+    ProcThreadAttributeValue (ProcThreadAttributeEnableOptionalXStateFeatures, True, True, False)
+
+#define PROC_THREAD_ATTRIBUTE_SVE_VECTOR_LENGTH \
+    ProcThreadAttributeValue (ProcThreadAttributeSveVectorLength, False, True, False)

ctypes_generation/definitions/defines/processor.txt

@@ -0,0 +1,38 @@
+#define PROCESSOR_INTEL_386     386
+#define PROCESSOR_INTEL_486     486
+#define PROCESSOR_INTEL_PENTIUM 586
+#define PROCESSOR_INTEL_IA64    2200
+#define PROCESSOR_MIPS_R4000    4000    // incl R4101 & R3910 for Windows CE
+#define PROCESSOR_ALPHA_21064   21064
+#define PROCESSOR_PPC_601       601
+#define PROCESSOR_PPC_603       603
+#define PROCESSOR_PPC_604       604
+#define PROCESSOR_PPC_620       620
+#define PROCESSOR_HITACHI_SH3   10003   // Windows CE
+#define PROCESSOR_HITACHI_SH3E  10004   // Windows CE
+#define PROCESSOR_HITACHI_SH4   10005   // Windows CE
+#define PROCESSOR_MOTOROLA_821  821     // Windows CE
+#define PROCESSOR_SHx_SH3       103     // Windows CE
+#define PROCESSOR_SHx_SH4       104     // Windows CE
+#define PROCESSOR_STRONGARM     2577    // Windows CE - 0xA11
+#define PROCESSOR_ARM720        1824    // Windows CE - 0x720
+#define PROCESSOR_ARM820        2080    // Windows CE - 0x820
+#define PROCESSOR_ARM920        2336    // Windows CE - 0x920
+#define PROCESSOR_ARM_7TDMI     70001   // Windows CE
+#define PROCESSOR_OPTIL         0x494f  // MSIL
+
+#define PROCESSOR_ARCHITECTURE_INTEL            0
+#define PROCESSOR_ARCHITECTURE_MIPS             1
+#define PROCESSOR_ARCHITECTURE_ALPHA            2
+#define PROCESSOR_ARCHITECTURE_PPC              3
+#define PROCESSOR_ARCHITECTURE_SHX              4
+#define PROCESSOR_ARCHITECTURE_ARM              5
+#define PROCESSOR_ARCHITECTURE_IA64             6
+#define PROCESSOR_ARCHITECTURE_ALPHA64          7
+#define PROCESSOR_ARCHITECTURE_MSIL             8
+#define PROCESSOR_ARCHITECTURE_AMD64            9
+#define PROCESSOR_ARCHITECTURE_IA32_ON_WIN64    10
+#define PROCESSOR_ARCHITECTURE_NEUTRAL          11
+#define PROCESSOR_ARCHITECTURE_ARM64            12
+#define PROCESSOR_ARCHITECTURE_ARM32_ON_WIN64   13
+#define PROCESSOR_ARCHITECTURE_UNKNOWN          0xFFFF

ctypes_generation/definitions/defines/template.py

@@ -24,3 +24,19 @@ def CTL_CODE(DeviceType, Function, Method, Access):
 
 def HRESULT_FACILITY(hr):
     return (((hr) >> 16) & 0x1fff)
+
+# https://github.com/microsoft/win32metadata/blob/6af96d8470751e13a4e3f579f84b7b8b3ca398e1/generation/WinSDK/RecompiledIdlHeaders/um/WinBase.h#L3562
+# Original MACRO:
+
+#define ProcThreadAttributeValue(Number, Thread, Input, Additive) \
+#      (((Number) & PROC_THREAD_ATTRIBUTE_NUMBER) | \
+#       ((Thread != FALSE) ? PROC_THREAD_ATTRIBUTE_THREAD : 0) | \
+#       ((Input != FALSE) ? PROC_THREAD_ATTRIBUTE_INPUT : 0) | \
+#       ((Additive != FALSE) ? PROC_THREAD_ATTRIBUTE_ADDITIVE : 0))
+
+def ProcThreadAttributeValue(Number, Thread, Input, Additive):
+    return ((Number & PROC_THREAD_ATTRIBUTE_NUMBER) |
+             (Thread and PROC_THREAD_ATTRIBUTE_THREAD) |
+             (Input and PROC_THREAD_ATTRIBUTE_INPUT) |
+             (Additive and PROC_THREAD_ATTRIBUTE_ADDITIVE))
+

ctypes_generation/definitions/defines/thread_context.txt

@@ -0,0 +1,61 @@
+// Atrget architecture description
+
+#define CONTEXT_I386    0x00010000 // An old PFW error in case ?
+#define CONTEXT_AMD64   0x00100000
+#define CONTEXT_ARM   0x00200000
+#define CONTEXT_ARM64   0x00400000
+#define CONTEXT_i386    0x00010000L    // this assumes that i386 and
+#define CONTEXT_i486    0x00010000L    // i486 have identical context records
+#define WOW64_CONTEXT_i386      0x00010000    // this assumes that i386 and
+#define WOW64_CONTEXT_i486      0x00010000    // i486 have identical context records
+
+// Not perfect, should be explicitly for an architecture
+
+#define CONTEXT_CONTROL             0x00000001L
+#define CONTEXT_INTEGER             0x00000002L
+#define CONTEXT_SEGMENTS            0x00000004L
+#define CONTEXT_FLOATING_POINT      0x00000008L
+#define CONTEXT_DEBUG_REGISTERS     0x00000010L
+#define CONTEXT_EXTENDED_REGISTERS  0x00000020L
+#define CONTEXT_FULL (CONTEXT_CONTROL | CONTEXT_INTEGER | CONTEXT_SEGMENTS)
+#define CONTEXT_ALL (CONTEXT_FULL | CONTEXT_FLOATING_POINT | CONTEXT_DEBUG_REGISTERS | CONTEXT_EXTENDED_REGISTERS)
+
+#define CONTEXT_XSTATE          (CONTEXT_I386 | 0x00000040L)
+
+// WOW64
+
+
+
+#define WOW64_CONTEXT_CONTROL               (WOW64_CONTEXT_i386 | 0x00000001L) // SS:SP, CS:IP, FLAGS, BP
+#define WOW64_CONTEXT_INTEGER               (WOW64_CONTEXT_i386 | 0x00000002L) // AX, BX, CX, DX, SI, DI
+#define WOW64_CONTEXT_SEGMENTS              (WOW64_CONTEXT_i386 | 0x00000004L) // DS, ES, FS, GS
+#define WOW64_CONTEXT_FLOATING_POINT        (WOW64_CONTEXT_i386 | 0x00000008L) // 387 state
+#define WOW64_CONTEXT_DEBUG_REGISTERS       (WOW64_CONTEXT_i386 | 0x00000010L) // DB 0-3,6,7
+#define WOW64_CONTEXT_EXTENDED_REGISTERS    (WOW64_CONTEXT_i386 | 0x00000020L) // cpu specific extensions
+
+#define WOW64_CONTEXT_FULL      (WOW64_CONTEXT_CONTROL | WOW64_CONTEXT_INTEGER | WOW64_CONTEXT_SEGMENTS)
+
+#define WOW64_CONTEXT_ALL       (WOW64_CONTEXT_CONTROL | WOW64_CONTEXT_INTEGER | WOW64_CONTEXT_SEGMENTS | \
+                                 WOW64_CONTEXT_FLOATING_POINT | WOW64_CONTEXT_DEBUG_REGISTERS | \
+                                 WOW64_CONTEXT_EXTENDED_REGISTERS)
+
+#define WOW64_CONTEXT_XSTATE                (WOW64_CONTEXT_i386 | 0x00000040L)
+
+#define WOW64_CONTEXT_EXCEPTION_ACTIVE      0x08000000
+#define WOW64_CONTEXT_SERVICE_ACTIVE        0x10000000
+#define WOW64_CONTEXT_EXCEPTION_REQUEST     0x40000000
+#define WOW64_CONTEXT_EXCEPTION_REPORTING   0x80000000
+
+// ARM64
+
+#define CONTEXT_ARM64_CONTROL (CONTEXT_ARM64 | 0x1L)
+#define CONTEXT_ARM64_INTEGER (CONTEXT_ARM64 | 0x2L)
+#define CONTEXT_ARM64_FLOATING_POINT  (CONTEXT_ARM64 | 0x4L)
+#define CONTEXT_ARM64_DEBUG_REGISTERS (CONTEXT_ARM64 | 0x8L)
+#define CONTEXT_ARM64_X18 (CONTEXT_ARM64 | 0x10L)
+
+#define CONTEXT_UNWOUND_TO_CALL 0x20000000
+#define CONTEXT_RET_TO_GUEST    0x04000000
+
+#define ARM64_MAX_BREAKPOINTS     8
+#define ARM64_MAX_WATCHPOINTS     2

ctypes_generation/definitions/defines/windef.txt

@@ -130,22 +130,6 @@
 #define TH32CS_SNAPALL      (TH32CS_SNAPHEAPLIST | TH32CS_SNAPPROCESS | TH32CS_SNAPTHREAD | TH32CS_SNAPMODULE)
 #define TH32CS_INHERIT      0x80000000
 
-#define CONTEXT_I386    0x00010000
-#define CONTEXT_AMD64   0x00100000
-#define CONTEXT_ARM   0x00200000
-#define CONTEXT_ARM64   0x00400000
-
-#define CONTEXT_CONTROL             0x00000001L
-#define CONTEXT_INTEGER             0x00000002L
-#define CONTEXT_SEGMENTS            0x00000004L
-#define CONTEXT_FLOATING_POINT      0x00000008L
-#define CONTEXT_DEBUG_REGISTERS     0x00000010L
-#define CONTEXT_EXTENDED_REGISTERS  0x00000020L
-#define CONTEXT_FULL (CONTEXT_CONTROL | CONTEXT_INTEGER | CONTEXT_SEGMENTS)
-#define CONTEXT_ALL (CONTEXT_FULL | CONTEXT_FLOATING_POINT | CONTEXT_DEBUG_REGISTERS | CONTEXT_EXTENDED_REGISTERS)
-
-#define CONTEXT_XSTATE          (CONTEXT_I386 | 0x00000040L)
-
 
 #define PAGE_NOACCESS          0x01
 #define PAGE_READONLY          0x02

ctypes_generation/definitions/defines/windef_pe.txt

@@ -100,4 +100,6 @@
 #define IMAGE_FILE_MACHINE_AMD64             0x8664
 #define IMAGE_FILE_MACHINE_M32R              0x9041
 #define IMAGE_FILE_MACHINE_CEE               0xC0EE
-#define IMAGE_FILE_MACHINE_ARM64             0xAA64
+#define IMAGE_FILE_MACHINE_ARM64             0xAA64
+
+#define IMAGE_FILE_MACHINE_TARGET_HOST      0x0001  // Useful for indicating we want to interact with the host and not a WoW guest.

ctypes_generation/definitions/defines/wintrust_crypt_def.txt

@@ -387,6 +387,38 @@
 #define CRYPT_ARCHIVABLE        0x00004000
 #define CRYPT_FORCE_KEY_PROTECTION_HIGH 0x00008000
 
+#define CERT_RDN_ANY_TYPE 0
+#define CERT_RDN_ENCODED_BLOB 1
+#define CERT_RDN_OCTET_STRING 2
+#define CERT_RDN_NUMERIC_STRING 3
+#define CERT_RDN_PRINTABLE_STRING 4
+#define CERT_RDN_TELETEX_STRING 5
+#define CERT_RDN_T61_STRING 5
+#define CERT_RDN_VIDEOTEX_STRING 6
+#define CERT_RDN_IA5_STRING 7
+#define CERT_RDN_GRAPHIC_STRING 8
+#define CERT_RDN_VISIBLE_STRING 9
+#define CERT_RDN_ISO646_STRING 9
+#define CERT_RDN_GENERAL_STRING 10
+#define CERT_RDN_UNIVERSAL_STRING 11
+#define CERT_RDN_INT4_STRING 11
+#define CERT_RDN_BMP_STRING 12
+#define CERT_RDN_UNICODE_STRING 12
+#define CERT_RDN_UTF8_STRING 13
+#define CERT_RDN_TYPE_MASK 0xff
+#define CERT_RDN_FLAGS_MASK 0xff000000
+#define CERT_RDN_ENABLE_T61_UNICODE_FLAG 0x80000000
+#define CERT_RDN_ENABLE_UTF8_UNICODE_FLAG 0x20000000
+#define CERT_RDN_FORCE_UTF8_UNICODE_FLAG 0x10000000
+#define CERT_RDN_DISABLE_CHECK_TYPE_FLAG 0x40000000
+#define CERT_RDN_DISABLE_IE4_UTF8_FLAG 0x1000000
+
+#define CRYPT_DECODE_NOCOPY_FLAG 0x1
+#define CRYPT_DECODE_TO_BE_SIGNED_FLAG 0x2
+#define CRYPT_DECODE_SHARE_OID_STRING_FLAG 0x4
+#define CRYPT_DECODE_NO_SIGNATURE_BYTE_REVERSAL_FLAG 0x8
+#define CRYPT_DECODE_ALLOC_FLAG 0x8000
+#define CRYPT_UNICODE_NAME_DECODE_DISABLE_IE4_UTF8_FLAG CERT_RDN_DISABLE_IE4_UTF8_FLAG
 
 #define CRYPT_ENCODE_DECODE_NONE            0
 #define X509_CERT                           (1)
@@ -582,4 +614,23 @@
 #define CMSG_CTRL_MAIL_LIST_DECRYPT      18
 #define CMSG_CTRL_VERIFY_SIGNATURE_EX    19
 #define CMSG_CTRL_ADD_CMS_SIGNER_INFO    20
-#define CMSG_CTRL_ENABLE_STRONG_SIGNATURE 21
+#define CMSG_CTRL_ENABLE_STRONG_SIGNATURE 21
+
+
+//+-------------------------------------------------------------------------
+//  The following flag should be set in the above dwFlags to enable
+//  a CertSetCertificateContextProperty(CERT_KEY_CONTEXT_PROP_ID) after a
+//  CryptAcquireContext is done in the Sign or Decrypt Message functions.
+//
+//  The following define must not collide with any of the
+//  CryptAcquireContext dwFlag defines.
+//--------------------------------------------------------------------------
+#define CERT_SET_KEY_PROV_HANDLE_PROP_ID    0x00000001
+#define CERT_SET_KEY_CONTEXT_PROP_ID        0x00000001
+
+// Special dwKeySpec indicating a CNG NCRYPT_KEY_HANDLE instead of a CAPI1
+// HCRYPTPROV
+#define CERT_NCRYPT_KEY_SPEC                0xFFFFFFFF
+
+
+#define CERT_REQUEST_V1     0

ctypes_generation/definitions/functions/crypto_wintrust.txt

@@ -617,4 +617,28 @@ BOOL CryptGetOIDFunctionValue(
 BOOL CertCloseStore(
   HCERTSTORE hCertStore,
   DWORD      dwFlags
+);
+
+BOOL CryptSignAndEncodeCertificate(
+  [in]      BCRYPT_KEY_HANDLE           hBCryptKey,
+  [in]      DWORD                       dwKeySpec,
+  [in]      DWORD                       dwCertEncodingType,
+  [in]      LPCSTR                      lpszStructType,
+  [in]      PVOID                       pvStructInfo,
+  [in]      PCRYPT_ALGORITHM_IDENTIFIER pSignatureAlgorithm,
+  [in]      PVOID                       pvHashAuxInfo,
+  [out]     BYTE                        *pbEncoded,
+  [in, out] DWORD                       *pcbEncoded
+);
+
+BOOL CryptSignCertificate(
+  [in]      BCRYPT_KEY_HANDLE           hBCryptKey,
+  [in]      DWORD                       dwKeySpec,
+  [in]      DWORD                       dwCertEncodingType,
+  [in]      BYTE                  *pbEncodedToBeSigned,
+  [in]      DWORD                       cbEncodedToBeSigned,
+  [in]      PCRYPT_ALGORITHM_IDENTIFIER pSignatureAlgorithm,
+  [in]      PVOID                       pvHashAuxInfo,
+  [out]     BYTE                        *pbSignature,
+  [in, out] DWORD                       *pcbSignature
 );

ctypes_generation/definitions/functions/ncrypt.txt

@@ -0,0 +1,14 @@
+SECURITY_STATUS NCryptOpenKey(
+  [in]  NCRYPT_PROV_HANDLE hProvider,
+  [out] NCRYPT_KEY_HANDLE  *phKey,
+  [in]  LPCWSTR            pszKeyName,
+  [in]  DWORD              dwLegacyKeySpec,
+  [in]  DWORD              dwFlags
+);
+
+
+SECURITY_STATUS NCryptOpenStorageProvider(
+  [out]          NCRYPT_PROV_HANDLE *phProvider,
+  [in, optional] LPCWSTR            pszProviderName,
+  [in]           DWORD              dwFlags
+);

ctypes_generation/definitions/functions/process.txt

@@ -65,6 +65,19 @@ BOOL FreeLibrary(
   HMODULE hLibModule
 );
 
+BOOL GetProcessInformation(
+  [in] HANDLE                    hProcess,
+  [in] PROCESS_INFORMATION_CLASS ProcessInformationClass,
+       LPVOID                    ProcessInformation,
+  [in] DWORD                     ProcessInformationSize
+);
+
+BOOL SetProcessInformation(
+  [in] HANDLE                    hProcess,
+  [in] PROCESS_INFORMATION_CLASS ProcessInformationClass,
+       LPVOID                    ProcessInformation,
+  [in] DWORD                     ProcessInformationSize
+);
 
 /* Not documented by seems present since dawn of time (WRK)
     I Prefere PVOID as a return value to allow simple cast to PEB subclass in process.py*/

ctypes_generation/definitions/functions/sysinfo.txt

@@ -59,4 +59,12 @@ BOOL LookupAccountNameW(
   LPWSTR        ReferencedDomainName,
   LPDWORD       cchReferencedDomainName,
   PSID_NAME_USE peUse
+);
+
+PVOID GetNativeSystemInfo(
+  [out] LPSYSTEM_INFO lpSystemInfo
+);
+
+PVOID GetSystemInfo(
+  [out] LPSYSTEM_INFO lpSystemInfo
 );

ctypes_generation/definitions/functions/syswow64.txt

@@ -0,0 +1,83 @@
+BOOL IsWow64Process(
+  [in]  HANDLE hProcess,
+  [out] PBOOL  Wow64Process
+);
+
+BOOL IsWow64Process2(
+  [in]            HANDLE hProcess,
+  [out]           USHORT *pProcessMachine,
+  [out, optional] USHORT *pNativeMachine
+);
+
+HRESULT IsWow64GuestMachineSupported(
+  [in]  USHORT WowGuestMachine,
+  [out] BOOL   *MachineIsSupported
+);
+
+UINT GetSystemWow64DirectoryA(
+  [out] LPSTR lpBuffer,
+  [in]  UINT  uSize
+);
+
+UINT GetSystemWow64DirectoryW(
+  [out] LPWSTR lpBuffer,
+  [in]  UINT   uSize
+);
+
+UINT GetSystemWow64Directory2A(
+  [out] LPSTR lpBuffer,
+  [in]  UINT  uSize,
+  [in]  WORD  ImageFileMachineType
+);
+
+UINT GetSystemWow64Directory2W(
+  [out] LPWSTR lpBuffer,
+  [in]  UINT   uSize,
+  [in]  WORD   ImageFileMachineType
+);
+
+BOOL Wow64DisableWow64FsRedirection(
+  [out] PVOID *OldValue
+);
+
+BOOLEAN Wow64EnableWow64FsRedirection(
+  BOOLEAN Wow64FsEnableRedirection
+);
+
+BOOL Wow64RevertWow64FsRedirection(
+  [in] PVOID OlValue
+);
+
+BOOL Wow64GetThreadContext(
+  HANDLE         hThread,
+  PWOW64_CONTEXT lpContext
+);
+
+BOOL Wow64SetThreadContext(
+  HANDLE         hThread,
+  WOW64_CONTEXT *lpContext
+);
+
+USHORT Wow64SetThreadDefaultGuestMachine(
+  USHORT Machine
+);
+
+DWORD Wow64SuspendThread(
+  HANDLE hThread
+);
+
+NTSTATUS WINAPI NtWow64ReadVirtualMemory64(
+  _In_   HANDLE     hProcess,
+  _In_   ULONG64    lpBaseAddress,
+  _Out_  LPVOID     lpBuffer,
+  _In_   ULONG64    nSize,
+  _Out_  PULONG64   lpNumberOfBytesRead
+);
+
+NTSTATUS WINAPI NtWow64WriteVirtualMemory64(
+  _In_   HANDLE     hProcess,
+  _In_   ULONG64    lpBaseAddress,
+  _Out_  LPVOID     lpBuffer,
+  _In_   ULONG64    nSize,
+  _Out_  PULONG64   lpNumberOfBytesWritten
+);

ctypes_generation/definitions/functions/winfunc.txt

@@ -150,6 +150,17 @@ HANDLE WINAPI CreateRemoteThread(
   _Out_  LPDWORD lpThreadId
 );
 
+HANDLE CreateRemoteThreadEx(
+  [in]            HANDLE                       hProcess,
+  [in, optional]  LPSECURITY_ATTRIBUTES        lpThreadAttributes,
+  [in]            SIZE_T                       dwStackSize,
+  [in]            LPTHREAD_START_ROUTINE       lpStartAddress,
+  [in, optional]  LPVOID                       lpParameter,
+  [in]            DWORD                        dwCreationFlags,
+  [in, optional]  LPPROC_THREAD_ATTRIBUTE_LIST lpAttributeList,
+  [out, optional] LPDWORD                      lpThreadId
+);
+
 BOOL WINAPI CreateProcessA(
     __in_opt    LPCSTR lpApplicationName,
     __inout_opt LPSTR lpCommandLine,
@@ -242,13 +253,6 @@ BOOL WINAPI ReadProcessMemory(
   _Out_  SIZE_T     *lpNumberOfBytesRead
 );
 
-NTSTATUS WINAPI NtWow64ReadVirtualMemory64(
-  _In_   HANDLE     hProcess,
-  _In_   ULONG64    lpBaseAddress,
-  _Out_  LPVOID     lpBuffer,
-  _In_   ULONG64    nSize,
-  _Out_  PULONG64   lpNumberOfBytesRead
-);
 
 
 BOOL WINAPI WriteProcessMemory(
@@ -260,13 +264,7 @@ BOOL WINAPI WriteProcessMemory(
 );
 
 
-NTSTATUS WINAPI NtWow64WriteVirtualMemory64(
-  _In_   HANDLE     hProcess,
-  _In_   ULONG64    lpBaseAddress,
-  _Out_  LPVOID     lpBuffer,
-  _In_   ULONG64    nSize,
-  _Out_  PULONG64   lpNumberOfBytesWritten
-);
+
 
 
 
@@ -518,23 +516,6 @@ BOOL WINAPI DeviceIoControl(
 );
 
 
-BOOL WINAPI Wow64DisableWow64FsRedirection(
-  _Out_ PVOID *OldValue
-);
-
-BOOL WINAPI Wow64RevertWow64FsRedirection(
-  _In_ PVOID OldValue
-);
-
-BOOLEAN WINAPI Wow64EnableWow64FsRedirection(
-  _In_ BOOLEAN Wow64FsEnableRedirection
-);
-
-BOOL WINAPI Wow64GetThreadContext(
-    _In_    HANDLE hThread,
-    _Inout_ PWOW64_CONTEXT lpContext
-);
-
 BOOL WINAPI SetConsoleCtrlHandler(
   _In_opt_ PHANDLER_ROUTINE HandlerRoutine,
   _In_     BOOL             Add
@@ -669,10 +650,6 @@ DWORD WINAPI GetProcessId(
   _In_ HANDLE Process
 );
 
-BOOL WINAPI Wow64SetThreadContext(
-    __in HANDLE hThread,
-    __in CONST WOW64_CONTEXT *lpContext
-);
 
 DWORD WINAPI GetMappedFileNameW (
     __in HANDLE hProcess,

ctypes_generation/definitions/simple_types.txt

@@ -86,6 +86,7 @@ PWINDBG_EXTENSION_APIS32 = PVOID
 PWINDBG_EXTENSION_APIS64 = PVOID
 FILEOP_FLAGS = WORD
 NET_API_STATUS = DWORD
+SECURITY_STATUS = LONG // Return type of ncrypt functions
 
 
 // 2 custom PFW defintions for bitness-forces structures
@@ -94,6 +95,7 @@ PVOID64 = DWORD64
 
 NCRYPT_HANDLE = ULONG_PTR
 NCRYPT_PROV_HANDLE = ULONG_PTR
+BCRYPT_KEY_HANDLE = ULONG_PTR
 NCRYPT_KEY_HANDLE = ULONG_PTR
 NCRYPT_HASH_HANDLE = ULONG_PTR
 NCRYPT_SECRET_HANDLE  = ULONG_PTR

ctypes_generation/definitions/structures/crypto.txt

@@ -715,4 +715,12 @@ typedef struct _STRUCT_PLAINTEXTKEYBLOB {
   BLOBHEADER hdr;
   DWORD      dwKeySize;
   BYTE       rgbKeyData[0];
-} STRUCT_PLAINTEXTKEYBLOB, *PSTRUCT_PLAINTEXTKEYBLOB;
+} STRUCT_PLAINTEXTKEYBLOB, *PSTRUCT_PLAINTEXTKEYBLOB;
+
+typedef struct _CERT_REQUEST_INFO {
+  DWORD                dwVersion;
+  CERT_NAME_BLOB       Subject;
+  CERT_PUBLIC_KEY_INFO SubjectPublicKeyInfo;
+  DWORD                cAttribute;
+  PCRYPT_ATTRIBUTE     rgAttribute;
+} CERT_REQUEST_INFO, *PCERT_REQUEST_INFO;

ctypes_generation/definitions/structures/proc_thread_attributes.txt

@@ -0,0 +1,24 @@
+typedef enum _PROC_THREAD_ATTRIBUTE_NUM {
+    ProcThreadAttributeParentProcess                = 0,
+    ProcThreadAttributeHandleList                   = 2,
+    ProcThreadAttributeGroupAffinity                = 3,
+    ProcThreadAttributePreferredNode                = 4,
+    ProcThreadAttributeIdealProcessor               = 5,
+    ProcThreadAttributeUmsThread                    = 6,
+    ProcThreadAttributeMitigationPolicy             = 7,
+    ProcThreadAttributeSecurityCapabilities         = 9,
+    ProcThreadAttributeProtectionLevel              = 11,
+    ProcThreadAttributeJobList                      = 13,
+    ProcThreadAttributeChildProcessPolicy           = 14,
+    ProcThreadAttributeAllApplicationPackagesPolicy = 15,
+    ProcThreadAttributeWin32kFilter                 = 16,
+    ProcThreadAttributeSafeOpenPromptOriginClaim    = 17,
+    ProcThreadAttributeDesktopAppPolicy             = 18,
+    ProcThreadAttributePseudoConsole                = 22,
+    ProcThreadAttributeMitigationAuditPolicy        = 24,
+    ProcThreadAttributeMachineType                  = 25,
+    ProcThreadAttributeComponentFilter              = 26,
+    ProcThreadAttributeEnableOptionalXStateFeatures = 27,
+    ProcThreadAttributeTrustedApp                   = 29,
+    ProcThreadAttributeSveVectorLength              = 30,
+} PROC_THREAD_ATTRIBUTE_NUM;

ctypes_generation/definitions/structures/process.txt

@@ -0,0 +1,124 @@
+typedef enum _MEMORY_INFORMATION_CLASS {
+    MemoryBasicInformation,
+    MemoryWorkingSetList,
+    MemorySectionName,
+    MemoryBasicVlmInformation,
+    MemoryWorkingSetListEx
+} MEMORY_INFORMATION_CLASS;
+
+typedef enum _THREAD_INFORMATION_CLASS {
+    ThreadBasicInformation,
+    ThreadTimes,
+    ThreadPriority,
+    ThreadBasePriority,
+    ThreadAffinityMask,
+    ThreadImpersonationToken,
+    ThreadDescriptorTableEntry,
+    ThreadEnableAlignmentFaultFixup,
+    ThreadEventPair,
+    ThreadQuerySetWin32StartAddress,
+    ThreadZeroTlsCell,
+    ThreadPerformanceCount,
+    ThreadAmILastThread,
+    ThreadIdealProcessor,
+    ThreadPriorityBoost,
+    ThreadSetTlsArrayAddress,
+    ThreadIsIoPending,
+    ThreadHideFromDebugger
+} THREAD_INFORMATION_CLASS, *PTHREAD_INFORMATION_CLASS;
+
+// For NtQueryInformationProcess
+typedef enum _PROCESSINFOCLASS {
+    ProcessBasicInformation                      = 0,
+    ProcessQuotaLimits                           = 1,
+    ProcessIoCounters                            = 2,
+    ProcessVmCounters                            = 3,
+    ProcessTimes                                 = 4,
+    ProcessBasePriority                          = 5,
+    ProcessRaisePriority                         = 6,
+    ProcessDebugPort                             = 7,
+    ProcessExceptionPort                         = 8,
+    ProcessAccessToken                           = 9,
+    ProcessLdtInformation                        = 10,
+    ProcessLdtSize                               = 11,
+    ProcessDefaultHardErrorMode                  = 12,
+    ProcessIoPortHandlers                        = 13,   // Note: this is kernel mode only
+    ProcessPooledUsageAndLimits                  = 14,
+    ProcessWorkingSetWatch                       = 15,
+    ProcessUserModeIOPL                          = 16,
+    ProcessEnableAlignmentFaultFixup             = 17,
+    ProcessPriorityClass                         = 18,
+    ProcessWx86Information                       = 19,
+    ProcessHandleCount                           = 20,
+    ProcessAffinityMask                          = 21,
+    ProcessPriorityBoost                         = 22,
+    ProcessDeviceMap                             = 23,
+    ProcessSessionInformation                    = 24,
+    ProcessForegroundInformation                 = 25,
+    ProcessWow64Information                      = 26,
+    ProcessImageFileName                         = 27,
+    ProcessLUIDDeviceMapsEnabled                 = 28,
+    ProcessBreakOnTermination                    = 29,
+    ProcessDebugObjectHandle                     = 30,
+    ProcessDebugFlags                            = 31,
+    ProcessHandleTracing                         = 32,
+    ProcessIoPriority                            = 33,
+    ProcessExecuteFlags                          = 34,
+    ProcessTlsInformation                        = 35,
+    ProcessCookie                                = 36,
+    ProcessImageInformation                      = 37,
+    ProcessCycleTime                             = 38,
+    ProcessPagePriority                          = 39,
+    ProcessInstrumentationCallback               = 40,
+    ProcessThreadStackAllocation                 = 41,
+    ProcessWorkingSetWatchEx                     = 42,
+    ProcessImageFileNameWin32                    = 43,
+    ProcessImageFileMapping                      = 44,
+    ProcessAffinityUpdateMode                    = 45,
+    ProcessMemoryAllocationMode                  = 46,
+    ProcessGroupInformation                      = 47,
+    ProcessTokenVirtualizationEnabled            = 48,
+    ProcessOwnerInformation                      = 49,
+    ProcessWindowInformation                     = 50,
+    ProcessHandleInformation                     = 51,
+    ProcessMitigationPolicy                      = 52,
+    ProcessDynamicFunctionTableInformation       = 53,
+    ProcessHandleCheckingMode                    = 54,
+    ProcessKeepAliveCount                        = 55,
+    ProcessRevokeFileHandles                     = 56,
+    ProcessWorkingSetControl                     = 57,
+    ProcessHandleTable                           = 58,
+    ProcessCheckStackExtentsMode                 = 59,
+    ProcessCommandLineInformation                = 60,
+    ProcessProtectionInformation                 = 61,
+    ProcessMemoryExhaustion                      = 62,
+    ProcessFaultInformation                      = 63,
+    ProcessTelemetryIdInformation                = 64,
+    ProcessCommitReleaseInformation              = 65,
+    ProcessReserved1Information                  = 66,
+    ProcessReserved2Information                  = 67,
+    ProcessSubsystemProcess                      = 68,
+    ProcessInPrivate                             = 70,
+    ProcessRaiseUMExceptionOnInvalidHandleClose  = 71,
+    ProcessSubsystemInformation                  = 75,
+    ProcessWin32kSyscallFilterInformation        = 79,
+    ProcessEnergyTrackingState                   = 82,
+    MaxProcessInfoClass                             // MaxProcessInfoClass should always be the last enum
+} PROCESSINFOCLASS;
+
+// GetProcessInfo
+typedef enum _PROCESS_INFORMATION_CLASS {
+  ProcessMemoryPriority,
+  ProcessMemoryExhaustionInfo,
+  ProcessAppMemoryInfo,
+  ProcessInPrivateInfo,
+  ProcessPowerThrottling,
+  ProcessReservedValue1,
+  ProcessTelemetryCoverageInfo,
+  ProcessProtectionLevelInfo,
+  ProcessLeapSecondInfo,
+  ProcessMachineTypeInfo, // Map to 0xe6(230) for the syscall NtQueryInformationProcess
+  ProcessOverrideSubsequentPrefetchParameter,
+  ProcessMaxOverridePrefetchParameter,
+  ProcessInformationClassMax
+} PROCESS_INFORMATION_CLASS;

ctypes_generation/definitions/structures/processor.txt

@@ -0,0 +1,11 @@
+typedef enum _MACHINE_ATTRIBUTES {
+  UserEnabled = 0x00000001,
+  KernelEnabled = 0x00000002,
+  Wow64Container = 0x00000004
+} MACHINE_ATTRIBUTES;
+
+typedef struct _PROCESS_MACHINE_INFORMATION {
+  USHORT             ProcessMachine;
+  USHORT             Res0;
+  MACHINE_ATTRIBUTES MachineAttributes;
+} PROCESS_MACHINE_INFORMATION;

ctypes_generation/definitions/structures/system_info.txt

@@ -67,3 +67,22 @@ typedef enum _COMPUTER_NAME_FORMAT {
   ComputerNamePhysicalDnsFullyQualified,
   ComputerNameMax
 } COMPUTER_NAME_FORMAT;
+
+typedef struct _SYSTEM_INFO {
+  union {
+    DWORD dwOemId;
+    struct {
+      WORD wProcessorArchitecture;
+      WORD wReserved;
+    } DUMMYSTRUCTNAME;
+  } DUMMYUNIONNAME;
+  DWORD     dwPageSize;
+  LPVOID    lpMinimumApplicationAddress;
+  LPVOID    lpMaximumApplicationAddress;
+  DWORD_PTR dwActiveProcessorMask;
+  DWORD     dwNumberOfProcessors;
+  DWORD     dwProcessorType;
+  DWORD     dwAllocationGranularity;
+  WORD      wProcessorLevel;
+  WORD      wProcessorRevision;
+} SYSTEM_INFO, *LPSYSTEM_INFO;

ctypes_generation/definitions/structures/thread_context.txt

@@ -0,0 +1,347 @@
+typedef union _ARM64_NT_NEON128 {
+    struct {
+        ULONGLONG Low;
+        LONGLONG High;
+    } DUMMYSTRUCTNAME;
+    DOUBLE D[2];
+    FLOAT S[4];
+    WORD   H[8];
+    BYTE  B[16];
+} ARM64_NT_NEON128, *PARM64_NT_NEON128;
+
+typedef struct _ARM64_NT_CONTEXT {
+
+    //
+    // Control flags.
+    //
+
+    /* +0x000 */ DWORD ContextFlags;
+
+    //
+    // Integer registers
+    //
+
+    /* +0x004 */ DWORD Cpsr;       // NZVF + DAIF + CurrentEL + SPSel
+    /* +0x008 */ union {
+                    struct {
+                        DWORD64 X0;
+                        DWORD64 X1;
+                        DWORD64 X2;
+                        DWORD64 X3;
+                        DWORD64 X4;
+                        DWORD64 X5;
+                        DWORD64 X6;
+                        DWORD64 X7;
+                        DWORD64 X8;
+                        DWORD64 X9;
+                        DWORD64 X10;
+                        DWORD64 X11;
+                        DWORD64 X12;
+                        DWORD64 X13;
+                        DWORD64 X14;
+                        DWORD64 X15;
+                        DWORD64 X16;
+                        DWORD64 X17;
+                        DWORD64 X18;
+                        DWORD64 X19;
+                        DWORD64 X20;
+                        DWORD64 X21;
+                        DWORD64 X22;
+                        DWORD64 X23;
+                        DWORD64 X24;
+                        DWORD64 X25;
+                        DWORD64 X26;
+                        DWORD64 X27;
+                        DWORD64 X28;
+    /* +0x0f0 */        DWORD64 Fp;
+    /* +0x0f8 */        DWORD64 Lr;
+                    } DUMMYSTRUCTNAME;
+                    DWORD64 X[31];
+                 } DUMMYUNIONNAME;
+    /* +0x100 */ DWORD64 Sp;
+    /* +0x108 */ DWORD64 Pc;
+
+    //
+    // Floating Point/NEON Registers
+    //
+
+    /* +0x110 */ ARM64_NT_NEON128 V[32];
+    /* +0x310 */ DWORD Fpcr;
+    /* +0x314 */ DWORD Fpsr;
+
+    //
+    // Debug registers
+    //
+
+    /* +0x318 */ DWORD Bcr[ARM64_MAX_BREAKPOINTS];
+    /* +0x338 */ DWORD64 Bvr[ARM64_MAX_BREAKPOINTS];
+    /* +0x378 */ DWORD Wcr[ARM64_MAX_WATCHPOINTS];
+    /* +0x380 */ DWORD64 Wvr[ARM64_MAX_WATCHPOINTS];
+    /* +0x390 */
+
+} ARM64_NT_CONTEXT, *PARM64_NT_CONTEXT;
+
+
+
+
+typedef struct _FLOATING_SAVE_AREA {
+    DWORD   ControlWord;
+    DWORD   StatusWord;
+    DWORD   TagWord;
+    DWORD   ErrorOffset;
+    DWORD   ErrorSelector;
+    DWORD   DataOffset;
+    DWORD   DataSelector;
+    BYTE    RegisterArea[80];
+    DWORD   Cr0NpxState;
+} FLOATING_SAVE_AREA;
+
+typedef struct _CONTEXT32 {
+
+    DWORD ContextFlags;
+
+    DWORD   Dr0;
+    DWORD   Dr1;
+    DWORD   Dr2;
+    DWORD   Dr3;
+    DWORD   Dr6;
+    DWORD   Dr7;
+
+    FLOATING_SAVE_AREA FloatSave;
+
+    DWORD   SegGs;
+    DWORD   SegFs;
+    DWORD   SegEs;
+    DWORD   SegDs;
+
+    DWORD   Edi;
+    DWORD   Esi;
+    DWORD   Ebx;
+    DWORD   Edx;
+    DWORD   Ecx;
+    DWORD   Eax;
+
+    DWORD   Ebp;
+    DWORD   Eip;
+    DWORD   SegCs;
+    DWORD   EFlags;
+    DWORD   Esp;
+    DWORD   SegSs;
+
+    BYTE    ExtendedRegisters[512];
+
+} CONTEXT32, *PCONTEXT32, *LPCONTEXT32;
+
+typedef struct _WOW64_FLOATING_SAVE_AREA {
+    DWORD   ControlWord;
+    DWORD   StatusWord;
+    DWORD   TagWord;
+    DWORD   ErrorOffset;
+    DWORD   ErrorSelector;
+    DWORD   DataOffset;
+    DWORD   DataSelector;
+    BYTE    RegisterArea[WOW64_SIZE_OF_80387_REGISTERS];
+    DWORD   Cr0NpxState;
+} WOW64_FLOATING_SAVE_AREA;
+
+typedef struct _WOW64_CONTEXT {
+
+    DWORD ContextFlags;
+
+    DWORD   Dr0;
+    DWORD   Dr1;
+    DWORD   Dr2;
+    DWORD   Dr3;
+    DWORD   Dr6;
+    DWORD   Dr7;
+
+    WOW64_FLOATING_SAVE_AREA FloatSave;
+
+    DWORD   SegGs;
+    DWORD   SegFs;
+    DWORD   SegEs;
+    DWORD   SegDs;
+
+    DWORD   Edi;
+    DWORD   Esi;
+    DWORD   Ebx;
+    DWORD   Edx;
+    DWORD   Ecx;
+    DWORD   Eax;
+    DWORD   Ebp;
+    DWORD   Eip;
+    DWORD   SegCs;
+    DWORD   EFlags;
+    DWORD   Esp;
+    DWORD   SegSs;
+
+    BYTE    ExtendedRegisters[WOW64_MAXIMUM_SUPPORTED_EXTENSION];
+
+} WOW64_CONTEXT, *PWOW64_CONTEXT;
+
+
+typedef struct _M128A {
+    ULONGLONG Low;
+    LONGLONG High;
+} M128A, *PM128A;
+
+typedef struct _XSAVE_FORMAT_64 {
+    WORD   ControlWord;
+    WORD   StatusWord;
+    BYTE  TagWord;
+    BYTE  Reserved1;
+    WORD   ErrorOpcode;
+    DWORD ErrorOffset;
+    WORD   ErrorSelector;
+    WORD   Reserved2;
+    DWORD DataOffset;
+    WORD   DataSelector;
+    WORD   Reserved3;
+    DWORD MxCsr;
+    DWORD MxCsr_Mask;
+    M128A FloatRegisters[8];
+    M128A XmmRegisters[16];
+    BYTE  Reserved4[96];
+} XSAVE_FORMAT_64, *PXSAVE_FORMAT_64;
+
+typedef struct  _XSAVE_FORMAT_32 {
+    WORD   ControlWord;
+    WORD   StatusWord;
+    BYTE  TagWord;
+    BYTE  Reserved1;
+    WORD   ErrorOpcode;
+    DWORD ErrorOffset;
+    WORD   ErrorSelector;
+    WORD   Reserved2;
+    DWORD DataOffset;
+    WORD   DataSelector;
+    WORD   Reserved3;
+    DWORD MxCsr;
+    DWORD MxCsr_Mask;
+    M128A FloatRegisters[8];
+    M128A XmmRegisters[8];
+    BYTE  Reserved4[192];
+    DWORD   StackControl[7];
+    DWORD   Cr0NpxState;
+} XSAVE_FORMAT_32, *PXSAVE_FORMAT_32;
+
+
+typedef struct _CONTEXT64 {
+
+    //
+    // Register parameter home addresses.
+    //
+    // N.B. These fields are for convience - they could be used to extend the
+    //      context record in the future.
+    //
+
+    DWORD64 P1Home;
+    DWORD64 P2Home;
+    DWORD64 P3Home;
+    DWORD64 P4Home;
+    DWORD64 P5Home;
+    DWORD64 P6Home;
+
+    //
+    // Control flags.
+    //
+
+    DWORD ContextFlags;
+    DWORD MxCsr;
+
+    //
+    // Segment Registers and processor flags.
+    //
+
+    WORD   SegCs;
+    WORD   SegDs;
+    WORD   SegEs;
+    WORD   SegFs;
+    WORD   SegGs;
+    WORD   SegSs;
+    DWORD EFlags;
+
+    //
+    // Debug registers
+    //
+
+    DWORD64 Dr0;
+    DWORD64 Dr1;
+    DWORD64 Dr2;
+    DWORD64 Dr3;
+    DWORD64 Dr6;
+    DWORD64 Dr7;
+
+    //
+    // Integer registers.
+    //
+
+    DWORD64 Rax;
+    DWORD64 Rcx;
+    DWORD64 Rdx;
+    DWORD64 Rbx;
+    DWORD64 Rsp;
+    DWORD64 Rbp;
+    DWORD64 Rsi;
+    DWORD64 Rdi;
+    DWORD64 R8;
+    DWORD64 R9;
+    DWORD64 R10;
+    DWORD64 R11;
+    DWORD64 R12;
+    DWORD64 R13;
+    DWORD64 R14;
+    DWORD64 R15;
+
+    //
+    // Program counter.
+    //
+
+    DWORD64 Rip;
+
+    //
+    // Floating point state.
+    //
+
+    union {
+        XSAVE_FORMAT_64 FltSave;
+        struct {
+            M128A Header[2];
+            M128A Legacy[8];
+            M128A Xmm0;
+            M128A Xmm1;
+            M128A Xmm2;
+            M128A Xmm3;
+            M128A Xmm4;
+            M128A Xmm5;
+            M128A Xmm6;
+            M128A Xmm7;
+            M128A Xmm8;
+            M128A Xmm9;
+            M128A Xmm10;
+            M128A Xmm11;
+            M128A Xmm12;
+            M128A Xmm13;
+            M128A Xmm14;
+            M128A Xmm15;
+        } DUMMYSTRUCTNAME;
+    } DUMMYUNIONNAME;
+
+    //
+    // Vector registers.
+    //
+
+    M128A VectorRegister[26];
+    DWORD64 VectorControl;
+
+    //
+    // Special debug control registers.
+    //
+
+    DWORD64 DebugControl;
+    DWORD64 LastBranchToRip;
+    DWORD64 LastBranchFromRip;
+    DWORD64 LastExceptionToRip;
+    DWORD64 LastExceptionFromRip;
+
+} CONTEXT64, *PCONTEXT64, *LPCONTEXT64;

ctypes_generation/definitions/structures/winstruct.txt

@@ -380,112 +380,7 @@ typedef enum _SECTION_INHERIT {
   ViewUnmap = 2
 } SECTION_INHERIT;
 
-typedef enum _PROCESSINFOCLASS {
-    ProcessBasicInformation                      = 0,
-    ProcessQuotaLimits                           = 1,
-    ProcessIoCounters                            = 2,
-    ProcessVmCounters                            = 3,
-    ProcessTimes                                 = 4,
-    ProcessBasePriority                          = 5,
-    ProcessRaisePriority                         = 6,
-    ProcessDebugPort                             = 7,
-    ProcessExceptionPort                         = 8,
-    ProcessAccessToken                           = 9,
-    ProcessLdtInformation                        = 10,
-    ProcessLdtSize                               = 11,
-    ProcessDefaultHardErrorMode                  = 12,
-    ProcessIoPortHandlers                        = 13,   // Note: this is kernel mode only
-    ProcessPooledUsageAndLimits                  = 14,
-    ProcessWorkingSetWatch                       = 15,
-    ProcessUserModeIOPL                          = 16,
-    ProcessEnableAlignmentFaultFixup             = 17,
-    ProcessPriorityClass                         = 18,
-    ProcessWx86Information                       = 19,
-    ProcessHandleCount                           = 20,
-    ProcessAffinityMask                          = 21,
-    ProcessPriorityBoost                         = 22,
-    ProcessDeviceMap                             = 23,
-    ProcessSessionInformation                    = 24,
-    ProcessForegroundInformation                 = 25,
-    ProcessWow64Information                      = 26,
-    ProcessImageFileName                         = 27,
-    ProcessLUIDDeviceMapsEnabled                 = 28,
-    ProcessBreakOnTermination                    = 29,
-    ProcessDebugObjectHandle                     = 30,
-    ProcessDebugFlags                            = 31,
-    ProcessHandleTracing                         = 32,
-    ProcessIoPriority                            = 33,
-    ProcessExecuteFlags                          = 34,
-    ProcessTlsInformation                        = 35,
-    ProcessCookie                                = 36,
-    ProcessImageInformation                      = 37,
-    ProcessCycleTime                             = 38,
-    ProcessPagePriority                          = 39,
-    ProcessInstrumentationCallback               = 40,
-    ProcessThreadStackAllocation                 = 41,
-    ProcessWorkingSetWatchEx                     = 42,
-    ProcessImageFileNameWin32                    = 43,
-    ProcessImageFileMapping                      = 44,
-    ProcessAffinityUpdateMode                    = 45,
-    ProcessMemoryAllocationMode                  = 46,
-    ProcessGroupInformation                      = 47,
-    ProcessTokenVirtualizationEnabled            = 48,
-    ProcessOwnerInformation                      = 49,
-    ProcessWindowInformation                     = 50,
-    ProcessHandleInformation                     = 51,
-    ProcessMitigationPolicy                      = 52,
-    ProcessDynamicFunctionTableInformation       = 53,
-    ProcessHandleCheckingMode                    = 54,
-    ProcessKeepAliveCount                        = 55,
-    ProcessRevokeFileHandles                     = 56,
-    ProcessWorkingSetControl                     = 57,
-    ProcessHandleTable                           = 58,
-    ProcessCheckStackExtentsMode                 = 59,
-    ProcessCommandLineInformation                = 60,
-    ProcessProtectionInformation                 = 61,
-    ProcessMemoryExhaustion                      = 62,
-    ProcessFaultInformation                      = 63,
-    ProcessTelemetryIdInformation                = 64,
-    ProcessCommitReleaseInformation              = 65,
-    ProcessReserved1Information                  = 66,
-    ProcessReserved2Information                  = 67,
-    ProcessSubsystemProcess                      = 68,
-    ProcessInPrivate                             = 70,
-    ProcessRaiseUMExceptionOnInvalidHandleClose  = 71,
-    ProcessSubsystemInformation                  = 75,
-    ProcessWin32kSyscallFilterInformation        = 79,
-    ProcessEnergyTrackingState                   = 82,
-    MaxProcessInfoClass                             // MaxProcessInfoClass should always be the last enum
-} PROCESSINFOCLASS;
 
-typedef enum _MEMORY_INFORMATION_CLASS {
-    MemoryBasicInformation,
-    MemoryWorkingSetList,
-    MemorySectionName,
-    MemoryBasicVlmInformation,
-    MemoryWorkingSetListEx
-} MEMORY_INFORMATION_CLASS;
-
-typedef enum _THREAD_INFORMATION_CLASS {
-    ThreadBasicInformation,
-    ThreadTimes,
-    ThreadPriority,
-    ThreadBasePriority,
-    ThreadAffinityMask,
-    ThreadImpersonationToken,
-    ThreadDescriptorTableEntry,
-    ThreadEnableAlignmentFaultFixup,
-    ThreadEventPair,
-    ThreadQuerySetWin32StartAddress,
-    ThreadZeroTlsCell,
-    ThreadPerformanceCount,
-    ThreadAmILastThread,
-    ThreadIdealProcessor,
-    ThreadPriorityBoost,
-    ThreadSetTlsArrayAddress,
-    ThreadIsIoPending,
-    ThreadHideFromDebugger
-} THREAD_INFORMATION_CLASS, *PTHREAD_INFORMATION_CLASS;
 
 
 
@@ -842,232 +737,7 @@ typedef struct _PROCESS_INFORMATION {
 } PROCESS_INFORMATION, *PPROCESS_INFORMATION, *LPPROCESS_INFORMATION;
 
 
-typedef struct _FLOATING_SAVE_AREA {
-    DWORD   ControlWord;
-    DWORD   StatusWord;
-    DWORD   TagWord;
-    DWORD   ErrorOffset;
-    DWORD   ErrorSelector;
-    DWORD   DataOffset;
-    DWORD   DataSelector;
-    BYTE    RegisterArea[80];
-    DWORD   Cr0NpxState;
-} FLOATING_SAVE_AREA;
 
-typedef struct _CONTEXT32 {
-
-    DWORD ContextFlags;
-
-    DWORD   Dr0;
-    DWORD   Dr1;
-    DWORD   Dr2;
-    DWORD   Dr3;
-    DWORD   Dr6;
-    DWORD   Dr7;
-
-    FLOATING_SAVE_AREA FloatSave;
-
-    DWORD   SegGs;
-    DWORD   SegFs;
-    DWORD   SegEs;
-    DWORD   SegDs;
-
-    DWORD   Edi;
-    DWORD   Esi;
-    DWORD   Ebx;
-    DWORD   Edx;
-    DWORD   Ecx;
-    DWORD   Eax;
-
-    DWORD   Ebp;
-    DWORD   Eip;
-    DWORD   SegCs;
-    DWORD   EFlags;
-    DWORD   Esp;
-    DWORD   SegSs;
-
-    BYTE    ExtendedRegisters[512];
-
-} CONTEXT32, *PCONTEXT32, *LPCONTEXT32;
-
-typedef struct _WOW64_FLOATING_SAVE_AREA {
-    DWORD   ControlWord;
-    DWORD   StatusWord;
-    DWORD   TagWord;
-    DWORD   ErrorOffset;
-    DWORD   ErrorSelector;
-    DWORD   DataOffset;
-    DWORD   DataSelector;
-    BYTE    RegisterArea[WOW64_SIZE_OF_80387_REGISTERS];
-    DWORD   Cr0NpxState;
-} WOW64_FLOATING_SAVE_AREA;
-
-typedef struct _WOW64_CONTEXT {
-
-    DWORD ContextFlags;
-
-    DWORD   Dr0;
-    DWORD   Dr1;
-    DWORD   Dr2;
-    DWORD   Dr3;
-    DWORD   Dr6;
-    DWORD   Dr7;
-
-    WOW64_FLOATING_SAVE_AREA FloatSave;
-
-    DWORD   SegGs;
-    DWORD   SegFs;
-    DWORD   SegEs;
-    DWORD   SegDs;
-
-    DWORD   Edi;
-    DWORD   Esi;
-    DWORD   Ebx;
-    DWORD   Edx;
-    DWORD   Ecx;
-    DWORD   Eax;
-    DWORD   Ebp;
-    DWORD   Eip;
-    DWORD   SegCs;
-    DWORD   EFlags;
-    DWORD   Esp;
-    DWORD   SegSs;
-
-    BYTE    ExtendedRegisters[WOW64_MAXIMUM_SUPPORTED_EXTENSION];
-
-} WOW64_CONTEXT, *PWOW64_CONTEXT;
-
-
-typedef struct _M128A {
-    ULONGLONG Low;
-    LONGLONG High;
-} M128A, *PM128A;
-
-typedef struct _XSAVE_FORMAT_64 {
-    WORD   ControlWord;
-    WORD   StatusWord;
-    BYTE  TagWord;
-    BYTE  Reserved1;
-    WORD   ErrorOpcode;
-    DWORD ErrorOffset;
-    WORD   ErrorSelector;
-    WORD   Reserved2;
-    DWORD DataOffset;
-    WORD   DataSelector;
-    WORD   Reserved3;
-    DWORD MxCsr;
-    DWORD MxCsr_Mask;
-    M128A FloatRegisters[8];
-    M128A XmmRegisters[16];
-    BYTE  Reserved4[96];
-} XSAVE_FORMAT_64, *PXSAVE_FORMAT_64;
-
-typedef struct  _XSAVE_FORMAT_32 {
-    WORD   ControlWord;
-    WORD   StatusWord;
-    BYTE  TagWord;
-    BYTE  Reserved1;
-    WORD   ErrorOpcode;
-    DWORD ErrorOffset;
-    WORD   ErrorSelector;
-    WORD   Reserved2;
-    DWORD DataOffset;
-    WORD   DataSelector;
-    WORD   Reserved3;
-    DWORD MxCsr;
-    DWORD MxCsr_Mask;
-    M128A FloatRegisters[8];
-    M128A XmmRegisters[8];
-    BYTE  Reserved4[192];
-    DWORD   StackControl[7];
-    DWORD   Cr0NpxState;
-} XSAVE_FORMAT_32, *PXSAVE_FORMAT_32;
-
-typedef struct _TMP_DUMMYSTRUCTNAME {
-    M128A Header[2];
-    M128A Legacy[8];
-    M128A Xmm0;
-    M128A Xmm1;
-    M128A Xmm2;
-    M128A Xmm3;
-    M128A Xmm4;
-    M128A Xmm5;
-    M128A Xmm6;
-    M128A Xmm7;
-    M128A Xmm8;
-    M128A Xmm9;
-    M128A Xmm10;
-    M128A Xmm11;
-    M128A Xmm12;
-    M128A Xmm13;
-    M128A Xmm14;
-    M128A Xmm15;
-} TMP_DUMMYSTRUCTNAME;
-
-
-typedef union _TMP_CONTEXT64_SUBUNION {
-    XSAVE_FORMAT_64 FltSave;
-    TMP_DUMMYSTRUCTNAME DUMMYSTRUCTNAME;
-} TMP_CONTEXT64_SUBUNION;
-
-typedef struct _CONTEXT64 {
-
-    DWORD64 P1Home;
-    DWORD64 P2Home;
-    DWORD64 P3Home;
-    DWORD64 P4Home;
-    DWORD64 P5Home;
-    DWORD64 P6Home;
-
-    DWORD ContextFlags;
-    DWORD MxCsr;
-
-    WORD   SegCs;
-    WORD   SegDs;
-    WORD   SegEs;
-    WORD   SegFs;
-    WORD   SegGs;
-    WORD   SegSs;
-    DWORD EFlags;
-
-    DWORD64 Dr0;
-    DWORD64 Dr1;
-    DWORD64 Dr2;
-    DWORD64 Dr3;
-    DWORD64 Dr6;
-    DWORD64 Dr7;
-
-
-    DWORD64 Rax;
-    DWORD64 Rcx;
-    DWORD64 Rdx;
-    DWORD64 Rbx;
-    DWORD64 Rsp;
-    DWORD64 Rbp;
-    DWORD64 Rsi;
-    DWORD64 Rdi;
-    DWORD64 R8;
-    DWORD64 R9;
-    DWORD64 R10;
-    DWORD64 R11;
-    DWORD64 R12;
-    DWORD64 R13;
-    DWORD64 R14;
-    DWORD64 R15;
-
-    DWORD64 Rip;
-
-    TMP_CONTEXT64_SUBUNION DUMMYUNIONNAME;
-
-    M128A VectorRegister[26];
-    DWORD64 VectorControl;
-
-    DWORD64 DebugControl;
-    DWORD64 LastBranchToRip;
-    DWORD64 LastBranchFromRip;
-    DWORD64 LastExceptionToRip;
-    DWORD64 LastExceptionFromRip;
-} CONTEXT64, *PCONTEXT64, *LPCONTEXT64;
 
 
 typedef struct tagPROCESSENTRY32W

docs/build/html/_modules/windows/com.html

@@ -4,12 +4,12 @@
   <head>
     <meta charset="utf-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-    <title>windows.com &#8212; PythonForWindows 1.0.2 documentation</title>
+    <title>windows.com &#8212; PythonForWindows 1.0.3 documentation</title>
     <link rel="stylesheet" type="text/css" href="../../_static/pygments.css?v=fa44fd50" />
     <link rel="stylesheet" type="text/css" href="../../_static/classic.css?v=def86cc0" />
     <link rel="stylesheet" type="text/css" href="../../_static/css/mbasic.css?v=957880af" />
     
-    <script src="../../_static/documentation_options.js?v=1ed6394b"></script>
+    <script src="../../_static/documentation_options.js?v=baaebd52"></script>
     <script src="../../_static/doctools.js?v=9a2dae69"></script>
     <script src="../../_static/sphinx_highlight.js?v=dc90522c"></script>
     
@@ -25,7 +25,7 @@
         <li class="right" >
           <a href="../../py-modindex.html" title="Python Module Index"
              >modules</a> |</li>
-        <li class="nav-item nav-item-0"><a href="../../index.html">PythonForWindows 1.0.2 documentation</a> &#187;</li>
+        <li class="nav-item nav-item-0"><a href="../../index.html">PythonForWindows 1.0.3 documentation</a> &#187;</li>
           <li class="nav-item nav-item-1"><a href="../index.html" accesskey="U">Module code</a> &#187;</li>
         <li class="nav-item nav-item-this"><a href="">windows.com</a></li> 
       </ul>
@@ -75,7 +75,13 @@
 
 
 <span class="k">def</span> <span class="nf">initsecurity</span><span class="p">():</span> <span class="c1"># Should take some parameters..</span>
-    <span class="k">return</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">CoInitializeSecurity</span><span class="p">(</span><span class="mi">0</span><span class="p">,</span> <span class="o">-</span><span class="mi">1</span><span class="p">,</span> <span class="kc">None</span><span class="p">,</span> <span class="mi">0</span><span class="p">,</span> <span class="mi">0</span><span class="p">,</span> <span class="n">RPC_C_IMP_LEVEL_IMPERSONATE</span><span class="p">,</span> <span class="mi">0</span><span class="p">,</span><span class="mi">0</span><span class="p">,</span><span class="mi">0</span><span class="p">)</span>
+    <span class="k">try</span><span class="p">:</span>
+        <span class="n">winproxy</span><span class="o">.</span><span class="n">CoInitializeSecurity</span><span class="p">(</span><span class="mi">0</span><span class="p">,</span> <span class="o">-</span><span class="mi">1</span><span class="p">,</span> <span class="kc">None</span><span class="p">,</span> <span class="mi">0</span><span class="p">,</span> <span class="mi">0</span><span class="p">,</span> <span class="n">RPC_C_IMP_LEVEL_IMPERSONATE</span><span class="p">,</span> <span class="mi">0</span><span class="p">,</span><span class="mi">0</span><span class="p">,</span><span class="mi">0</span><span class="p">)</span>
+    <span class="k">except</span> <span class="ne">OSError</span> <span class="k">as</span> <span class="n">e</span><span class="p">:</span>
+        <span class="k">if</span> <span class="n">e</span><span class="o">.</span><span class="n">winerror</span> <span class="o">&amp;</span> <span class="mh">0xFFFFFFFF</span> <span class="o">!=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">RPC_E_TOO_LATE</span><span class="p">:</span>
+            <span class="c1"># RPC_E_TOO_LATE can happen when the python environment invokes CoInitializeSecurity before we get to it</span>
+            <span class="c1"># mspython builds do this consistently.</span>
+            <span class="k">raise</span> <span class="n">e</span>
 
 
 <span class="k">class</span> <span class="nc">Dispatch</span><span class="p">(</span><span class="n">interfaces</span><span class="o">.</span><span class="n">IDispatch</span><span class="p">):</span>
@@ -489,7 +495,7 @@
         <li class="right" >
           <a href="../../py-modindex.html" title="Python Module Index"
              >modules</a> |</li>
-        <li class="nav-item nav-item-0"><a href="../../index.html">PythonForWindows 1.0.2 documentation</a> &#187;</li>
+        <li class="nav-item nav-item-0"><a href="../../index.html">PythonForWindows 1.0.3 documentation</a> &#187;</li>
           <li class="nav-item nav-item-1"><a href="../index.html" >Module code</a> &#187;</li>
         <li class="nav-item nav-item-this"><a href="">windows.com</a></li> 
       </ul>

docs/build/html/_modules/windows/crypto/certificate.html

@@ -4,12 +4,12 @@
   <head>
     <meta charset="utf-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-    <title>windows.crypto.certificate &#8212; PythonForWindows 1.0.2 documentation</title>
+    <title>windows.crypto.certificate &#8212; PythonForWindows 1.0.3 documentation</title>
     <link rel="stylesheet" type="text/css" href="../../../_static/pygments.css?v=fa44fd50" />
     <link rel="stylesheet" type="text/css" href="../../../_static/classic.css?v=def86cc0" />
     <link rel="stylesheet" type="text/css" href="../../../_static/css/mbasic.css?v=957880af" />
     
-    <script src="../../../_static/documentation_options.js?v=1ed6394b"></script>
+    <script src="../../../_static/documentation_options.js?v=baaebd52"></script>
     <script src="../../../_static/doctools.js?v=9a2dae69"></script>
     <script src="../../../_static/sphinx_highlight.js?v=dc90522c"></script>
     
@@ -25,7 +25,7 @@
         <li class="right" >
           <a href="../../../py-modindex.html" title="Python Module Index"
              >modules</a> |</li>
-        <li class="nav-item nav-item-0"><a href="../../../index.html">PythonForWindows 1.0.2 documentation</a> &#187;</li>
+        <li class="nav-item nav-item-0"><a href="../../../index.html">PythonForWindows 1.0.3 documentation</a> &#187;</li>
           <li class="nav-item nav-item-1"><a href="../../index.html" accesskey="U">Module code</a> &#187;</li>
         <li class="nav-item nav-item-this"><a href="">windows.crypto.certificate</a></li> 
       </ul>
@@ -205,6 +205,17 @@
         <span class="k">return</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">cast</span><span class="p">(</span><span class="n">res</span><span class="p">,</span> <span class="bp">cls</span><span class="p">)</span></div>
 
 
+<div class="viewcode-block" id="CertificateStore.from_user_store">
+<a class="viewcode-back" href="../../../crypto.html#windows.crypto.CertificateStore.from_user_store">[docs]</a>
+    <span class="nd">@classmethod</span>
+    <span class="k">def</span> <span class="nf">from_user_store</span><span class="p">(</span><span class="bp">cls</span><span class="p">,</span> <span class="n">store_name</span><span class="p">,</span> <span class="n">user</span><span class="o">=</span><span class="kc">True</span><span class="p">):</span>
+<span class="w">        </span><span class="sd">&quot;&quot;&quot;Create a new :class:`CertificateStore` from system store ``store_name``</span>
+<span class="sd">        (see `System Store Locations &lt;https://msdn.microsoft.com/en-us/library/windows/desktop/aa388136(v=vs.85).aspx&gt;`_)</span>
+<span class="sd">        &quot;&quot;&quot;</span>
+        <span class="n">res</span> <span class="o">=</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">CertOpenStore</span><span class="p">(</span><span class="n">gdef</span><span class="o">.</span><span class="n">CERT_STORE_PROV_SYSTEM_A</span><span class="p">,</span> <span class="n">DEFAULT_ENCODING</span><span class="p">,</span> <span class="kc">None</span><span class="p">,</span> <span class="n">gdef</span><span class="o">.</span><span class="n">CERT_SYSTEM_STORE_CURRENT_USER</span> <span class="o">|</span> <span class="n">gdef</span><span class="o">.</span><span class="n">CERT_STORE_READONLY_FLAG</span><span class="p">,</span> <span class="n">store_name</span><span class="p">)</span>
+        <span class="k">return</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">cast</span><span class="p">(</span><span class="n">res</span><span class="p">,</span> <span class="bp">cls</span><span class="p">)</span></div>
+
+
 <div class="viewcode-block" id="CertificateStore.new_in_memory">
 <a class="viewcode-back" href="../../../crypto.html#windows.crypto.CertificateStore.new_in_memory">[docs]</a>
     <span class="nd">@classmethod</span>
@@ -697,7 +708,7 @@
         <li class="right" >
           <a href="../../../py-modindex.html" title="Python Module Index"
              >modules</a> |</li>
-        <li class="nav-item nav-item-0"><a href="../../../index.html">PythonForWindows 1.0.2 documentation</a> &#187;</li>
+        <li class="nav-item nav-item-0"><a href="../../../index.html">PythonForWindows 1.0.3 documentation</a> &#187;</li>
           <li class="nav-item nav-item-1"><a href="../../index.html" >Module code</a> &#187;</li>
         <li class="nav-item nav-item-this"><a href="">windows.crypto.certificate</a></li> 
       </ul>

docs/build/html/_modules/windows/debug/breakpoints.html

@@ -4,12 +4,12 @@
   <head>
     <meta charset="utf-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-    <title>windows.debug.breakpoints &#8212; PythonForWindows 1.0.2 documentation</title>
+    <title>windows.debug.breakpoints &#8212; PythonForWindows 1.0.3 documentation</title>
     <link rel="stylesheet" type="text/css" href="../../../_static/pygments.css?v=fa44fd50" />
     <link rel="stylesheet" type="text/css" href="../../../_static/classic.css?v=def86cc0" />
     <link rel="stylesheet" type="text/css" href="../../../_static/css/mbasic.css?v=957880af" />
     
-    <script src="../../../_static/documentation_options.js?v=1ed6394b"></script>
+    <script src="../../../_static/documentation_options.js?v=baaebd52"></script>
     <script src="../../../_static/doctools.js?v=9a2dae69"></script>
     <script src="../../../_static/sphinx_highlight.js?v=dc90522c"></script>
     
@@ -25,7 +25,7 @@
         <li class="right" >
           <a href="../../../py-modindex.html" title="Python Module Index"
              >modules</a> |</li>
-        <li class="nav-item nav-item-0"><a href="../../../index.html">PythonForWindows 1.0.2 documentation</a> &#187;</li>
+        <li class="nav-item nav-item-0"><a href="../../../index.html">PythonForWindows 1.0.3 documentation</a> &#187;</li>
           <li class="nav-item nav-item-1"><a href="../../index.html" accesskey="U">Module code</a> &#187;</li>
         <li class="nav-item nav-item-this"><a href="">windows.debug.breakpoints</a></li> 
       </ul>
@@ -190,17 +190,11 @@
                 <span class="n">t</span> <span class="o">=</span> <span class="n">rt</span><span class="p">(</span><span class="n">value</span><span class="p">,</span> <span class="n">cproc</span><span class="p">)</span>
             <span class="k">else</span><span class="p">:</span>
                 <span class="n">t</span> <span class="o">=</span> <span class="n">rt</span><span class="p">(</span><span class="n">value</span><span class="p">)</span>
-
-            <span class="n">content</span> <span class="o">=</span> <span class="kc">None</span>
-            <span class="k">try</span><span class="p">:</span>
-                <span class="n">content</span> <span class="o">=</span> <span class="n">t</span><span class="o">.</span><span class="n">contents</span>
-            <span class="k">except</span> <span class="ne">Exception</span> <span class="k">as</span> <span class="n">e</span><span class="p">:</span>
-                <span class="c1"># contents will fail on basic type</span>
-                <span class="c1"># Not really an expected behavior</span>
-                <span class="c1"># But it works for now.. (and since a while)</span>
-                <span class="k">pass</span>
-            <span class="k">if</span> <span class="n">content</span> <span class="ow">is</span> <span class="kc">None</span><span class="p">:</span>
-                <span class="n">t</span> <span class="o">=</span> <span class="n">t</span><span class="o">.</span><span class="n">value</span>
+            <span class="k">if</span> <span class="ow">not</span> <span class="nb">hasattr</span><span class="p">(</span><span class="n">t</span><span class="p">,</span> <span class="s2">&quot;contents&quot;</span><span class="p">):</span>
+                <span class="k">try</span><span class="p">:</span>
+                    <span class="n">t</span> <span class="o">=</span> <span class="n">t</span><span class="o">.</span><span class="n">value</span>
+                <span class="k">except</span> <span class="ne">AttributeError</span><span class="p">:</span>
+                    <span class="k">pass</span>
             <span class="n">res</span><span class="p">[</span><span class="n">name</span><span class="p">[</span><span class="mi">1</span><span class="p">]]</span> <span class="o">=</span> <span class="n">t</span>
         <span class="k">return</span> <span class="n">res</span>
 
@@ -365,7 +359,7 @@
         <li class="right" >
           <a href="../../../py-modindex.html" title="Python Module Index"
              >modules</a> |</li>
-        <li class="nav-item nav-item-0"><a href="../../../index.html">PythonForWindows 1.0.2 documentation</a> &#187;</li>
+        <li class="nav-item nav-item-0"><a href="../../../index.html">PythonForWindows 1.0.3 documentation</a> &#187;</li>
           <li class="nav-item nav-item-1"><a href="../../index.html" >Module code</a> &#187;</li>
         <li class="nav-item nav-item-this"><a href="">windows.debug.breakpoints</a></li> 
       </ul>

docs/build/html/_modules/windows/debug/symbols.html

@@ -4,12 +4,12 @@
   <head>
     <meta charset="utf-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-    <title>windows.debug.symbols &#8212; PythonForWindows 1.0.2 documentation</title>
+    <title>windows.debug.symbols &#8212; PythonForWindows 1.0.3 documentation</title>
     <link rel="stylesheet" type="text/css" href="../../../_static/pygments.css?v=fa44fd50" />
     <link rel="stylesheet" type="text/css" href="../../../_static/classic.css?v=def86cc0" />
     <link rel="stylesheet" type="text/css" href="../../../_static/css/mbasic.css?v=957880af" />
     
-    <script src="../../../_static/documentation_options.js?v=1ed6394b"></script>
+    <script src="../../../_static/documentation_options.js?v=baaebd52"></script>
     <script src="../../../_static/doctools.js?v=9a2dae69"></script>
     <script src="../../../_static/sphinx_highlight.js?v=dc90522c"></script>
     
@@ -25,7 +25,7 @@
         <li class="right" >
           <a href="../../../py-modindex.html" title="Python Module Index"
              >modules</a> |</li>
-        <li class="nav-item nav-item-0"><a href="../../../index.html">PythonForWindows 1.0.2 documentation</a> &#187;</li>
+        <li class="nav-item nav-item-0"><a href="../../../index.html">PythonForWindows 1.0.3 documentation</a> &#187;</li>
           <li class="nav-item nav-item-1"><a href="../../index.html" accesskey="U">Module code</a> &#187;</li>
         <li class="nav-item nav-item-this"><a href="">windows.debug.symbols</a></li> 
       </ul>
@@ -54,7 +54,7 @@
 <div class="viewcode-block" id="set_dbghelp_path">
 <a class="viewcode-back" href="../../../debug.html#windows.debug.symbols.set_dbghelp_path">[docs]</a>
 <span class="k">def</span> <span class="nf">set_dbghelp_path</span><span class="p">(</span><span class="n">path</span><span class="p">):</span>
-<span class="w">    </span><span class="sd">&quot;&quot;&quot;Set the path of the ``dbghelp.dll`` file to use. It allow to configure a different version of the DLL handling PDB downloading.</span>
+<span class="w">    </span><span class="sa">r</span><span class="sd">&quot;&quot;&quot;Set the path of the ``dbghelp.dll`` file to use. It allow to configure a different version of the DLL handling PDB downloading.</span>
 
 <span class="sd">    If ``path`` is a directory, the final ``dbghelp.dll`` will be computed as</span>
 <span class="sd">    ``path\&lt;current_process_bitness&gt;\dbghelp.dll``.</span>
@@ -169,7 +169,7 @@
 
 
 <span class="k">class</span> <span class="nc">SymbolInfoW</span><span class="p">(</span><span class="n">gdef</span><span class="o">.</span><span class="n">SYMBOL_INFOW</span><span class="p">,</span> <span class="n">SymbolInfoBase</span><span class="p">):</span>
-<span class="w">    </span><span class="sd">&quot;&quot;&quot;Represent a Symbol.</span>
+<span class="w">    </span><span class="sa">r</span><span class="sd">&quot;&quot;&quot;Represent a Symbol.</span>
 <span class="sd">    This class in based on the class `SYMBOL_INFO &lt;https://docs.microsoft.com/en-us/windows/win32/api/dbghelp/ns-dbghelp-symbol_info&gt;`_</span>
 <span class="sd">    with the handling on displacement embeded into it.s</span>
 
@@ -222,6 +222,10 @@
             <span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">LocalFree</span><span class="p">(</span><span class="n">res</span><span class="p">)</span>
         <span class="k">return</span> <span class="n">newres</span>
 
+    <span class="nd">@property</span>
+    <span class="k">def</span> <span class="nf">module</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
+        <span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">resolver</span><span class="o">.</span><span class="n">get_module</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">modbase</span><span class="p">)</span>
+
     <span class="nd">@property</span>
     <span class="k">def</span> <span class="nf">name</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
         <span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">_get_type_info</span><span class="p">(</span><span class="n">gdef</span><span class="o">.</span><span class="n">TI_GET_SYMNAME</span><span class="p">)</span>
@@ -373,7 +377,7 @@
 
     <span class="nd">@property</span>
     <span class="k">def</span> <span class="nf">pdb</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
-<span class="w">        </span><span class="sd">&quot;&quot;&quot;The local path of the loaded PDB if present</span>
+<span class="w">        </span><span class="sa">r</span><span class="sd">&quot;&quot;&quot;The local path of the loaded PDB if present</span>
 
 <span class="sd">        Exemple:</span>
 <span class="sd">            &gt;&gt;&gt; sh = windows.debug.symbols.VirtualSymbolHandler()</span>
@@ -503,7 +507,7 @@
         <span class="k">return</span> <span class="n">sym</span>
 
     <span class="k">def</span> <span class="nf">resolve</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">name_or_addr</span><span class="p">):</span>
-<span class="w">        </span><span class="sd">&quot;&quot;&quot;Resolve ``name_or_addr``.</span>
+<span class="w">        </span><span class="sa">r</span><span class="sd">&quot;&quot;&quot;Resolve ``name_or_addr``.</span>
 
 <span class="sd">        If its an int -&gt; Return the :class:`SymbolInfo` at the address.</span>
 <span class="sd">        If its a string -&gt; Return the :class:`SymbolInfo` corresponding to the symbol name</span>
@@ -552,7 +556,7 @@
         <span class="k">return</span> <span class="kc">True</span>
 
     <span class="k">def</span> <span class="nf">search</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">mask</span><span class="p">,</span> <span class="n">mod</span><span class="o">=</span><span class="mi">0</span><span class="p">,</span> <span class="n">tag</span><span class="o">=</span><span class="mi">0</span><span class="p">,</span> <span class="n">options</span><span class="o">=</span><span class="n">gdef</span><span class="o">.</span><span class="n">SYMSEARCH_ALLITEMS</span><span class="p">,</span> <span class="n">callback</span><span class="o">=</span><span class="kc">None</span><span class="p">):</span>
-<span class="w">        </span><span class="sd">&quot;&quot;&quot;Search the symbols matching ``mask`` (``Windbg`` like).</span>
+<span class="w">        </span><span class="sa">r</span><span class="sd">&quot;&quot;&quot;Search the symbols matching ``mask`` (``Windbg`` like).</span>
 
 <span class="sd">        :return: [:class:`SymbolInfo`] -- A list of :class:`SymbolInfo`</span>
 
@@ -605,12 +609,6 @@
         <span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">SymGetTypeFromNameW</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">mod</span><span class="p">,</span> <span class="n">name</span><span class="p">,</span> <span class="n">buff</span><span class="p">)</span>
         <span class="k">return</span> <span class="n">SymbolType</span><span class="o">.</span><span class="n">from_symbol_info</span><span class="p">(</span><span class="n">buff</span><span class="p">[</span><span class="mi">0</span><span class="p">],</span> <span class="n">resolver</span><span class="o">=</span><span class="bp">self</span><span class="p">)</span>
 
-    <span class="c1">#</span>
-    <span class="k">def</span> <span class="nf">types</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">mod</span><span class="o">=</span><span class="kc">None</span><span class="p">):</span>
-        <span class="n">typeslist</span> <span class="o">=</span> <span class="p">[]</span> <span class="c1"># Iter on types of all modules if None provided ?</span>
-        <span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">SymEnumTypes</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">mod</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">simple_aggregator</span><span class="p">,</span> <span class="n">typeslist</span><span class="p">)</span>
-        <span class="k">return</span> <span class="p">[</span><span class="n">SymbolType</span><span class="o">.</span><span class="n">from_symbol_info</span><span class="p">(</span><span class="n">t</span><span class="p">,</span> <span class="n">resolver</span><span class="o">=</span><span class="bp">self</span><span class="p">)</span> <span class="k">for</span> <span class="n">t</span> <span class="ow">in</span> <span class="n">typeslist</span><span class="p">]</span>
-
 
 <span class="c1"># TODO: mets de l&#39;huile pour w4kfu</span>
 <span class="k">class</span> <span class="nc">StackWalker</span><span class="p">(</span><span class="nb">object</span><span class="p">):</span>
@@ -869,7 +867,7 @@
         <li class="right" >
           <a href="../../../py-modindex.html" title="Python Module Index"
              >modules</a> |</li>
-        <li class="nav-item nav-item-0"><a href="../../../index.html">PythonForWindows 1.0.2 documentation</a> &#187;</li>
+        <li class="nav-item nav-item-0"><a href="../../../index.html">PythonForWindows 1.0.3 documentation</a> &#187;</li>
           <li class="nav-item nav-item-1"><a href="../../index.html" >Module code</a> &#187;</li>
         <li class="nav-item nav-item-this"><a href="">windows.debug.symbols</a></li> 
       </ul>

docs/build/html/_modules/windows/generated_def/flag.html

@@ -4,12 +4,12 @@
   <head>
     <meta charset="utf-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-    <title>windows.generated_def.flag &#8212; PythonForWindows 1.0.2 documentation</title>
+    <title>windows.generated_def.flag &#8212; PythonForWindows 1.0.3 documentation</title>
     <link rel="stylesheet" type="text/css" href="../../../_static/pygments.css?v=fa44fd50" />
     <link rel="stylesheet" type="text/css" href="../../../_static/classic.css?v=def86cc0" />
     <link rel="stylesheet" type="text/css" href="../../../_static/css/mbasic.css?v=957880af" />
     
-    <script src="../../../_static/documentation_options.js?v=1ed6394b"></script>
+    <script src="../../../_static/documentation_options.js?v=baaebd52"></script>
     <script src="../../../_static/doctools.js?v=9a2dae69"></script>
     <script src="../../../_static/sphinx_highlight.js?v=dc90522c"></script>
     
@@ -25,7 +25,7 @@
         <li class="right" >
           <a href="../../../py-modindex.html" title="Python Module Index"
              >modules</a> |</li>
-        <li class="nav-item nav-item-0"><a href="../../../index.html">PythonForWindows 1.0.2 documentation</a> &#187;</li>
+        <li class="nav-item nav-item-0"><a href="../../../index.html">PythonForWindows 1.0.3 documentation</a> &#187;</li>
           <li class="nav-item nav-item-1"><a href="../../index.html" accesskey="U">Module code</a> &#187;</li>
         <li class="nav-item nav-item-this"><a href="">windows.generated_def.flag</a></li> 
       </ul>
@@ -145,7 +145,7 @@
         <li class="right" >
           <a href="../../../py-modindex.html" title="Python Module Index"
              >modules</a> |</li>
-        <li class="nav-item nav-item-0"><a href="../../../index.html">PythonForWindows 1.0.2 documentation</a> &#187;</li>
+        <li class="nav-item nav-item-0"><a href="../../../index.html">PythonForWindows 1.0.3 documentation</a> &#187;</li>
           <li class="nav-item nav-item-1"><a href="../../index.html" >Module code</a> &#187;</li>
         <li class="nav-item nav-item-this"><a href="">windows.generated_def.flag</a></li> 
       </ul>

docs/build/html/_modules/windows/generated_def/interfaces.html

@@ -4,12 +4,12 @@
   <head>
     <meta charset="utf-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-    <title>windows.generated_def.interfaces &#8212; PythonForWindows 1.0.2 documentation</title>
+    <title>windows.generated_def.interfaces &#8212; PythonForWindows 1.0.3 documentation</title>
     <link rel="stylesheet" type="text/css" href="../../../_static/pygments.css?v=fa44fd50" />
     <link rel="stylesheet" type="text/css" href="../../../_static/classic.css?v=def86cc0" />
     <link rel="stylesheet" type="text/css" href="../../../_static/css/mbasic.css?v=957880af" />
     
-    <script src="../../../_static/documentation_options.js?v=1ed6394b"></script>
+    <script src="../../../_static/documentation_options.js?v=baaebd52"></script>
     <script src="../../../_static/doctools.js?v=9a2dae69"></script>
     <script src="../../../_static/sphinx_highlight.js?v=dc90522c"></script>
     
@@ -25,7 +25,7 @@
         <li class="right" >
           <a href="../../../py-modindex.html" title="Python Module Index"
              >modules</a> |</li>
-        <li class="nav-item nav-item-0"><a href="../../../index.html">PythonForWindows 1.0.2 documentation</a> &#187;</li>
+        <li class="nav-item nav-item-0"><a href="../../../index.html">PythonForWindows 1.0.3 documentation</a> &#187;</li>
           <li class="nav-item nav-item-1"><a href="../../index.html" accesskey="U">Module code</a> &#187;</li>
         <li class="nav-item nav-item-this"><a href="">windows.generated_def.interfaces</a></li> 
       </ul>
@@ -3998,7 +3998,7 @@
         <li class="right" >
           <a href="../../../py-modindex.html" title="Python Module Index"
              >modules</a> |</li>
-        <li class="nav-item nav-item-0"><a href="../../../index.html">PythonForWindows 1.0.2 documentation</a> &#187;</li>
+        <li class="nav-item nav-item-0"><a href="../../../index.html">PythonForWindows 1.0.3 documentation</a> &#187;</li>
           <li class="nav-item nav-item-1"><a href="../../index.html" >Module code</a> &#187;</li>
         <li class="nav-item nav-item-this"><a href="">windows.generated_def.interfaces</a></li> 
       </ul>

docs/build/html/_modules/windows/pe_parse.html

@@ -4,12 +4,12 @@
   <head>
     <meta charset="utf-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-    <title>windows.pe_parse &#8212; PythonForWindows 1.0.2 documentation</title>
+    <title>windows.pe_parse &#8212; PythonForWindows 1.0.3 documentation</title>
     <link rel="stylesheet" type="text/css" href="../../_static/pygments.css?v=fa44fd50" />
     <link rel="stylesheet" type="text/css" href="../../_static/classic.css?v=def86cc0" />
     <link rel="stylesheet" type="text/css" href="../../_static/css/mbasic.css?v=957880af" />
     
-    <script src="../../_static/documentation_options.js?v=1ed6394b"></script>
+    <script src="../../_static/documentation_options.js?v=baaebd52"></script>
     <script src="../../_static/doctools.js?v=9a2dae69"></script>
     <script src="../../_static/sphinx_highlight.js?v=dc90522c"></script>
     
@@ -25,7 +25,7 @@
         <li class="right" >
           <a href="../../py-modindex.html" title="Python Module Index"
              >modules</a> |</li>
-        <li class="nav-item nav-item-0"><a href="../../index.html">PythonForWindows 1.0.2 documentation</a> &#187;</li>
+        <li class="nav-item nav-item-0"><a href="../../index.html">PythonForWindows 1.0.3 documentation</a> &#187;</li>
           <li class="nav-item nav-item-1"><a href="../index.html" accesskey="U">Module code</a> &#187;</li>
         <li class="nav-item nav-item-this"><a href="">windows.pe_parse</a></li> 
       </ul>
@@ -42,6 +42,7 @@
 <span class="kn">import</span> <span class="nn">windows.hooks</span> <span class="k">as</span> <span class="nn">hooks</span>
 <span class="kn">import</span> <span class="nn">windows.utils</span> <span class="k">as</span> <span class="nn">utils</span>
 
+<span class="kn">import</span> <span class="nn">windows.generated_def</span> <span class="k">as</span> <span class="nn">gdef</span>
 <span class="kn">from</span> <span class="nn">windows.generated_def.winstructs</span> <span class="kn">import</span> <span class="o">*</span>
 <span class="kn">from</span> <span class="nn">windows.utils</span> <span class="kn">import</span> <span class="n">transform_ctypes_fields</span>
 <span class="kn">import</span> <span class="nn">windows.remotectypes</span> <span class="k">as</span> <span class="nn">rctypes</span>
@@ -77,9 +78,9 @@
     <span class="c1"># We can force bitness as the field we access are bitness-independant</span>
     <span class="n">pe</span> <span class="o">=</span> <span class="n">GetPEFile</span><span class="p">(</span><span class="n">baseaddr</span><span class="p">,</span> <span class="n">target</span><span class="p">,</span> <span class="n">force_bitness</span><span class="o">=</span><span class="mi">32</span><span class="p">)</span>
     <span class="n">machine</span> <span class="o">=</span> <span class="n">pe</span><span class="o">.</span><span class="n">get_NT_HEADER</span><span class="p">()</span><span class="o">.</span><span class="n">FileHeader</span><span class="o">.</span><span class="n">Machine</span>
-    <span class="k">if</span> <span class="n">machine</span> <span class="o">==</span> <span class="mh">0x14c</span><span class="p">:</span>
+    <span class="k">if</span> <span class="n">machine</span> <span class="o">==</span> <span class="n">gdef</span><span class="o">.</span><span class="n">IMAGE_FILE_MACHINE_I386</span><span class="p">:</span>
         <span class="k">return</span> <span class="mi">32</span>
-    <span class="k">elif</span> <span class="n">machine</span> <span class="o">==</span> <span class="mh">0x8664</span><span class="p">:</span>
+    <span class="k">elif</span> <span class="n">machine</span> <span class="ow">in</span> <span class="p">(</span><span class="n">gdef</span><span class="o">.</span><span class="n">IMAGE_FILE_MACHINE_AMD64</span><span class="p">,</span> <span class="n">gdef</span><span class="o">.</span><span class="n">IMAGE_FILE_MACHINE_ARM64</span><span class="p">):</span>
         <span class="k">return</span> <span class="mi">64</span>
     <span class="k">else</span><span class="p">:</span>
         <span class="k">raise</span> <span class="ne">ValueError</span><span class="p">(</span><span class="s2">&quot;Unknow PE target machine &lt;0x</span><span class="si">{0:x}</span><span class="s2">&gt;&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">machine</span><span class="p">))</span>
@@ -150,7 +151,7 @@
         <span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">target</span> <span class="ow">is</span> <span class="kc">None</span><span class="p">:</span>
             <span class="n">name</span> <span class="o">=</span> <span class="n">get_string</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">target</span><span class="p">,</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">addressof</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">Name</span><span class="p">))[:</span><span class="mi">8</span><span class="p">]</span>
         <span class="k">else</span><span class="p">:</span>
-            <span class="n">name</span> <span class="o">=</span> <span class="n">get_string</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">target</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">_base_addr</span><span class="p">)[:</span><span class="mi">8</span><span class="p">]</span>
+            <span class="n">name</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">target</span><span class="o">.</span><span class="n">read_memory</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">_base_addr</span><span class="p">,</span> <span class="mi">8</span><span class="p">)</span><span class="o">.</span><span class="n">split</span><span class="p">(</span><span class="sa">b</span><span class="s2">&quot;</span><span class="se">\x00</span><span class="s2">&quot;</span><span class="p">,</span> <span class="mi">1</span><span class="p">)[</span><span class="mi">0</span><span class="p">]</span><span class="o">.</span><span class="n">decode</span><span class="p">(</span><span class="s2">&quot;ascii&quot;</span><span class="p">)</span>
         <span class="c1"># Decode as UTF-8 as the MS doc say ?</span>
         <span class="k">return</span> <span class="n">name</span>
 
@@ -549,7 +550,7 @@
         <li class="right" >
           <a href="../../py-modindex.html" title="Python Module Index"
              >modules</a> |</li>
-        <li class="nav-item nav-item-0"><a href="../../index.html">PythonForWindows 1.0.2 documentation</a> &#187;</li>
+        <li class="nav-item nav-item-0"><a href="../../index.html">PythonForWindows 1.0.3 documentation</a> &#187;</li>
           <li class="nav-item nav-item-1"><a href="../index.html" >Module code</a> &#187;</li>
         <li class="nav-item nav-item-this"><a href="">windows.pe_parse</a></li> 
       </ul>

docs/build/html/_modules/windows/remotectypes.html

@@ -4,12 +4,12 @@
   <head>
     <meta charset="utf-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-    <title>windows.remotectypes &#8212; PythonForWindows 1.0.2 documentation</title>
+    <title>windows.remotectypes &#8212; PythonForWindows 1.0.3 documentation</title>
     <link rel="stylesheet" type="text/css" href="../../_static/pygments.css?v=fa44fd50" />
     <link rel="stylesheet" type="text/css" href="../../_static/classic.css?v=def86cc0" />
     <link rel="stylesheet" type="text/css" href="../../_static/css/mbasic.css?v=957880af" />
     
-    <script src="../../_static/documentation_options.js?v=1ed6394b"></script>
+    <script src="../../_static/documentation_options.js?v=baaebd52"></script>
     <script src="../../_static/doctools.js?v=9a2dae69"></script>
     <script src="../../_static/sphinx_highlight.js?v=dc90522c"></script>
     
@@ -25,7 +25,7 @@
         <li class="right" >
           <a href="../../py-modindex.html" title="Python Module Index"
              >modules</a> |</li>
-        <li class="nav-item nav-item-0"><a href="../../index.html">PythonForWindows 1.0.2 documentation</a> &#187;</li>
+        <li class="nav-item nav-item-0"><a href="../../index.html">PythonForWindows 1.0.3 documentation</a> &#187;</li>
           <li class="nav-item nav-item-1"><a href="../index.html" accesskey="U">Module code</a> &#187;</li>
         <li class="nav-item nav-item-this"><a href="">windows.remotectypes</a></li> 
       </ul>
@@ -599,7 +599,7 @@
         <li class="right" >
           <a href="../../py-modindex.html" title="Python Module Index"
              >modules</a> |</li>
-        <li class="nav-item nav-item-0"><a href="../../index.html">PythonForWindows 1.0.2 documentation</a> &#187;</li>
+        <li class="nav-item nav-item-0"><a href="../../index.html">PythonForWindows 1.0.3 documentation</a> &#187;</li>
           <li class="nav-item nav-item-1"><a href="../index.html" >Module code</a> &#187;</li>
         <li class="nav-item nav-item-this"><a href="">windows.remotectypes</a></li> 
       </ul>

docs/build/html/_modules/windows/rpc/client.html

@@ -216,7 +216,7 @@
             <span class="n">this</span><span class="o">.</span><span class="n">version</span> <span class="o">=</span> <span class="p">(</span><span class="mi">5</span><span class="p">,</span><span class="mi">7</span><span class="p">)</span>
             <span class="n">this</span><span class="o">.</span><span class="n">flags</span> <span class="o">=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">ORPCF_LOCAL</span>
             <span class="c1"># Returned correct type with mandatory fields filed</span>
-            <span class="n">lthis</span> <span class="o">=</span> <span class="n">find_correct_localthis_for_version</span><span class="p">()</span>
+            <span class="n">lthis</span> <span class="o">=</span> <span class="n">fill_correct_localthis_for_version</span><span class="p">()</span>
             <span class="k">return</span> <span class="n">buffer</span><span class="p">(</span><span class="n">req</span><span class="p">)[:]</span> <span class="o">+</span> <span class="n">buffer</span><span class="p">(</span><span class="n">this</span><span class="p">)[:]</span> <span class="o">+</span> <span class="n">buffer</span><span class="p">(</span><span class="n">lthis</span><span class="p">)[:]</span> <span class="o">+</span> <span class="n">params</span>
         <span class="k">return</span> <span class="n">buffer</span><span class="p">(</span><span class="n">req</span><span class="p">)[:]</span> <span class="o">+</span> <span class="n">params</span>
 
@@ -255,8 +255,11 @@
         <span class="s2">&quot;raise if request_type == RESPONSE_TYPE_FAIL&quot;</span>
         <span class="n">request_type</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">unpack</span><span class="p">(</span><span class="s2">&quot;&lt;I&quot;</span><span class="p">,</span> <span class="n">response</span><span class="o">.</span><span class="n">data</span><span class="p">[:</span><span class="mi">4</span><span class="p">])[</span><span class="mi">0</span><span class="p">]</span>
         <span class="k">if</span> <span class="n">request_type</span> <span class="o">==</span> <span class="n">gdef</span><span class="o">.</span><span class="n">RPC_RESPONSE_TYPE_FAIL</span><span class="p">:</span>
-            <span class="n">error_code</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">unpack</span><span class="p">(</span><span class="s2">&quot;&lt;5I&quot;</span><span class="p">,</span> <span class="n">response</span><span class="o">.</span><span class="n">data</span><span class="p">)[</span><span class="mi">2</span><span class="p">]</span>
-            <span class="k">raise</span> <span class="ne">ValueError</span><span class="p">(</span><span class="s2">&quot;RPC Response error </span><span class="si">{0}</span><span class="s2"> (</span><span class="si">{1!r}</span><span class="s2">)&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">error_code</span><span class="p">,</span> <span class="n">KNOWN_RPC_ERROR_CODE</span><span class="o">.</span><span class="n">get</span><span class="p">(</span><span class="n">error_code</span><span class="p">,</span> <span class="n">error_code</span><span class="p">)))</span>
+            <span class="n">effective_error_code</span> <span class="o">=</span> <span class="n">error_code</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">unpack</span><span class="p">(</span><span class="s2">&quot;&lt;5I&quot;</span><span class="p">,</span> <span class="n">response</span><span class="o">.</span><span class="n">data</span><span class="p">)[</span><span class="mi">2</span><span class="p">]</span>
+            <span class="c1"># https://learn.microsoft.com/en-us/windows/win32/com/structure-of-com-error-codes</span>
+            <span class="k">if</span> <span class="n">gdef</span><span class="o">.</span><span class="n">HRESULT_FACILITY</span><span class="p">(</span><span class="n">error_code</span><span class="p">)</span> <span class="o">==</span> <span class="n">gdef</span><span class="o">.</span><span class="n">FACILITY_WIN32</span><span class="p">:</span>
+                <span class="n">effective_error_code</span> <span class="o">=</span> <span class="n">effective_error_code</span> <span class="o">&amp;</span> <span class="mh">0xffff</span>
+            <span class="k">raise</span> <span class="ne">ValueError</span><span class="p">(</span><span class="s2">&quot;RPC Response error </span><span class="si">{0:#x}</span><span class="s2"> (</span><span class="si">{1!r}</span><span class="s2">)&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">error_code</span><span class="p">,</span> <span class="n">KNOWN_RPC_ERROR_CODE</span><span class="p">[</span><span class="n">effective_error_code</span><span class="p">]))</span>
         <span class="k">return</span> <span class="n">request_type</span>
 
     <span class="k">def</span> <span class="nf">_get_response_effective_data</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">response</span><span class="p">):</span>
@@ -267,33 +270,41 @@
             <span class="n">data</span> <span class="o">=</span> <span class="n">response</span><span class="o">.</span><span class="n">data</span><span class="p">[</span><span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">ALPC_RPC_RESPONSE</span><span class="p">):]</span>
         <span class="k">else</span><span class="p">:</span>
             <span class="c1"># Response in view M extract size from PORT_MESSAGE &amp; read data from view</span>
-            <span class="k">assert</span> <span class="n">response</span><span class="o">.</span><span class="n">port_message</span><span class="o">.</span><span class="n">u1</span><span class="o">.</span><span class="n">s1</span><span class="o">.</span><span class="n">TotalLength</span> <span class="o">&gt;=</span> <span class="mh">0x48</span> <span class="c1"># At least 0x20 of data</span>
+            <span class="k">assert</span> <span class="n">response</span><span class="o">.</span><span class="n">port_message</span><span class="o">.</span><span class="n">u1</span><span class="o">.</span><span class="n">s1</span><span class="o">.</span><span class="n">DataLength</span> <span class="o">&gt;=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">ALPC_RPC_RESPONSE</span><span class="p">)</span> <span class="c1"># 0x20</span>
             <span class="n">rpcdatasize</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">unpack</span><span class="p">(</span><span class="s2">&quot;&lt;I&quot;</span><span class="p">,</span> <span class="n">response</span><span class="o">.</span><span class="n">data</span><span class="p">[</span><span class="mh">0x18</span><span class="p">:</span><span class="mh">0x1c</span><span class="p">])[</span><span class="mi">0</span><span class="p">]</span> <span class="c1"># ctypes.sizeof(ALPC_RPC_RESPONSE)</span>
             <span class="n">viewattr</span> <span class="o">=</span> <span class="n">response</span><span class="o">.</span><span class="n">view_attribute</span>
             <span class="k">assert</span> <span class="n">viewattr</span><span class="o">.</span><span class="n">ViewSize</span> <span class="o">&gt;=</span> <span class="n">rpcdatasize</span>
             <span class="n">data</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">read_memory</span><span class="p">(</span><span class="n">viewattr</span><span class="o">.</span><span class="n">ViewBase</span><span class="p">,</span> <span class="n">rpcdatasize</span><span class="p">)</span>
+            <span class="c1"># We have copied the data from the view: free it</span>
+            <span class="c1"># It looks like:</span>
+            <span class="c1"># windows.winproxy.NtAlpcDeleteSectionView(self.alpc_client.handle, 0, viewattr.ViewBase)</span>
+            <span class="c1"># Will ne be enough, as it will wait for the message to be reused to unmap the section..</span>
+            <span class="c1"># And the current architecture encourage creating new message every time</span>
         <span class="k">if</span> <span class="n">response_header</span><span class="o">.</span><span class="n">request_id</span> <span class="o">==</span> <span class="bp">self</span><span class="o">.</span><span class="n">REQUEST_IDENTIFIER_ORPC</span><span class="p">:</span>
             <span class="c1"># Parse &amp; remove ORPC headers (orpcthat + LocalThat)</span>
-            <span class="n">orpcthat</span> <span class="o">=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">ORPCTHAT32</span><span class="o">.</span><span class="n">from_buffer_copy</span><span class="p">(</span><span class="n">data</span><span class="p">)</span>
-            <span class="n">data</span> <span class="o">=</span> <span class="n">data</span><span class="p">[</span><span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">orpcthat</span><span class="p">):]</span>
-            <span class="k">if</span> <span class="n">orpcthat</span><span class="o">.</span><span class="n">extensions</span> <span class="o">!=</span> <span class="mi">0</span><span class="p">:</span>
-                <span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Parsing extension !&quot;</span><span class="p">)</span>
-                <span class="c1"># Parse extension : code have not been tested a lot</span>
-                <span class="n">write_array_extend</span> <span class="o">=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">WireExtentArray</span><span class="o">.</span><span class="n">from_buffer_copy</span><span class="p">(</span><span class="n">data</span><span class="p">)</span>
-                <span class="n">data</span> <span class="o">=</span> <span class="n">data</span><span class="p">[</span><span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">gdef</span><span class="o">.</span><span class="n">WireExtentArray</span><span class="p">):]</span>
-                <span class="k">if</span> <span class="n">write_array_extend</span><span class="o">.</span><span class="n">rounded_size</span> <span class="o">!=</span> <span class="mi">2</span><span class="p">:</span>
-                    <span class="k">raise</span> <span class="ne">NotImplementedError</span><span class="p">(</span><span class="s2">&quot;orpcthat.extensions: WireExtentArray.rounded_size != 2&quot;</span><span class="p">)</span>
-                <span class="k">for</span> <span class="n">value</span> <span class="ow">in</span> <span class="n">write_array_extend</span><span class="o">.</span><span class="n">unique_flag</span><span class="p">:</span>
-                    <span class="k">if</span> <span class="n">value</span> <span class="o">!=</span> <span class="mi">0</span><span class="p">:</span>
-                        <span class="n">data</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">_pass_wire_extend</span><span class="p">(</span><span class="n">data</span><span class="p">)</span>
-            <span class="n">localthat_type</span> <span class="o">=</span> <span class="n">find_correct_localthat_for_version</span><span class="p">()</span>
-            <span class="k">if</span> <span class="n">localthat_type</span> <span class="ow">is</span> <span class="ow">not</span> <span class="kc">None</span><span class="p">:</span>
-                <span class="n">localthat</span> <span class="o">=</span> <span class="n">localthat_type</span><span class="o">.</span><span class="n">from_buffer_copy</span><span class="p">(</span><span class="n">data</span><span class="p">)</span>
-                <span class="c1"># Check localthat pointers are empty</span>
-                <span class="k">for</span> <span class="n">field</span> <span class="ow">in</span> <span class="p">(</span><span class="s2">&quot;pAsyncResponseBlock&quot;</span><span class="p">,</span> <span class="s2">&quot;containerErrorInformation&quot;</span><span class="p">,</span> <span class="s2">&quot;containerPassthroughData&quot;</span><span class="p">):</span>
-                    <span class="k">if</span> <span class="nb">getattr</span><span class="p">(</span><span class="n">localthat</span><span class="p">,</span> <span class="n">field</span><span class="p">,</span> <span class="mi">0</span><span class="p">)</span> <span class="o">!=</span> <span class="mi">0</span><span class="p">:</span>
-                        <span class="k">raise</span> <span class="ne">NotImplementedError</span><span class="p">(</span><span class="s2">&quot;ORPC Response with localthat.</span><span class="si">{0}</span><span class="s2"> != 0&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">field</span><span class="p">))</span>
-                <span class="n">data</span> <span class="o">=</span> <span class="n">data</span><span class="p">[</span><span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">localthat</span><span class="p">):]</span>
+            <span class="n">data</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">_pass_orpc_response_structures</span><span class="p">(</span><span class="n">data</span><span class="p">)</span>
+        <span class="k">return</span> <span class="n">data</span>
+
+    <span class="k">def</span> <span class="nf">_pass_orpc_response_structures</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">data</span><span class="p">):</span>
+        <span class="n">orpcthat</span> <span class="o">=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">ORPCTHAT32</span><span class="o">.</span><span class="n">from_buffer_copy</span><span class="p">(</span><span class="n">data</span><span class="p">)</span>
+        <span class="n">data</span> <span class="o">=</span> <span class="n">data</span><span class="p">[</span><span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">orpcthat</span><span class="p">):]</span>
+        <span class="k">if</span> <span class="n">orpcthat</span><span class="o">.</span><span class="n">extensions</span> <span class="o">!=</span> <span class="mi">0</span><span class="p">:</span>
+            <span class="c1"># Parse extension : code have not been tested a lot</span>
+            <span class="n">write_array_extend</span> <span class="o">=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">WireExtentArray</span><span class="o">.</span><span class="n">from_buffer_copy</span><span class="p">(</span><span class="n">data</span><span class="p">)</span>
+            <span class="n">data</span> <span class="o">=</span> <span class="n">data</span><span class="p">[</span><span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">gdef</span><span class="o">.</span><span class="n">WireExtentArray</span><span class="p">):]</span>
+            <span class="k">if</span> <span class="n">write_array_extend</span><span class="o">.</span><span class="n">rounded_size</span> <span class="o">!=</span> <span class="mi">2</span><span class="p">:</span>
+                <span class="k">raise</span> <span class="ne">NotImplementedError</span><span class="p">(</span><span class="s2">&quot;orpcthat.extensions: WireExtentArray.rounded_size != 2&quot;</span><span class="p">)</span>
+            <span class="k">for</span> <span class="n">value</span> <span class="ow">in</span> <span class="n">write_array_extend</span><span class="o">.</span><span class="n">unique_flag</span><span class="p">:</span>
+                <span class="k">if</span> <span class="n">value</span> <span class="o">!=</span> <span class="mi">0</span><span class="p">:</span>
+                    <span class="n">data</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">_pass_wire_extend</span><span class="p">(</span><span class="n">data</span><span class="p">)</span>
+        <span class="n">localthat_type</span> <span class="o">=</span> <span class="n">find_correct_localthat_for_version</span><span class="p">()</span>
+        <span class="k">if</span> <span class="n">localthat_type</span> <span class="ow">is</span> <span class="ow">not</span> <span class="kc">None</span><span class="p">:</span>
+            <span class="n">localthat</span> <span class="o">=</span> <span class="n">localthat_type</span><span class="o">.</span><span class="n">from_buffer_copy</span><span class="p">(</span><span class="n">data</span><span class="p">)</span>
+            <span class="c1"># Check localthat pointers are empty</span>
+            <span class="k">for</span> <span class="n">field</span> <span class="ow">in</span> <span class="p">(</span><span class="s2">&quot;pAsyncResponseBlock&quot;</span><span class="p">,</span> <span class="s2">&quot;containerErrorInformation&quot;</span><span class="p">,</span> <span class="s2">&quot;containerPassthroughData&quot;</span><span class="p">):</span>
+                <span class="k">if</span> <span class="nb">getattr</span><span class="p">(</span><span class="n">localthat</span><span class="p">,</span> <span class="n">field</span><span class="p">,</span> <span class="mi">0</span><span class="p">)</span> <span class="o">!=</span> <span class="mi">0</span><span class="p">:</span>
+                    <span class="k">raise</span> <span class="ne">NotImplementedError</span><span class="p">(</span><span class="s2">&quot;ORPC Response with localthat.</span><span class="si">{0}</span><span class="s2"> != 0&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">field</span><span class="p">))</span>
+            <span class="n">data</span> <span class="o">=</span> <span class="n">data</span><span class="p">[</span><span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">localthat</span><span class="p">):]</span>
         <span class="k">return</span> <span class="n">data</span>
 
     <span class="k">def</span> <span class="nf">_pass_wire_extend</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">data</span><span class="p">):</span>
@@ -319,7 +330,7 @@
 <span class="c1"># Nb fields:  7</span>
 <span class="c1"># 10.0.16299.1 -&gt; 10.0.26100.2454</span>
 
-<span class="k">def</span> <span class="nf">find_correct_localthis_for_version</span><span class="p">():</span>
+<span class="k">def</span> <span class="nf">fill_correct_localthis_for_version</span><span class="p">():</span>
     <span class="n">vmaj</span><span class="p">,</span> <span class="n">vmin</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">system</span><span class="o">.</span><span class="n">version</span>
     <span class="k">if</span> <span class="p">(</span><span class="n">vmaj</span><span class="p">,</span> <span class="n">vmin</span><span class="p">)</span> <span class="o">&lt;</span> <span class="p">(</span><span class="mi">6</span><span class="p">,</span> <span class="mi">1</span><span class="p">):</span>
         <span class="k">return</span> <span class="kc">None</span>

docs/build/html/_modules/windows/rpc/ndr.html

@@ -4,12 +4,12 @@
   <head>
     <meta charset="utf-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-    <title>windows.rpc.ndr &#8212; PythonForWindows 1.0.2 documentation</title>
+    <title>windows.rpc.ndr &#8212; PythonForWindows 1.0.3 documentation</title>
     <link rel="stylesheet" type="text/css" href="../../../_static/pygments.css?v=fa44fd50" />
     <link rel="stylesheet" type="text/css" href="../../../_static/classic.css?v=def86cc0" />
     <link rel="stylesheet" type="text/css" href="../../../_static/css/mbasic.css?v=957880af" />
     
-    <script src="../../../_static/documentation_options.js?v=1ed6394b"></script>
+    <script src="../../../_static/documentation_options.js?v=baaebd52"></script>
     <script src="../../../_static/doctools.js?v=9a2dae69"></script>
     <script src="../../../_static/sphinx_highlight.js?v=dc90522c"></script>
     
@@ -25,7 +25,7 @@
         <li class="right" >
           <a href="../../../py-modindex.html" title="Python Module Index"
              >modules</a> |</li>
-        <li class="nav-item nav-item-0"><a href="../../../index.html">PythonForWindows 1.0.2 documentation</a> &#187;</li>
+        <li class="nav-item nav-item-0"><a href="../../../index.html">PythonForWindows 1.0.3 documentation</a> &#187;</li>
           <li class="nav-item nav-item-1"><a href="../../index.html" accesskey="U">Module code</a> &#187;</li>
         <li class="nav-item nav-item-this"><a href="">windows.rpc.ndr</a></li> 
       </ul>
@@ -229,6 +229,8 @@
         <span class="k">assert</span> <span class="n">size1</span> <span class="o">==</span> <span class="n">size2</span>
         <span class="k">assert</span> <span class="n">zero</span> <span class="o">==</span> <span class="mi">0</span>
         <span class="n">s</span> <span class="o">=</span> <span class="n">stream</span><span class="o">.</span><span class="n">read</span><span class="p">(</span><span class="n">size1</span> <span class="o">*</span> <span class="mi">2</span><span class="p">)</span>
+        <span class="k">if</span> <span class="n">stream</span><span class="o">.</span><span class="n">use_memoryview</span><span class="p">:</span>
+            <span class="k">return</span> <span class="nb">bytearray</span><span class="p">(</span><span class="n">s</span><span class="p">)</span><span class="o">.</span><span class="n">decode</span><span class="p">(</span><span class="s2">&quot;utf-16-le&quot;</span><span class="p">)</span>
         <span class="k">return</span> <span class="n">s</span><span class="o">.</span><span class="n">decode</span><span class="p">(</span><span class="s2">&quot;utf-16-le&quot;</span><span class="p">)</span>
 
     <span class="nd">@classmethod</span>
@@ -652,10 +654,14 @@
 <a class="viewcode-back" href="../../../rpc.html#windows.rpc.ndr.NdrStream">[docs]</a>
 <span class="k">class</span> <span class="nc">NdrStream</span><span class="p">(</span><span class="nb">object</span><span class="p">):</span>
 <span class="w">    </span><span class="sd">&quot;&quot;&quot;A stream of bytes used for NDR unpacking&quot;&quot;&quot;</span>
-    <span class="k">def</span> <span class="fm">__init__</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">data</span><span class="p">):</span>
+    <span class="k">def</span> <span class="fm">__init__</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">data</span><span class="p">,</span> <span class="n">use_memoryview</span><span class="o">=</span><span class="kc">False</span><span class="p">):</span>
+<span class="w">        </span><span class="sd">&quot;&quot;&quot;&quot;&quot;&quot;</span>
         <span class="bp">self</span><span class="o">.</span><span class="n">fulldata</span> <span class="o">=</span> <span class="n">data</span>
-        <span class="bp">self</span><span class="o">.</span><span class="n">data</span> <span class="o">=</span> <span class="n">data</span>
-        <span class="c1"># self.data = memoryview(data) # FAST but need some code rewrite at some places</span>
+        <span class="bp">self</span><span class="o">.</span><span class="n">use_memoryview</span> <span class="o">=</span> <span class="n">use_memoryview</span>
+        <span class="k">if</span> <span class="n">use_memoryview</span><span class="p">:</span>
+            <span class="bp">self</span><span class="o">.</span><span class="n">data</span> <span class="o">=</span> <span class="nb">memoryview</span><span class="p">(</span><span class="n">data</span><span class="p">)</span> <span class="c1"># FAST but need some code rewrite at some places</span>
+        <span class="k">else</span><span class="p">:</span>
+            <span class="bp">self</span><span class="o">.</span><span class="n">data</span> <span class="o">=</span> <span class="n">data</span>
 
     <span class="k">def</span> <span class="nf">partial_unpack</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="nb">format</span><span class="p">):</span>
         <span class="n">size</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">calcsize</span><span class="p">(</span><span class="nb">format</span><span class="p">)</span>
@@ -757,7 +763,7 @@
         <li class="right" >
           <a href="../../../py-modindex.html" title="Python Module Index"
              >modules</a> |</li>
-        <li class="nav-item nav-item-0"><a href="../../../index.html">PythonForWindows 1.0.2 documentation</a> &#187;</li>
+        <li class="nav-item nav-item-0"><a href="../../../index.html">PythonForWindows 1.0.3 documentation</a> &#187;</li>
           <li class="nav-item nav-item-1"><a href="../../index.html" >Module code</a> &#187;</li>
         <li class="nav-item nav-item-this"><a href="">windows.rpc.ndr</a></li> 
       </ul>

docs/build/html/_modules/windows/syswow64.html

@@ -4,12 +4,12 @@
   <head>
     <meta charset="utf-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-    <title>windows.syswow64 &#8212; PythonForWindows 1.0.2 documentation</title>
+    <title>windows.syswow64 &#8212; PythonForWindows 1.0.3 documentation</title>
     <link rel="stylesheet" type="text/css" href="../../_static/pygments.css?v=fa44fd50" />
     <link rel="stylesheet" type="text/css" href="../../_static/classic.css?v=def86cc0" />
     <link rel="stylesheet" type="text/css" href="../../_static/css/mbasic.css?v=957880af" />
     
-    <script src="../../_static/documentation_options.js?v=1ed6394b"></script>
+    <script src="../../_static/documentation_options.js?v=baaebd52"></script>
     <script src="../../_static/doctools.js?v=9a2dae69"></script>
     <script src="../../_static/sphinx_highlight.js?v=dc90522c"></script>
     
@@ -25,7 +25,7 @@
         <li class="right" >
           <a href="../../py-modindex.html" title="Python Module Index"
              >modules</a> |</li>
-        <li class="nav-item nav-item-0"><a href="../../index.html">PythonForWindows 1.0.2 documentation</a> &#187;</li>
+        <li class="nav-item nav-item-0"><a href="../../index.html">PythonForWindows 1.0.3 documentation</a> &#187;</li>
           <li class="nav-item nav-item-1"><a href="../index.html" accesskey="U">Module code</a> &#187;</li>
         <li class="nav-item nav-item-this"><a href="">windows.syswow64</a></li> 
       </ul>
@@ -212,19 +212,20 @@
 
 <span class="k">def</span> <span class="nf">get_current_process_syswow_peb</span><span class="p">():</span>
     <span class="n">current_process</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span>
-
-    <span class="k">class</span> <span class="nc">CurrentProcessReadSyswow</span><span class="p">(</span><span class="n">process</span><span class="o">.</span><span class="n">Process</span><span class="p">):</span>
-        <span class="n">bitness</span> <span class="o">=</span> <span class="mi">64</span>
-        <span class="k">def</span> <span class="nf">_get_handle</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
-            <span class="k">return</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">OpenProcess</span><span class="p">(</span><span class="n">dwProcessId</span><span class="o">=</span><span class="n">current_process</span><span class="o">.</span><span class="n">pid</span><span class="p">)</span>
-
-        <span class="k">def</span> <span class="nf">read_memory</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">addr</span><span class="p">,</span> <span class="n">size</span><span class="p">):</span>
-            <span class="n">buffer_addr</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">create_string_buffer</span><span class="p">(</span><span class="n">size</span><span class="p">)</span>
-            <span class="n">winproxy</span><span class="o">.</span><span class="n">NtWow64ReadVirtualMemory64</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">addr</span><span class="p">,</span> <span class="n">buffer_addr</span><span class="p">,</span> <span class="n">size</span><span class="p">)</span>
-            <span class="k">return</span> <span class="n">buffer_addr</span><span class="p">[:]</span>
     <span class="n">peb_addr</span> <span class="o">=</span> <span class="n">get_current_process_syswow_peb_addr</span><span class="p">()</span>
     <span class="k">return</span> <span class="n">windows</span><span class="o">.</span><span class="n">winobject</span><span class="o">.</span><span class="n">process</span><span class="o">.</span><span class="n">RemotePEB64</span><span class="p">(</span><span class="n">peb_addr</span><span class="p">,</span> <span class="n">CurrentProcessReadSyswow</span><span class="p">())</span>
 
+<span class="k">class</span> <span class="nc">CurrentProcessReadSyswow</span><span class="p">(</span><span class="n">process</span><span class="o">.</span><span class="n">Process</span><span class="p">):</span>
+    <span class="n">bitness</span> <span class="o">=</span> <span class="mi">64</span>
+
+    <span class="k">def</span> <span class="nf">_get_handle</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
+        <span class="c1"># GetCurrentProcess() is not accepted for NtWow64ReadVirtualMemory64 :(</span>
+        <span class="k">return</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">OpenProcess</span><span class="p">(</span><span class="n">dwProcessId</span><span class="o">=</span><span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">pid</span><span class="p">)</span>
+
+    <span class="k">def</span> <span class="nf">read_memory</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">addr</span><span class="p">,</span> <span class="n">size</span><span class="p">):</span>
+        <span class="n">buffer_addr</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">create_string_buffer</span><span class="p">(</span><span class="n">size</span><span class="p">)</span>
+        <span class="n">winproxy</span><span class="o">.</span><span class="n">NtWow64ReadVirtualMemory64</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">addr</span><span class="p">,</span> <span class="n">buffer_addr</span><span class="p">,</span> <span class="n">size</span><span class="p">)</span>
+        <span class="k">return</span> <span class="n">buffer_addr</span><span class="p">[:]</span>
 
 <span class="k">class</span> <span class="nc">ReadSyswow64Process</span><span class="p">(</span><span class="n">process</span><span class="o">.</span><span class="n">Process</span><span class="p">):</span>
         <span class="k">def</span> <span class="fm">__init__</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">target</span><span class="p">):</span>
@@ -432,7 +433,7 @@
         <li class="right" >
           <a href="../../py-modindex.html" title="Python Module Index"
              >modules</a> |</li>
-        <li class="nav-item nav-item-0"><a href="../../index.html">PythonForWindows 1.0.2 documentation</a> &#187;</li>
+        <li class="nav-item nav-item-0"><a href="../../index.html">PythonForWindows 1.0.3 documentation</a> &#187;</li>
           <li class="nav-item nav-item-1"><a href="../index.html" >Module code</a> &#187;</li>
         <li class="nav-item nav-item-this"><a href="">windows.syswow64</a></li> 
       </ul>

docs/build/html/_modules/windows/utils/winutils.html

@@ -4,12 +4,12 @@
   <head>
     <meta charset="utf-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-    <title>windows.utils.winutils &#8212; PythonForWindows 1.0.2 documentation</title>
+    <title>windows.utils.winutils &#8212; PythonForWindows 1.0.3 documentation</title>
     <link rel="stylesheet" type="text/css" href="../../../_static/pygments.css?v=fa44fd50" />
     <link rel="stylesheet" type="text/css" href="../../../_static/classic.css?v=def86cc0" />
     <link rel="stylesheet" type="text/css" href="../../../_static/css/mbasic.css?v=957880af" />
     
-    <script src="../../../_static/documentation_options.js?v=1ed6394b"></script>
+    <script src="../../../_static/documentation_options.js?v=baaebd52"></script>
     <script src="../../../_static/doctools.js?v=9a2dae69"></script>
     <script src="../../../_static/sphinx_highlight.js?v=dc90522c"></script>
     
@@ -25,7 +25,7 @@
         <li class="right" >
           <a href="../../../py-modindex.html" title="Python Module Index"
              >modules</a> |</li>
-        <li class="nav-item nav-item-0"><a href="../../../index.html">PythonForWindows 1.0.2 documentation</a> &#187;</li>
+        <li class="nav-item nav-item-0"><a href="../../../index.html">PythonForWindows 1.0.3 documentation</a> &#187;</li>
           <li class="nav-item nav-item-1"><a href="../../index.html" accesskey="U">Module code</a> &#187;</li>
         <li class="nav-item nav-item-this"><a href="">windows.utils.winutils</a></li> 
       </ul>
@@ -75,19 +75,6 @@
         <span class="k">return</span> <span class="n">mod</span><span class="o">.</span><span class="n">pe</span><span class="o">.</span><span class="n">exports</span><span class="p">[</span><span class="n">func_name</span><span class="p">]</span>
 
 
-<span class="k">def</span> <span class="nf">is_wow_64</span><span class="p">(</span><span class="n">hProcess</span><span class="p">):</span>
-    <span class="k">try</span><span class="p">:</span>
-        <span class="n">fnIsWow64Process</span> <span class="o">=</span> <span class="n">get_func_addr</span><span class="p">(</span><span class="s2">&quot;kernel32.dll&quot;</span><span class="p">,</span> <span class="s2">&quot;IsWow64Process&quot;</span><span class="p">)</span>
-    <span class="k">except</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">WinproxyError</span><span class="p">:</span>
-        <span class="k">return</span> <span class="kc">False</span>
-    <span class="n">IsWow64Process</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">WINFUNCTYPE</span><span class="p">(</span><span class="n">BOOL</span><span class="p">,</span> <span class="n">HANDLE</span><span class="p">,</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">POINTER</span><span class="p">(</span><span class="n">BOOL</span><span class="p">))(</span><span class="n">fnIsWow64Process</span><span class="p">)</span>
-    <span class="n">Wow64Process</span> <span class="o">=</span> <span class="n">BOOL</span><span class="p">()</span>
-    <span class="n">res</span> <span class="o">=</span> <span class="n">IsWow64Process</span><span class="p">(</span><span class="n">hProcess</span><span class="p">,</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">byref</span><span class="p">(</span><span class="n">Wow64Process</span><span class="p">))</span>
-    <span class="k">if</span> <span class="n">res</span><span class="p">:</span>
-        <span class="k">return</span> <span class="nb">bool</span><span class="p">(</span><span class="n">Wow64Process</span><span class="p">)</span>
-    <span class="k">raise</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">WinError</span><span class="p">()</span>
-
-
 <div class="viewcode-block" id="create_file_from_handle">
 <a class="viewcode-back" href="../../../utils.html#windows.utils.create_file_from_handle">[docs]</a>
 <span class="k">def</span> <span class="nf">create_file_from_handle</span><span class="p">(</span><span class="n">handle</span><span class="p">,</span> <span class="n">mode</span><span class="o">=</span><span class="s2">&quot;r&quot;</span><span class="p">):</span>
@@ -136,14 +123,35 @@
 
 <div class="viewcode-block" id="create_process">
 <a class="viewcode-back" href="../../../utils.html#windows.utils.create_process">[docs]</a>
-<span class="k">def</span> <span class="nf">create_process</span><span class="p">(</span><span class="n">path</span><span class="p">,</span> <span class="n">args</span><span class="o">=</span><span class="kc">None</span><span class="p">,</span> <span class="n">dwCreationFlags</span><span class="o">=</span><span class="mi">0</span><span class="p">,</span> <span class="n">show_windows</span><span class="o">=</span><span class="kc">True</span><span class="p">):</span>
-<span class="w">    </span><span class="sd">&quot;&quot;&quot;A convenient wrapper arround :func:`windows.winproxy.CreateProcessW`&quot;&quot;&quot;</span>
+<span class="k">def</span> <span class="nf">create_process</span><span class="p">(</span><span class="n">path</span><span class="p">,</span> <span class="n">args</span><span class="o">=</span><span class="kc">None</span><span class="p">,</span> <span class="n">dwCreationFlags</span><span class="o">=</span><span class="mi">0</span><span class="p">,</span> <span class="n">show_windows</span><span class="o">=</span><span class="kc">True</span><span class="p">,</span> <span class="n">machine</span><span class="o">=</span><span class="kc">None</span><span class="p">):</span>
+<span class="w">    </span><span class="sd">&quot;&quot;&quot;A convenient wrapper arround :func:`windows.winproxy.CreateProcessW`</span>
+<span class="sd">    ..note:</span>
+<span class="sd">        The machine param only works starting at vista and should be used on arm64 computer</span>
+<span class="sd">    &quot;&quot;&quot;</span>
     <span class="n">proc_info</span> <span class="o">=</span> <span class="n">PROCESS_INFORMATION</span><span class="p">()</span>
+    <span class="n">StartupInfo</span> <span class="o">=</span> <span class="kc">None</span>
     <span class="n">lpStartupInfo</span> <span class="o">=</span> <span class="kc">None</span>
+
+    <span class="k">if</span> <span class="n">machine</span> <span class="ow">is</span> <span class="ow">not</span> <span class="kc">None</span><span class="p">:</span>
+        <span class="n">buffer</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">create_string_buffer</span><span class="p">(</span><span class="mh">0x100</span><span class="p">)</span>
+        <span class="n">size</span> <span class="o">=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">DWORD64</span><span class="p">(</span><span class="nb">len</span><span class="p">(</span><span class="n">buffer</span><span class="p">))</span>
+        <span class="n">machine</span> <span class="o">=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">WORD</span><span class="p">(</span><span class="n">machine</span><span class="p">)</span>
+        <span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">InitializeProcThreadAttributeList</span><span class="p">(</span><span class="n">buffer</span><span class="p">,</span> <span class="mi">1</span><span class="p">,</span> <span class="mi">0</span><span class="p">,</span> <span class="n">size</span><span class="p">)</span>
+        <span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">UpdateProcThreadAttribute</span><span class="p">(</span><span class="n">buffer</span><span class="p">,</span> <span class="mi">0</span><span class="p">,</span> <span class="n">gdef</span><span class="o">.</span><span class="n">PROC_THREAD_ATTRIBUTE_MACHINE_TYPE</span><span class="p">,</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">addressof</span><span class="p">(</span><span class="n">machine</span><span class="p">),</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">machine</span><span class="p">),</span> <span class="kc">None</span><span class="p">,</span> <span class="kc">None</span><span class="p">)</span>
+
+        <span class="n">startup_infoex</span> <span class="o">=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">STARTUPINFOEXW</span><span class="p">()</span>
+        <span class="n">startup_infoex</span><span class="o">.</span><span class="n">StartupInfo</span><span class="o">.</span><span class="n">cb</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">gdef</span><span class="o">.</span><span class="n">STARTUPINFOEXW</span><span class="p">)</span>
+        <span class="n">startup_infoex</span><span class="o">.</span><span class="n">lpAttributeList</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">cast</span><span class="p">(</span><span class="n">buffer</span><span class="p">,</span> <span class="n">gdef</span><span class="o">.</span><span class="n">PVOID</span><span class="p">)</span>
+        <span class="n">StartupInfo</span> <span class="o">=</span> <span class="n">startup_infoex</span><span class="o">.</span><span class="n">StartupInfo</span>
+
+        <span class="n">dwCreationFlags</span> <span class="o">|=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">EXTENDED_STARTUPINFO_PRESENT</span>
+
     <span class="k">if</span> <span class="n">show_windows</span><span class="p">:</span>
-        <span class="n">StartupInfo</span> <span class="o">=</span> <span class="n">STARTUPINFOW</span><span class="p">()</span>
-        <span class="n">StartupInfo</span><span class="o">.</span><span class="n">cb</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">StartupInfo</span><span class="p">)</span>
+        <span class="k">if</span> <span class="n">StartupInfo</span> <span class="ow">is</span> <span class="kc">None</span><span class="p">:</span>
+            <span class="n">StartupInfo</span> <span class="o">=</span> <span class="n">STARTUPINFOW</span><span class="p">()</span>
+            <span class="n">StartupInfo</span><span class="o">.</span><span class="n">cb</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">StartupInfo</span><span class="p">)</span>
         <span class="n">StartupInfo</span><span class="o">.</span><span class="n">dwFlags</span> <span class="o">=</span> <span class="mi">0</span>
+    <span class="k">if</span> <span class="n">StartupInfo</span><span class="p">:</span>
         <span class="n">lpStartupInfo</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">byref</span><span class="p">(</span><span class="n">StartupInfo</span><span class="p">)</span>
     <span class="n">lpCommandLine</span> <span class="o">=</span> <span class="kc">None</span>
     <span class="k">if</span> <span class="nb">isinstance</span><span class="p">(</span><span class="n">path</span><span class="p">,</span> <span class="nb">bytes</span><span class="p">):</span>
@@ -160,6 +168,8 @@
     <span class="n">dbgprint</span><span class="p">(</span><span class="s2">&quot;CreateProcessW new thread handle </span><span class="si">{:#x}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">proc_info</span><span class="o">.</span><span class="n">hThread</span><span class="p">),</span> <span class="s2">&quot;HANDLE&quot;</span><span class="p">)</span>
     <span class="n">dbgprint</span><span class="p">(</span><span class="s2">&quot;Automatic close of thread handle </span><span class="si">{:#x}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">proc_info</span><span class="o">.</span><span class="n">hThread</span><span class="p">),</span> <span class="s2">&quot;HANDLE&quot;</span><span class="p">)</span>
     <span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">CloseHandle</span><span class="p">(</span><span class="n">proc_info</span><span class="o">.</span><span class="n">hThread</span><span class="p">)</span>  <span class="c1"># Give access to a WinThread in addition of the WinProcess ?</span>
+    <span class="k">if</span> <span class="n">machine</span><span class="p">:</span>
+        <span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">DeleteProcThreadAttributeList</span><span class="p">(</span><span class="n">buffer</span><span class="p">)</span>
     <span class="k">return</span> <span class="n">windows</span><span class="o">.</span><span class="n">winobject</span><span class="o">.</span><span class="n">process</span><span class="o">.</span><span class="n">WinProcess</span><span class="p">(</span><span class="n">pid</span><span class="o">=</span><span class="n">proc_info</span><span class="o">.</span><span class="n">dwProcessId</span><span class="p">,</span> <span class="n">handle</span><span class="o">=</span><span class="n">proc_info</span><span class="o">.</span><span class="n">hProcess</span><span class="p">)</span></div>
 
 
@@ -360,6 +370,16 @@
             <span class="n">microsecond</span><span class="o">=</span><span class="n">systime</span><span class="o">.</span><span class="n">wMilliseconds</span> <span class="o">*</span> <span class="mi">1000</span><span class="p">,</span>
     <span class="p">)</span>
 
+<span class="n">IMAGE_FILE_MACHINE_TO_PROC_ARCH</span> <span class="o">=</span> <span class="p">{</span>
+    <span class="n">gdef</span><span class="o">.</span><span class="n">IMAGE_FILE_MACHINE_I386</span><span class="p">:</span> <span class="n">gdef</span><span class="o">.</span><span class="n">PROCESSOR_ARCHITECTURE_INTEL</span><span class="p">,</span>
+    <span class="n">gdef</span><span class="o">.</span><span class="n">IMAGE_FILE_MACHINE_AMD64</span><span class="p">:</span> <span class="n">gdef</span><span class="o">.</span><span class="n">PROCESSOR_ARCHITECTURE_AMD64</span><span class="p">,</span>
+    <span class="n">gdef</span><span class="o">.</span><span class="n">IMAGE_FILE_MACHINE_ARM64</span><span class="p">:</span> <span class="n">gdef</span><span class="o">.</span><span class="n">PROCESSOR_ARCHITECTURE_ARM64</span><span class="p">,</span>
+    <span class="n">gdef</span><span class="o">.</span><span class="n">IMAGE_FILE_MACHINE_UNKNOWN</span><span class="p">:</span> <span class="n">gdef</span><span class="o">.</span><span class="n">PROCESSOR_ARCHITECTURE_UNKNOWN</span>
+<span class="p">}</span>
+
+<span class="k">def</span> <span class="nf">image_file_machine_to_processor_architecture</span><span class="p">(</span><span class="n">image_file_machine</span><span class="p">):</span>
+    <span class="k">return</span> <span class="n">IMAGE_FILE_MACHINE_TO_PROC_ARCH</span><span class="p">[</span><span class="n">image_file_machine</span><span class="p">]</span>
+
 <span class="k">class</span> <span class="nc">FixedInteractiveConsole</span><span class="p">(</span><span class="n">code</span><span class="o">.</span><span class="n">InteractiveConsole</span><span class="p">):</span>
     <span class="k">def</span> <span class="nf">raw_input</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">prompt</span><span class="o">=</span><span class="s2">&quot;&gt;&gt;&gt;&quot;</span><span class="p">):</span>
         <span class="n">sys</span><span class="o">.</span><span class="n">stdout</span><span class="o">.</span><span class="n">write</span><span class="p">(</span><span class="n">prompt</span><span class="p">)</span>
@@ -626,6 +646,14 @@
 <span class="c1">#    addr = windows.winproxy.MapViewOfFile(h, dwDesiredAccess=FILE_MAP_READ, dwNumberOfBytesToMap=1)</span>
 <span class="c1">#    return addr</span>
 
+<span class="k">def</span> <span class="nf">get_system_info</span><span class="p">(</span><span class="n">native</span><span class="o">=</span><span class="kc">False</span><span class="p">):</span>
+    <span class="n">res</span> <span class="o">=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">SYSTEM_INFO</span><span class="p">()</span>
+    <span class="k">if</span> <span class="n">native</span><span class="p">:</span>
+        <span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">GetNativeSystemInfo</span><span class="p">(</span><span class="n">res</span><span class="p">)</span>
+    <span class="k">else</span><span class="p">:</span>
+        <span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">GetSystemInfo</span><span class="p">(</span><span class="n">res</span><span class="p">)</span>
+    <span class="k">return</span> <span class="n">res</span>
+
 <span class="k">def</span> <span class="nf">decompress_buffer</span><span class="p">(</span><span class="n">buffer</span><span class="p">,</span> <span class="n">comptype</span><span class="o">=</span><span class="n">gdef</span><span class="o">.</span><span class="n">COMPRESSION_FORMAT_LZNT1</span><span class="p">,</span> <span class="n">uncompress_size</span><span class="o">=</span><span class="kc">None</span><span class="p">):</span>
     <span class="k">if</span> <span class="n">uncompress_size</span> <span class="ow">is</span> <span class="kc">None</span><span class="p">:</span>
         <span class="n">uncompress_size</span> <span class="o">=</span> <span class="nb">len</span><span class="p">(</span><span class="n">buffer</span><span class="p">)</span> <span class="o">*</span> <span class="mi">10</span>
@@ -700,7 +728,7 @@
 <div class="viewcode-block" id="DisableWow64FsRedirection">
 <a class="viewcode-back" href="../../../utils.html#windows.utils.DisableWow64FsRedirection">[docs]</a>
 <span class="k">class</span> <span class="nc">DisableWow64FsRedirection</span><span class="p">(</span><span class="nb">object</span><span class="p">):</span>
-<span class="w">    </span><span class="sd">&quot;&quot;&quot;</span>
+<span class="w">    </span><span class="sa">r</span><span class="sd">&quot;&quot;&quot;</span>
 <span class="sd">    A context manager that disable the SysWow64 Filesystem Redirection ::</span>
 
 <span class="sd">        if is_process_32_bits:</span>
@@ -752,7 +780,7 @@
         <li class="right" >
           <a href="../../../py-modindex.html" title="Python Module Index"
              >modules</a> |</li>
-        <li class="nav-item nav-item-0"><a href="../../../index.html">PythonForWindows 1.0.2 documentation</a> &#187;</li>
+        <li class="nav-item nav-item-0"><a href="../../../index.html">PythonForWindows 1.0.3 documentation</a> &#187;</li>
           <li class="nav-item nav-item-1"><a href="../../index.html" >Module code</a> &#187;</li>
         <li class="nav-item nav-item-this"><a href="">windows.utils.winutils</a></li> 
       </ul>

docs/build/html/_modules/windows/winobject/event_log.html

@@ -4,12 +4,12 @@
   <head>
     <meta charset="utf-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-    <title>windows.winobject.event_log &#8212; PythonForWindows 1.0.2 documentation</title>
+    <title>windows.winobject.event_log &#8212; PythonForWindows 1.0.3 documentation</title>
     <link rel="stylesheet" type="text/css" href="../../../_static/pygments.css?v=fa44fd50" />
     <link rel="stylesheet" type="text/css" href="../../../_static/classic.css?v=def86cc0" />
     <link rel="stylesheet" type="text/css" href="../../../_static/css/mbasic.css?v=957880af" />
     
-    <script src="../../../_static/documentation_options.js?v=1ed6394b"></script>
+    <script src="../../../_static/documentation_options.js?v=baaebd52"></script>
     <script src="../../../_static/doctools.js?v=9a2dae69"></script>
     <script src="../../../_static/sphinx_highlight.js?v=dc90522c"></script>
     
@@ -25,7 +25,7 @@
         <li class="right" >
           <a href="../../../py-modindex.html" title="Python Module Index"
              >modules</a> |</li>
-        <li class="nav-item nav-item-0"><a href="../../../index.html">PythonForWindows 1.0.2 documentation</a> &#187;</li>
+        <li class="nav-item nav-item-0"><a href="../../../index.html">PythonForWindows 1.0.3 documentation</a> &#187;</li>
           <li class="nav-item nav-item-1"><a href="../../index.html" accesskey="U">Module code</a> &#187;</li>
         <li class="nav-item nav-item-this"><a href="">windows.winobject.event_log</a></li> 
       </ul>
@@ -1279,7 +1279,7 @@
         <li class="right" >
           <a href="../../../py-modindex.html" title="Python Module Index"
              >modules</a> |</li>
-        <li class="nav-item nav-item-0"><a href="../../../index.html">PythonForWindows 1.0.2 documentation</a> &#187;</li>
+        <li class="nav-item nav-item-0"><a href="../../../index.html">PythonForWindows 1.0.3 documentation</a> &#187;</li>
           <li class="nav-item nav-item-1"><a href="../../index.html" >Module code</a> &#187;</li>
         <li class="nav-item nav-item-this"><a href="">windows.winobject.event_log</a></li> 
       </ul>

docs/build/html/_modules/windows/winobject/handle.html

@@ -4,12 +4,12 @@
   <head>
     <meta charset="utf-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-    <title>windows.winobject.handle &#8212; PythonForWindows 1.0.2 documentation</title>
+    <title>windows.winobject.handle &#8212; PythonForWindows 1.0.3 documentation</title>
     <link rel="stylesheet" type="text/css" href="../../../_static/pygments.css?v=fa44fd50" />
     <link rel="stylesheet" type="text/css" href="../../../_static/classic.css?v=def86cc0" />
     <link rel="stylesheet" type="text/css" href="../../../_static/css/mbasic.css?v=957880af" />
     
-    <script src="../../../_static/documentation_options.js?v=1ed6394b"></script>
+    <script src="../../../_static/documentation_options.js?v=baaebd52"></script>
     <script src="../../../_static/doctools.js?v=9a2dae69"></script>
     <script src="../../../_static/sphinx_highlight.js?v=dc90522c"></script>
     
@@ -25,7 +25,7 @@
         <li class="right" >
           <a href="../../../py-modindex.html" title="Python Module Index"
              >modules</a> |</li>
-        <li class="nav-item nav-item-0"><a href="../../../index.html">PythonForWindows 1.0.2 documentation</a> &#187;</li>
+        <li class="nav-item nav-item-0"><a href="../../../index.html">PythonForWindows 1.0.3 documentation</a> &#187;</li>
           <li class="nav-item nav-item-1"><a href="../../index.html" accesskey="U">Module code</a> &#187;</li>
         <li class="nav-item nav-item-this"><a href="">windows.winobject.handle</a></li> 
       </ul>
@@ -186,6 +186,8 @@
 
 
 <span class="k">def</span> <span class="nf">enumerate_handles_syswow64</span><span class="p">():</span>
+    <span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">_is_x86_on_arm64</span><span class="p">:</span>
+        <span class="k">raise</span> <span class="ne">NotImplementedError</span><span class="p">(</span><span class="s2">&quot;Crossing heaven gate x86 -&gt; arm64 not implemented&quot;</span><span class="p">)</span>
     <span class="n">size_needed</span> <span class="o">=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">ULONG</span><span class="p">()</span>
     <span class="c1"># Should at least be sizeof(gdef.SYSTEM_HANDLE_INFORMATION)</span>
     <span class="n">tmp_buffer</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">utils</span><span class="o">.</span><span class="n">BUFFER</span><span class="p">(</span><span class="n">gdef</span><span class="o">.</span><span class="n">SYSTEM_HANDLE_INFORMATION64</span><span class="p">)()</span>
@@ -267,7 +269,7 @@
         <li class="right" >
           <a href="../../../py-modindex.html" title="Python Module Index"
              >modules</a> |</li>
-        <li class="nav-item nav-item-0"><a href="../../../index.html">PythonForWindows 1.0.2 documentation</a> &#187;</li>
+        <li class="nav-item nav-item-0"><a href="../../../index.html">PythonForWindows 1.0.3 documentation</a> &#187;</li>
           <li class="nav-item nav-item-1"><a href="../../index.html" >Module code</a> &#187;</li>
         <li class="nav-item nav-item-this"><a href="">windows.winobject.handle</a></li> 
       </ul>

docs/build/html/_modules/windows/winobject/object_manager.html

@@ -4,12 +4,12 @@
   <head>
     <meta charset="utf-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-    <title>windows.winobject.object_manager &#8212; PythonForWindows 1.0.2 documentation</title>
+    <title>windows.winobject.object_manager &#8212; PythonForWindows 1.0.3 documentation</title>
     <link rel="stylesheet" type="text/css" href="../../../_static/pygments.css?v=fa44fd50" />
     <link rel="stylesheet" type="text/css" href="../../../_static/classic.css?v=def86cc0" />
     <link rel="stylesheet" type="text/css" href="../../../_static/css/mbasic.css?v=957880af" />
     
-    <script src="../../../_static/documentation_options.js?v=1ed6394b"></script>
+    <script src="../../../_static/documentation_options.js?v=baaebd52"></script>
     <script src="../../../_static/doctools.js?v=9a2dae69"></script>
     <script src="../../../_static/sphinx_highlight.js?v=dc90522c"></script>
     
@@ -25,7 +25,7 @@
         <li class="right" >
           <a href="../../../py-modindex.html" title="Python Module Index"
              >modules</a> |</li>
-        <li class="nav-item nav-item-0"><a href="../../../index.html">PythonForWindows 1.0.2 documentation</a> &#187;</li>
+        <li class="nav-item nav-item-0"><a href="../../../index.html">PythonForWindows 1.0.3 documentation</a> &#187;</li>
           <li class="nav-item nav-item-1"><a href="../../index.html" accesskey="U">Module code</a> &#187;</li>
         <li class="nav-item nav-item-this"><a href="">windows.winobject.object_manager</a></li> 
       </ul>
@@ -224,13 +224,13 @@
 <div class="viewcode-block" id="KernelObject.__getitem__">
 <a class="viewcode-back" href="../../../object_manager.html#windows.winobject.object_manager.KernelObject.__getitem__">[docs]</a>
     <span class="k">def</span> <span class="fm">__getitem__</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">name</span><span class="p">):</span>
-<span class="w">        </span><span class="sd">&quot;&quot;&quot;Query object ``name`` from the directory, split and subquery on ``\\``::</span>
+<span class="w">        </span><span class="sa">r</span><span class="sd">&quot;&quot;&quot;Query object ``name`` from the directory, split and subquery on ``\``::</span>
 
 <span class="sd">            &gt;&gt;&gt; obj</span>
 <span class="sd">            &lt;KernelObject &quot;\Windows&quot; (type=&quot;Directory&quot;)&gt;</span>
 <span class="sd">            &gt;&gt;&gt; obj[&quot;WindowStations&quot;][&quot;WinSta0&quot;]</span>
 <span class="sd">            &lt;KernelObject &quot;\Windows\WindowStations&quot; (type=&quot;Directory&quot;)&gt;</span>
-<span class="sd">            &gt;&gt;&gt; obj[&quot;WindowStations\\WinSta0&quot;]</span>
+<span class="sd">            &gt;&gt;&gt; obj[r&quot;WindowStations\\WinSta0&quot;]</span>
 <span class="sd">            &lt;KernelObject &quot;\Windows\WindowStations&quot; (type=&quot;Directory&quot;)&gt;</span>
 
 <span class="sd">        :rtype: :class:`KernelObject`</span>
@@ -317,7 +317,7 @@
         <li class="right" >
           <a href="../../../py-modindex.html" title="Python Module Index"
              >modules</a> |</li>
-        <li class="nav-item nav-item-0"><a href="../../../index.html">PythonForWindows 1.0.2 documentation</a> &#187;</li>
+        <li class="nav-item nav-item-0"><a href="../../../index.html">PythonForWindows 1.0.3 documentation</a> &#187;</li>
           <li class="nav-item nav-item-1"><a href="../../index.html" >Module code</a> &#187;</li>
         <li class="nav-item nav-item-this"><a href="">windows.winobject.object_manager</a></li> 
       </ul>

docs/build/html/_modules/windows/winobject/process.html

@@ -4,12 +4,12 @@
   <head>
     <meta charset="utf-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-    <title>windows.winobject.process &#8212; PythonForWindows 1.0.2 documentation</title>
+    <title>windows.winobject.process &#8212; PythonForWindows 1.0.3 documentation</title>
     <link rel="stylesheet" type="text/css" href="../../../_static/pygments.css?v=fa44fd50" />
     <link rel="stylesheet" type="text/css" href="../../../_static/classic.css?v=def86cc0" />
     <link rel="stylesheet" type="text/css" href="../../../_static/css/mbasic.css?v=957880af" />
     
-    <script src="../../../_static/documentation_options.js?v=1ed6394b"></script>
+    <script src="../../../_static/documentation_options.js?v=baaebd52"></script>
     <script src="../../../_static/doctools.js?v=9a2dae69"></script>
     <script src="../../../_static/sphinx_highlight.js?v=dc90522c"></script>
     
@@ -25,7 +25,7 @@
         <li class="right" >
           <a href="../../../py-modindex.html" title="Python Module Index"
              >modules</a> |</li>
-        <li class="nav-item nav-item-0"><a href="../../../index.html">PythonForWindows 1.0.2 documentation</a> &#187;</li>
+        <li class="nav-item nav-item-0"><a href="../../../index.html">PythonForWindows 1.0.3 documentation</a> &#187;</li>
           <li class="nav-item nav-item-1"><a href="../../index.html" accesskey="U">Module code</a> &#187;</li>
         <li class="nav-item nav-item-this"><a href="">windows.winobject.process</a></li> 
       </ul>
@@ -51,6 +51,7 @@
 <span class="kn">import</span> <span class="nn">windows</span>
 <span class="kn">import</span> <span class="nn">windows.native_exec.simple_x86</span> <span class="k">as</span> <span class="nn">x86</span>
 <span class="kn">import</span> <span class="nn">windows.native_exec.simple_x64</span> <span class="k">as</span> <span class="nn">x64</span>
+<span class="kn">import</span> <span class="nn">windows.native_exec.simple_arm64</span> <span class="k">as</span> <span class="nn">arm64</span>
 <span class="kn">import</span> <span class="nn">windows.remotectypes</span> <span class="k">as</span> <span class="nn">rctypes</span>
 <span class="kn">import</span> <span class="nn">windows.generated_def</span> <span class="k">as</span> <span class="nn">gdef</span>
 
@@ -106,27 +107,82 @@
 
 
 <span class="k">class</span> <span class="nc">Process</span><span class="p">(</span><span class="n">utils</span><span class="o">.</span><span class="n">AutoHandle</span><span class="p">):</span>
-    <span class="nd">@utils</span><span class="o">.</span><span class="n">fixedpropety</span>
+    <span class="nd">@utils</span><span class="o">.</span><span class="n">fixedproperty</span>
     <span class="k">def</span> <span class="nf">is_wow_64</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
 <span class="w">        </span><span class="sd">&quot;&quot;&quot;``True`` if the process is a SysWow64 process (32bit process on 64bits system).</span>
 
 <span class="sd">        :type: :class:`bool`</span>
 <span class="sd">		&quot;&quot;&quot;</span>
-        <span class="c1"># return utils.is_wow_64(self.handle)</span>
-        <span class="k">return</span> <span class="n">utils</span><span class="o">.</span><span class="n">is_wow_64</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">limited_handle</span><span class="p">)</span>
+        <span class="k">if</span> <span class="ow">not</span> <span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">is_implemented</span><span class="p">(</span><span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">IsWow64Process</span><span class="p">):</span>
+            <span class="k">return</span> <span class="kc">False</span>
+        <span class="n">Wow64Process</span> <span class="o">=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">BOOL</span><span class="p">()</span>
+        <span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">IsWow64Process</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">Wow64Process</span><span class="p">)</span>
+        <span class="k">return</span> <span class="nb">bool</span><span class="p">(</span><span class="n">Wow64Process</span><span class="p">)</span>
 
-    <span class="nd">@utils</span><span class="o">.</span><span class="n">fixedpropety</span>
+
+
+    <span class="nd">@utils</span><span class="o">.</span><span class="n">fixedproperty</span>
+    <span class="k">def</span> <span class="nf">is_wow_64_2</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
+        <span class="k">if</span> <span class="ow">not</span> <span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">is_implemented</span><span class="p">(</span><span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">IsWow64Process2</span><span class="p">):</span>
+            <span class="k">return</span> <span class="kc">None</span><span class="p">,</span> <span class="kc">None</span>
+        <span class="n">processMachine</span> <span class="o">=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">USHORT</span><span class="p">()</span>
+        <span class="n">nativeMachine</span> <span class="o">=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">USHORT</span><span class="p">()</span>
+        <span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">IsWow64Process2</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">processMachine</span><span class="p">,</span> <span class="n">nativeMachine</span><span class="p">)</span>
+        <span class="k">return</span> <span class="p">(</span><span class="n">gdef</span><span class="o">.</span><span class="n">IMAGE_FILE_MACHINE_MAPPER</span><span class="p">[</span><span class="n">processMachine</span><span class="o">.</span><span class="n">value</span><span class="p">],</span>
+                <span class="n">gdef</span><span class="o">.</span><span class="n">IMAGE_FILE_MACHINE_MAPPER</span><span class="p">[</span><span class="n">nativeMachine</span><span class="o">.</span><span class="n">value</span><span class="p">])</span>
+
+
+    <span class="nd">@utils</span><span class="o">.</span><span class="n">fixedproperty</span>
     <span class="k">def</span> <span class="nf">bitness</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
 <span class="w">        </span><span class="sd">&quot;&quot;&quot;The bitness of the process</span>
 
 <span class="sd">        :returns: :class:`int` -- 32 or 64</span>
 <span class="sd">		&quot;&quot;&quot;</span>
-        <span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">system</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">32</span><span class="p">:</span>
-            <span class="k">return</span> <span class="mi">32</span>
-        <span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">is_wow_64</span><span class="p">:</span>
+        <span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">system</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">32</span> <span class="ow">or</span> <span class="bp">self</span><span class="o">.</span><span class="n">is_wow_64</span><span class="p">:</span>
             <span class="k">return</span> <span class="mi">32</span>
         <span class="k">return</span> <span class="mi">64</span>
 
+    <span class="nd">@utils</span><span class="o">.</span><span class="n">fixedproperty</span>
+    <span class="k">def</span> <span class="nf">architecture</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
+        <span class="c1"># Syswow2 will exactly tell us the architecture</span>
+        <span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">is_implemented</span><span class="p">(</span><span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">IsWow64Process2</span><span class="p">):</span>
+            <span class="n">process_machine</span><span class="p">,</span> <span class="n">native_machine</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">is_wow_64_2</span>
+            <span class="k">if</span> <span class="n">process_machine</span> <span class="o">!=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">IMAGE_FILE_MACHINE_UNKNOWN</span><span class="p">:</span>
+                <span class="k">return</span> <span class="n">process_machine</span>
+
+            <span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">system</span><span class="o">.</span><span class="n">architecture</span> <span class="o">==</span> <span class="n">gdef</span><span class="o">.</span><span class="n">PROCESSOR_ARCHITECTURE_ARM64</span><span class="p">:</span>
+                <span class="c1"># May be ARM64 or AMD64 as X64TA64 is not considered WOW64</span>
+                <span class="c1"># ProcessMachineTypeInfo is from build 22000</span>
+                <span class="c1"># What if not implemented ? parse target main binary PE ?</span>
+                <span class="n">machine_archi</span> <span class="o">=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">PROCESS_MACHINE_INFORMATION</span><span class="p">()</span>
+                <span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">GetProcessInformation</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">gdef</span><span class="o">.</span><span class="n">ProcessMachineTypeInfo</span><span class="p">,</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">byref</span><span class="p">(</span><span class="n">machine_archi</span><span class="p">),</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">machine_archi</span><span class="p">))</span>
+                <span class="k">return</span> <span class="n">gdef</span><span class="o">.</span><span class="n">IMAGE_FILE_MACHINE_MAPPER</span><span class="p">[</span><span class="n">machine_archi</span><span class="o">.</span><span class="n">ProcessMachine</span><span class="p">]</span>
+
+        <span class="c1"># No IsWow64Process2 -&gt; No ARM</span>
+        <span class="c1"># So its up on x86 -&gt; x64 based on process bitness</span>
+        <span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">32</span><span class="p">:</span>
+            <span class="k">return</span> <span class="n">gdef</span><span class="o">.</span><span class="n">IMAGE_FILE_MACHINE_I386</span>
+        <span class="k">return</span> <span class="n">gdef</span><span class="o">.</span><span class="n">IMAGE_FILE_MACHINE_AMD64</span>
+
+    <span class="nd">@utils</span><span class="o">.</span><span class="n">fixedproperty</span>
+    <span class="k">def</span> <span class="nf">_is_x86_on_arm64</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
+        <span class="k">return</span> <span class="p">(</span><span class="n">windows</span><span class="o">.</span><span class="n">system</span><span class="o">.</span><span class="n">architecture</span> <span class="o">==</span> <span class="n">gdef</span><span class="o">.</span><span class="n">PROCESSOR_ARCHITECTURE_ARM64</span> <span class="ow">and</span>
+                    <span class="bp">self</span><span class="o">.</span><span class="n">architecture</span> <span class="o">==</span> <span class="n">gdef</span><span class="o">.</span><span class="n">IMAGE_FILE_MACHINE_I386</span><span class="p">)</span>
+
+    <span class="nd">@utils</span><span class="o">.</span><span class="n">fixedproperty</span>
+    <span class="k">def</span> <span class="nf">_is_x86_on_x64</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
+        <span class="k">return</span> <span class="p">(</span><span class="n">windows</span><span class="o">.</span><span class="n">system</span><span class="o">.</span><span class="n">architecture</span> <span class="o">==</span> <span class="n">gdef</span><span class="o">.</span><span class="n">PROCESSOR_ARCHITECTURE_AMD64</span> <span class="ow">and</span>
+                    <span class="bp">self</span><span class="o">.</span><span class="n">architecture</span> <span class="o">==</span> <span class="n">gdef</span><span class="o">.</span><span class="n">IMAGE_FILE_MACHINE_I386</span><span class="p">)</span>
+
+    <span class="nd">@utils</span><span class="o">.</span><span class="n">fixedproperty</span>
+    <span class="k">def</span> <span class="nf">_is_native_architecture</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
+        <span class="k">return</span> <span class="p">((</span><span class="n">windows</span><span class="o">.</span><span class="n">system</span><span class="o">.</span><span class="n">architecture</span> <span class="o">==</span> <span class="n">gdef</span><span class="o">.</span><span class="n">PROCESSOR_ARCHITECTURE_INTEL</span> <span class="ow">and</span>
+                    <span class="bp">self</span><span class="o">.</span><span class="n">architecture</span> <span class="o">==</span> <span class="n">gdef</span><span class="o">.</span><span class="n">IMAGE_FILE_MACHINE_I386</span><span class="p">)</span> <span class="ow">or</span>
+                <span class="p">(</span><span class="n">windows</span><span class="o">.</span><span class="n">system</span><span class="o">.</span><span class="n">architecture</span> <span class="o">==</span> <span class="n">gdef</span><span class="o">.</span><span class="n">PROCESSOR_ARCHITECTURE_AMD64</span> <span class="ow">and</span>
+                    <span class="bp">self</span><span class="o">.</span><span class="n">architecture</span> <span class="o">==</span> <span class="n">gdef</span><span class="o">.</span><span class="n">IMAGE_FILE_MACHINE_AMD64</span><span class="p">)</span> <span class="ow">or</span>
+                <span class="p">(</span><span class="n">windows</span><span class="o">.</span><span class="n">system</span><span class="o">.</span><span class="n">architecture</span> <span class="o">==</span> <span class="n">gdef</span><span class="o">.</span><span class="n">PROCESSOR_ARCHITECTURE_ARM64</span> <span class="ow">and</span>
+                    <span class="bp">self</span><span class="o">.</span><span class="n">architecture</span> <span class="o">==</span> <span class="n">gdef</span><span class="o">.</span><span class="n">IMAGE_FILE_MACHINE_ARM64</span><span class="p">))</span>
+
     <span class="nd">@utils</span><span class="o">.</span><span class="n">fixedpropety</span>
     <span class="k">def</span> <span class="nf">limited_handle</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
         <span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">system</span><span class="o">.</span><span class="n">version</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span> <span class="o">&lt;=</span> <span class="mi">5</span><span class="p">:</span>
@@ -134,14 +190,26 @@
             <span class="k">return</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">OpenProcess</span><span class="p">(</span><span class="n">PROCESS_QUERY_INFORMATION</span><span class="p">,</span> <span class="n">dwProcessId</span><span class="o">=</span><span class="bp">self</span><span class="o">.</span><span class="n">pid</span><span class="p">)</span>
         <span class="k">return</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">OpenProcess</span><span class="p">(</span><span class="n">PROCESS_QUERY_LIMITED_INFORMATION</span><span class="p">,</span> <span class="n">dwProcessId</span><span class="o">=</span><span class="bp">self</span><span class="o">.</span><span class="n">pid</span><span class="p">)</span>
 
+    <span class="nd">@utils</span><span class="o">.</span><span class="n">fixedproperty</span>
+    <span class="k">def</span> <span class="nf">name</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
+<span class="w">        </span><span class="sd">&quot;&quot;&quot;Name of the process</span>
 
-    <span class="nd">@utils</span><span class="o">.</span><span class="n">fixedpropety</span>
+<span class="sd">        :type: :class:`str`</span>
+<span class="sd">		&quot;&quot;&quot;</span>
+        <span class="n">buffer</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">create_unicode_buffer</span><span class="p">(</span><span class="mh">0x1024</span><span class="p">)</span>
+        <span class="n">rsize</span> <span class="o">=</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">GetProcessImageFileNameW</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">limited_handle</span><span class="p">,</span> <span class="n">buffer</span><span class="p">)</span>
+        <span class="c1"># GetProcessImageFileNameW returns the fullpath</span>
+        <span class="k">return</span> <span class="n">buffer</span><span class="p">[:</span><span class="n">rsize</span><span class="p">]</span><span class="o">.</span><span class="n">split</span><span class="p">(</span><span class="s2">&quot;</span><span class="se">\\</span><span class="s2">&quot;</span><span class="p">)[</span><span class="o">-</span><span class="mi">1</span><span class="p">]</span>
+
+    <span class="nd">@utils</span><span class="o">.</span><span class="n">fixedproperty</span>
     <span class="k">def</span> <span class="nf">ppid</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
 <span class="w">        </span><span class="sd">&quot;&quot;&quot;Parent Process ID</span>
 
 <span class="sd">        :type: :class:`int`</span>
 <span class="sd">		&quot;&quot;&quot;</span>
         <span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">32</span> <span class="ow">and</span> <span class="bp">self</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">64</span><span class="p">:</span>
+            <span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">_is_x86_on_arm64</span><span class="p">:</span>
+                <span class="k">raise</span> <span class="ne">NotImplementedError</span><span class="p">(</span><span class="s2">&quot;Crossing heaven gate x86 -&gt; arm64 not implemented&quot;</span><span class="p">)</span>
             <span class="n">xtype</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">remotectypes</span><span class="o">.</span><span class="n">transform_type_to_remote64bits</span><span class="p">(</span><span class="n">PROCESS_BASIC_INFORMATION</span><span class="p">)</span>
             <span class="c1"># Fuck-it &lt;3</span>
             <span class="n">data</span> <span class="o">=</span> <span class="p">(</span><span class="n">ctypes</span><span class="o">.</span><span class="n">c_char</span> <span class="o">*</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">xtype</span><span class="p">))()</span>
@@ -212,6 +280,8 @@
     <span class="k">def</span> <span class="nf">virtual_protect</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">addr</span><span class="p">,</span> <span class="n">size</span><span class="p">,</span> <span class="n">protect</span><span class="p">,</span> <span class="n">old_protect</span><span class="o">=</span><span class="kc">None</span><span class="p">):</span>
 <span class="w">        </span><span class="sd">&quot;&quot;&quot;Change the access right of one or more page of the process&quot;&quot;&quot;</span>
         <span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">32</span> <span class="ow">and</span> <span class="bp">self</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">64</span><span class="p">:</span>
+            <span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">_is_x86_on_arm64</span><span class="p">:</span>
+                <span class="k">raise</span> <span class="ne">NotImplementedError</span><span class="p">(</span><span class="s2">&quot;Crossing heaven gate x86 -&gt; arm64 not implemented&quot;</span><span class="p">)</span>
             <span class="k">if</span> <span class="n">size</span> <span class="o">&amp;</span> <span class="mh">0x0fff</span><span class="p">:</span>
                 <span class="n">size</span> <span class="o">=</span> <span class="p">((</span><span class="n">size</span> <span class="o">&gt;&gt;</span> <span class="mi">12</span><span class="p">)</span> <span class="o">+</span> <span class="mi">1</span><span class="p">)</span> <span class="o">&lt;&lt;</span> <span class="mi">12</span>
             <span class="k">if</span> <span class="n">old_protect</span> <span class="ow">is</span> <span class="kc">None</span><span class="p">:</span>
@@ -242,6 +312,8 @@
 <span class="sd">        :rtype: :class:`~windows.generated_def.winstructs.MEMORY_BASIC_INFORMATION`</span>
 <span class="sd">		&quot;&quot;&quot;</span>
         <span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">32</span> <span class="ow">and</span> <span class="bp">self</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">64</span><span class="p">:</span>
+            <span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">_is_x86_on_arm64</span><span class="p">:</span>
+                <span class="k">raise</span> <span class="ne">NotImplementedError</span><span class="p">(</span><span class="s2">&quot;Crossing heaven gate x86 -&gt; arm64 not implemented&quot;</span><span class="p">)</span>
             <span class="n">res</span> <span class="o">=</span> <span class="n">MEMORY_BASIC_INFORMATION64</span><span class="p">()</span>
             <span class="k">try</span><span class="p">:</span>
                 <span class="n">v</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">syswow64</span><span class="o">.</span><span class="n">NtQueryVirtualMemory_32_to_64</span><span class="p">(</span><span class="n">ProcessHandle</span><span class="o">=</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">BaseAddress</span><span class="o">=</span><span class="n">addr</span><span class="p">,</span> <span class="n">MemoryInformationClass</span><span class="o">=</span><span class="n">MemoryBasicInformation</span><span class="p">,</span> <span class="n">MemoryInformation</span><span class="o">=</span><span class="n">res</span><span class="p">)</span>
@@ -322,6 +394,8 @@
         <span class="k">for</span> <span class="n">i</span><span class="p">,</span> <span class="n">data</span> <span class="ow">in</span> <span class="nb">enumerate</span><span class="p">(</span><span class="n">info_array</span><span class="p">):</span>
             <span class="n">info_array</span><span class="p">[</span><span class="n">i</span><span class="p">]</span><span class="o">.</span><span class="n">VirtualAddress</span> <span class="o">=</span> <span class="n">addresses</span><span class="p">[</span><span class="n">i</span><span class="p">]</span>
         <span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">32</span> <span class="ow">and</span> <span class="bp">self</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">64</span><span class="p">:</span>
+            <span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">_is_x86_on_arm64</span><span class="p">:</span>
+                <span class="k">raise</span> <span class="ne">NotImplementedError</span><span class="p">(</span><span class="s2">&quot;Crossing heaven gate x86 -&gt; arm64 not implemented&quot;</span><span class="p">)</span>
             <span class="n">windows</span><span class="o">.</span><span class="n">syswow64</span><span class="o">.</span><span class="n">NtQueryVirtualMemory_32_to_64</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="mi">0</span><span class="p">,</span> <span class="n">MemoryWorkingSetListEx</span><span class="p">,</span> <span class="n">info_array</span><span class="p">)</span>
         <span class="k">else</span><span class="p">:</span>
             <span class="n">winproxy</span><span class="o">.</span><span class="n">QueryWorkingSetEx</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">byref</span><span class="p">(</span><span class="n">info_array</span><span class="p">),</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">info_array</span><span class="p">))</span>
@@ -552,11 +626,12 @@
         <span class="k">return</span> <span class="p">[</span><span class="n">h</span> <span class="k">for</span> <span class="n">h</span> <span class="ow">in</span> <span class="n">windows</span><span class="o">.</span><span class="n">system</span><span class="o">.</span><span class="n">handles</span> <span class="k">if</span> <span class="n">h</span><span class="o">.</span><span class="n">dwProcessId</span> <span class="o">==</span> <span class="n">pid</span><span class="p">]</span>
 
     <span class="k">def</span> <span class="fm">__del__</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
-        <span class="nb">super</span><span class="p">(</span><span class="n">Process</span><span class="p">,</span> <span class="bp">self</span><span class="p">)</span><span class="o">.</span><span class="fm">__del__</span><span class="p">()</span>
-        <span class="c1"># Same logic that AutoHandle.__del__ for Process.limited_handle</span>
-        <span class="c1"># Assert that Process inherit AutoHandle</span>
         <span class="c1"># sys.path is not None -&gt; check if python shutdown</span>
         <span class="k">if</span> <span class="n">sys</span><span class="o">.</span><span class="n">path</span> <span class="ow">is</span> <span class="ow">not</span> <span class="kc">None</span> <span class="ow">and</span> <span class="nb">hasattr</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="s2">&quot;_limited_handle&quot;</span><span class="p">)</span> <span class="ow">and</span> <span class="bp">self</span><span class="o">.</span><span class="n">_limited_handle</span><span class="p">:</span>
+            <span class="c1"># Same logic that AutoHandle.__del__ for Process.limited_handle</span>
+            <span class="c1"># Assert that Process inherit AutoHandle</span>
+            <span class="c1"># Call super after check as Process could be None during destruction</span>
+            <span class="nb">super</span><span class="p">(</span><span class="n">Process</span><span class="p">,</span> <span class="bp">self</span><span class="p">)</span><span class="o">.</span><span class="fm">__del__</span><span class="p">()</span>
             <span class="c1"># Prevent some bug where dbgprint might be None when __del__ is called in a closing process</span>
             <span class="c1"># This line is bad -&gt; it reopens a handle closed by &#39;super(Process, self).__del__()&#39; ._.</span>
             <span class="n">dbgprint</span><span class="p">(</span><span class="s2">&quot;Closing limited handle </span><span class="si">{0}</span><span class="s2"> for </span><span class="si">{1}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="nb">hex</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">_limited_handle</span><span class="p">),</span> <span class="bp">self</span><span class="p">),</span> <span class="s2">&quot;HANDLE&quot;</span><span class="p">)</span> <span class="k">if</span> <span class="n">dbgprint</span> <span class="ow">is</span> <span class="ow">not</span> <span class="kc">None</span> <span class="k">else</span> <span class="kc">None</span>
@@ -603,7 +678,14 @@
 <a class="viewcode-back" href="../../../process.html#windows.winobject.process.CurrentThread">[docs]</a>
 <span class="k">class</span> <span class="nc">CurrentThread</span><span class="p">(</span><span class="n">Thread</span><span class="p">):</span>
 <span class="w">    </span><span class="sd">&quot;&quot;&quot;The current thread&quot;&quot;&quot;</span>
-    <span class="nd">@property</span> <span class="c1">#It&#39;s not a fixedpropety because executing thread might change</span>
+
+    <span class="n">get_teb_code_by_architecture</span> <span class="o">=</span> <span class="p">{</span>
+        <span class="n">gdef</span><span class="o">.</span><span class="n">IMAGE_FILE_MACHINE_I386</span><span class="p">:</span> <span class="n">x86</span><span class="o">.</span><span class="n">assemble</span><span class="p">(</span><span class="s2">&quot;mov eax, fs:[0x18]; ret&quot;</span><span class="p">),</span>
+        <span class="n">gdef</span><span class="o">.</span><span class="n">IMAGE_FILE_MACHINE_AMD64</span><span class="p">:</span> <span class="n">x64</span><span class="o">.</span><span class="n">assemble</span><span class="p">(</span><span class="s2">&quot;mov rax, gs:[0x30]; ret&quot;</span><span class="p">),</span>
+        <span class="n">gdef</span><span class="o">.</span><span class="n">IMAGE_FILE_MACHINE_ARM64</span><span class="p">:</span> <span class="n">arm64</span><span class="o">.</span><span class="n">assemble</span><span class="p">(</span><span class="s2">&quot;mov x0, x18; ret&quot;</span><span class="p">)</span>
+    <span class="p">}</span>
+
+    <span class="nd">@property</span> <span class="c1">#It&#39;s not a fixedproperty because executing thread might change</span>
     <span class="k">def</span> <span class="nf">tid</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
 <span class="w">        </span><span class="sd">&quot;&quot;&quot;Thread ID</span>
 
@@ -611,6 +693,15 @@
 <span class="sd">		&quot;&quot;&quot;</span>
         <span class="k">return</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">GetCurrentThreadId</span><span class="p">()</span>
 
+    <span class="nd">@property</span> <span class="c1">#It&#39;s not a fixedproperty because executing thread might change</span>
+    <span class="k">def</span> <span class="nf">teb_base</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
+        <span class="n">get_teb_base_code</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">get_teb_code_by_architecture</span><span class="p">[</span><span class="bp">self</span><span class="o">.</span><span class="n">owner</span><span class="o">.</span><span class="n">architecture</span><span class="p">]</span>
+        <span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">owner</span><span class="o">.</span><span class="n">execute</span><span class="p">(</span><span class="n">get_teb_base_code</span><span class="p">)</span>
+
+    <span class="nd">@property</span>
+    <span class="k">def</span> <span class="nf">teb</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
+        <span class="k">return</span> <span class="n">TEB</span><span class="o">.</span><span class="n">from_address</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">teb_base</span><span class="p">)</span>
+
     <span class="nd">@property</span>
     <span class="k">def</span> <span class="nf">owner</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
 <span class="w">        </span><span class="sd">&quot;&quot;&quot;The current process</span>
@@ -632,8 +723,6 @@
         <span class="k">return</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">ExitThread</span><span class="p">(</span><span class="n">code</span><span class="p">)</span></div>
 
 
-
-
 <div class="viewcode-block" id="CurrentThread.wait">
 <a class="viewcode-back" href="../../../process.html#windows.winobject.process.CurrentThread.wait">[docs]</a>
     <span class="k">def</span> <span class="nf">wait</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">timeout</span><span class="o">=</span><span class="n">INFINITE</span><span class="p">):</span>
@@ -647,37 +736,12 @@
 <a class="viewcode-back" href="../../../process.html#windows.winobject.process.CurrentProcess">[docs]</a>
 <span class="k">class</span> <span class="nc">CurrentProcess</span><span class="p">(</span><span class="n">Process</span><span class="p">):</span>
 <span class="w">    </span><span class="sd">&quot;&quot;&quot;The current process&quot;&quot;&quot;</span>
-    <span class="n">get_peb</span> <span class="o">=</span> <span class="kc">None</span>
-
-    <span class="n">get_peb_32_code</span> <span class="o">=</span> <span class="n">x86</span><span class="o">.</span><span class="n">MultipleInstr</span><span class="p">()</span>
-    <span class="n">get_peb_32_code</span> <span class="o">+=</span> <span class="n">x86</span><span class="o">.</span><span class="n">Mov</span><span class="p">(</span><span class="s1">&#39;EAX&#39;</span><span class="p">,</span> <span class="n">x86</span><span class="o">.</span><span class="n">mem</span><span class="p">(</span><span class="s1">&#39;fs:[0x30]&#39;</span><span class="p">))</span>
-    <span class="n">get_peb_32_code</span> <span class="o">+=</span> <span class="n">x86</span><span class="o">.</span><span class="n">Ret</span><span class="p">()</span>
-    <span class="n">get_peb_32_code</span> <span class="o">=</span> <span class="n">get_peb_32_code</span><span class="o">.</span><span class="n">get_code</span><span class="p">()</span>
-
-    <span class="n">get_peb_64_code</span> <span class="o">=</span> <span class="n">x64</span><span class="o">.</span><span class="n">MultipleInstr</span><span class="p">()</span>
-    <span class="n">get_peb_64_code</span> <span class="o">+=</span> <span class="n">x64</span><span class="o">.</span><span class="n">Mov</span><span class="p">(</span><span class="s1">&#39;RAX&#39;</span><span class="p">,</span> <span class="n">x64</span><span class="o">.</span><span class="n">mem</span><span class="p">(</span><span class="s1">&#39;gs:[0x60]&#39;</span><span class="p">))</span>
-    <span class="n">get_peb_64_code</span> <span class="o">+=</span> <span class="n">x64</span><span class="o">.</span><span class="n">Ret</span><span class="p">()</span>
-    <span class="n">get_peb_64_code</span> <span class="o">=</span> <span class="n">get_peb_64_code</span><span class="o">.</span><span class="n">get_code</span><span class="p">()</span>
-
     <span class="n">allocator</span> <span class="o">=</span> <span class="n">native_exec</span><span class="o">.</span><span class="n">native_function</span><span class="o">.</span><span class="n">allocator</span>
 
-    <span class="n">name</span> <span class="o">=</span> <span class="s2">&quot;CurrentProcess&quot;</span> <span class="c1"># Used by Winthread for __repr__</span>
-
-    <span class="c1"># Use RtlGetCurrentPeb ?</span>
-    <span class="k">def</span> <span class="nf">get_peb_builtin</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
-        <span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">get_peb</span> <span class="ow">is</span> <span class="ow">not</span> <span class="kc">None</span><span class="p">:</span>
-            <span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">get_peb</span>
-        <span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">32</span><span class="p">:</span>
-            <span class="n">get_peb</span> <span class="o">=</span> <span class="n">native_exec</span><span class="o">.</span><span class="n">create_function</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">get_peb_32_code</span><span class="p">,</span> <span class="p">[</span><span class="n">PVOID</span><span class="p">])</span>
-        <span class="k">else</span><span class="p">:</span>
-            <span class="n">get_peb</span> <span class="o">=</span> <span class="n">native_exec</span><span class="o">.</span><span class="n">create_function</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">get_peb_64_code</span><span class="p">,</span> <span class="p">[</span><span class="n">PVOID</span><span class="p">])</span>
-        <span class="bp">self</span><span class="o">.</span><span class="n">get_peb</span> <span class="o">=</span> <span class="n">get_peb</span>
-        <span class="k">return</span> <span class="n">get_peb</span>
-
     <span class="k">def</span> <span class="nf">_get_handle</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
         <span class="k">return</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">GetCurrentProcess</span><span class="p">()</span>
 
-    <span class="nd">@utils</span><span class="o">.</span><span class="n">fixedpropety</span>
+    <span class="nd">@utils</span><span class="o">.</span><span class="n">fixedproperty</span>
     <span class="k">def</span> <span class="nf">limited_handle</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
         <span class="k">return</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">GetCurrentProcess</span><span class="p">()</span>
 
@@ -693,33 +757,32 @@
 <span class="sd">		&quot;&quot;&quot;</span>
         <span class="k">return</span> <span class="n">os</span><span class="o">.</span><span class="n">getpid</span><span class="p">()</span>
 
-    <span class="nd">@utils</span><span class="o">.</span><span class="n">fixedpropety</span> <span class="c1"># leave it has fixed property as we don&#39;t care if CurrentProcess is never collected</span>
+    <span class="nd">@utils</span><span class="o">.</span><span class="n">fixedproperty</span> <span class="c1"># leave it has fixed property as we don&#39;t care if CurrentProcess is never collected</span>
     <span class="k">def</span> <span class="nf">peb</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
 <span class="w">        </span><span class="sd">&quot;&quot;&quot;The Process Environment Block of the current process</span>
 
 <span class="sd">        :type: :class:`PEB`</span>
 <span class="sd">		&quot;&quot;&quot;</span>
-        <span class="k">return</span> <span class="n">PEB</span><span class="o">.</span><span class="n">from_address</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">get_peb_builtin</span><span class="p">()())</span>
+        <span class="k">return</span> <span class="n">PEB</span><span class="o">.</span><span class="n">from_address</span><span class="p">(</span><span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">RtlGetCurrentPeb</span><span class="p">())</span>
 
-    <span class="nd">@utils</span><span class="o">.</span><span class="n">fixedpropety</span>
+    <span class="nd">@utils</span><span class="o">.</span><span class="n">fixedproperty</span>
     <span class="k">def</span> <span class="nf">bitness</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
 <span class="w">        </span><span class="sd">&quot;&quot;&quot;The bitness of the process</span>
 
 <span class="sd">        :type: :class:`int` -- 32 or 64</span>
 <span class="sd">		&quot;&quot;&quot;</span>
-        <span class="kn">import</span> <span class="nn">platform</span>
-        <span class="n">bits</span> <span class="o">=</span> <span class="n">platform</span><span class="o">.</span><span class="n">architecture</span><span class="p">()[</span><span class="mi">0</span><span class="p">]</span>
-        <span class="k">return</span> <span class="nb">int</span><span class="p">(</span><span class="n">bits</span><span class="p">[:</span><span class="mi">2</span><span class="p">])</span>
+        <span class="k">return</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">gdef</span><span class="o">.</span><span class="n">PVOID</span><span class="p">)</span> <span class="o">*</span> <span class="mi">8</span> <span class="c1"># byte to bits</span>
+
 
 <div class="viewcode-block" id="CurrentProcess.virtual_alloc">
 <a class="viewcode-back" href="../../../process.html#windows.winobject.process.CurrentProcess.virtual_alloc">[docs]</a>
-    <span class="k">def</span> <span class="nf">virtual_alloc</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">size</span><span class="p">,</span> <span class="n">prot</span><span class="o">=</span><span class="n">PAGE_EXECUTE_READWRITE</span><span class="p">):</span>
+    <span class="k">def</span> <span class="nf">virtual_alloc</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">size</span><span class="p">,</span> <span class="n">prot</span><span class="o">=</span><span class="n">PAGE_EXECUTE_READWRITE</span><span class="p">,</span> <span class="n">addr</span><span class="o">=</span><span class="kc">None</span><span class="p">,</span> <span class="nb">type</span><span class="o">=</span><span class="n">gdef</span><span class="o">.</span><span class="n">MEM_COMMIT</span><span class="p">):</span>
 <span class="w">        </span><span class="sd">&quot;&quot;&quot;Allocate memory in the process</span>
 
 <span class="sd">        :return: The address of the allocated memory</span>
 <span class="sd">        :rtype: :class:`int`</span>
 <span class="sd">		&quot;&quot;&quot;</span>
-        <span class="k">return</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">VirtualAlloc</span><span class="p">(</span><span class="n">dwSize</span><span class="o">=</span><span class="n">size</span><span class="p">,</span> <span class="n">flProtect</span><span class="o">=</span><span class="n">prot</span><span class="p">)</span></div>
+        <span class="k">return</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">VirtualAlloc</span><span class="p">(</span><span class="n">lpAddress</span><span class="o">=</span><span class="n">addr</span><span class="p">,</span> <span class="n">dwSize</span><span class="o">=</span><span class="n">size</span><span class="p">,</span> <span class="n">flAllocationType</span><span class="o">=</span><span class="nb">type</span><span class="p">,</span> <span class="n">flProtect</span><span class="o">=</span><span class="n">prot</span><span class="p">)</span></div>
 
 
 <div class="viewcode-block" id="CurrentProcess.virtual_free">
@@ -798,7 +861,7 @@
         <span class="k">raise</span> <span class="ne">ValueError</span><span class="p">(</span><span class="s2">&quot;wait() on current thread&quot;</span><span class="p">)</span></div>
 
 
-    <span class="nd">@utils</span><span class="o">.</span><span class="n">fixedpropety</span>
+    <span class="nd">@utils</span><span class="o">.</span><span class="n">fixedproperty</span>
     <span class="k">def</span> <span class="nf">peb_syswow</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
 <span class="w">        </span><span class="sd">&quot;&quot;&quot;The 64bits PEB of a SysWow64 process</span>
 
@@ -806,6 +869,8 @@
 <span class="sd">		&quot;&quot;&quot;</span>
         <span class="k">if</span> <span class="ow">not</span> <span class="bp">self</span><span class="o">.</span><span class="n">is_wow_64</span><span class="p">:</span>
             <span class="k">raise</span> <span class="ne">ValueError</span><span class="p">(</span><span class="s2">&quot;Not a syswow process&quot;</span><span class="p">)</span>
+        <span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">_is_x86_on_arm64</span><span class="p">:</span>
+            <span class="k">raise</span> <span class="ne">NotImplementedError</span><span class="p">(</span><span class="s2">&quot;Crossing heaven gate x86 -&gt; arm64 not implemented&quot;</span><span class="p">)</span>
         <span class="k">return</span> <span class="n">windows</span><span class="o">.</span><span class="n">syswow64</span><span class="o">.</span><span class="n">get_current_process_syswow_peb</span><span class="p">()</span>
 
     <span class="c1"># TODO: use ctypes.string_at / ctypes.wstring_at for read_string / read_wstring ?</span>
@@ -850,21 +915,21 @@
         <span class="c1"># Create a DeadThread if thread is already dead ?</span>
         <span class="k">return</span> <span class="n">WinThread</span><span class="p">(</span><span class="n">handle</span><span class="o">=</span><span class="n">handle</span><span class="p">)</span>
 
-    <span class="nd">@utils</span><span class="o">.</span><span class="n">fixedpropety</span>
+    <span class="nd">@utils</span><span class="o">.</span><span class="n">fixedproperty</span>
     <span class="k">def</span> <span class="nf">tid</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
 <span class="w">        </span><span class="sd">&quot;&quot;&quot;Thread ID</span>
 
 <span class="sd">        :type: :class:`int`&quot;&quot;&quot;</span>
         <span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">_get_thread_id</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">)</span>
 
-    <span class="nd">@utils</span><span class="o">.</span><span class="n">fixedpropety</span>
+    <span class="nd">@utils</span><span class="o">.</span><span class="n">fixedproperty</span>
     <span class="k">def</span> <span class="nf">owner_pid</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
         <span class="n">res</span> <span class="o">=</span> <span class="n">THREAD_BASIC_INFORMATION</span><span class="p">()</span>
         <span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">NtQueryInformationThread</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">ThreadBasicInformation</span><span class="p">,</span> <span class="n">byref</span><span class="p">(</span><span class="n">res</span><span class="p">),</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">res</span><span class="p">))</span>
         <span class="n">owner_id</span> <span class="o">=</span> <span class="n">res</span><span class="o">.</span><span class="n">ClientId</span><span class="o">.</span><span class="n">UniqueProcess</span>
         <span class="k">return</span> <span class="n">owner_id</span>
 
-    <span class="nd">@utils</span><span class="o">.</span><span class="n">fixedpropety</span>
+    <span class="nd">@utils</span><span class="o">.</span><span class="n">fixedproperty</span>
     <span class="k">def</span> <span class="nf">owner</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
 <span class="w">        </span><span class="sd">&quot;&quot;&quot;The Process owning the thread</span>
 
@@ -947,6 +1012,8 @@
 <span class="sd">            :type: :class:`int`</span>
 <span class="sd">		&quot;&quot;&quot;</span>
         <span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">32</span> <span class="ow">and</span> <span class="bp">self</span><span class="o">.</span><span class="n">owner</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">64</span><span class="p">:</span>
+            <span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">_is_x86_on_arm64</span><span class="p">:</span>
+                <span class="k">raise</span> <span class="ne">NotImplementedError</span><span class="p">(</span><span class="s2">&quot;Crossing heaven gate x86 -&gt; arm64 not implemented&quot;</span><span class="p">)</span>
             <span class="n">res</span> <span class="o">=</span> <span class="n">ULONGLONG</span><span class="p">()</span>
             <span class="n">windows</span><span class="o">.</span><span class="n">syswow64</span><span class="o">.</span><span class="n">NtQueryInformationThread_32_to_64</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">ThreadQuerySetWin32StartAddress</span><span class="p">,</span> <span class="n">byref</span><span class="p">(</span><span class="n">res</span><span class="p">),</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">res</span><span class="p">))</span>
             <span class="k">return</span> <span class="n">res</span><span class="o">.</span><span class="n">value</span>
@@ -966,6 +1033,9 @@
         <span class="c1"># - Want the TEB of a 64b process</span>
         <span class="c1"># - Want the TEB64 of a Wowprocess</span>
         <span class="c1"># It&#39;s the same code for both</span>
+        <span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">_is_x86_on_arm64</span><span class="p">:</span>
+            <span class="k">raise</span> <span class="ne">NotImplementedError</span><span class="p">(</span><span class="s2">&quot;Crossing heaven gate x86 -&gt; arm64 not implemented&quot;</span><span class="p">)</span>
+
         <span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">is_wow_64</span><span class="p">:</span>
             <span class="n">restype</span> <span class="o">=</span> <span class="n">rctypes</span><span class="o">.</span><span class="n">transform_type_to_remote64bits</span><span class="p">(</span><span class="n">THREAD_BASIC_INFORMATION</span><span class="p">)</span>
             <span class="n">ressize</span> <span class="o">=</span> <span class="p">(</span><span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">restype</span><span class="p">))</span>
@@ -995,7 +1065,11 @@
         <span class="c1"># TebBase-&gt;NtTib.ExceptionList = (PVOID)Teb32Base;</span>
         <span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">owner</span><span class="o">.</span><span class="n">read_dword</span><span class="p">(</span><span class="n">main_teb_addr</span><span class="p">)</span>
 
-
+    <span class="nd">@property</span>
+    <span class="k">def</span> <span class="nf">teb</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
+        <span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">owner</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">32</span><span class="p">:</span>
+            <span class="k">return</span> <span class="n">RemoteTEB32</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">teb_base</span><span class="p">,</span> <span class="n">target</span><span class="o">=</span><span class="bp">self</span><span class="o">.</span><span class="n">owner</span><span class="p">)</span>
+        <span class="k">return</span> <span class="n">RemoteTEB64</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">teb_base</span><span class="p">,</span> <span class="n">target</span><span class="o">=</span><span class="bp">self</span><span class="o">.</span><span class="n">owner</span><span class="p">)</span>
 
     <span class="nd">@property</span>
     <span class="k">def</span> <span class="nf">teb_syswow_base</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
@@ -1008,6 +1082,12 @@
         <span class="c1"># just return the main TEB</span>
         <span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">_get_principal_teb_addr</span><span class="p">()</span>
 
+    <span class="nd">@property</span>
+    <span class="k">def</span> <span class="nf">teb_syswow</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
+        <span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">64</span><span class="p">:</span>
+            <span class="k">return</span> <span class="n">RemoteTEB64</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">teb_syswow_base</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">owner</span><span class="p">)</span>
+        <span class="k">else</span><span class="p">:</span> <span class="c1">#current is 32bits</span>
+            <span class="k">return</span> <span class="n">RemoteTEB64</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">teb_syswow_base</span><span class="p">,</span> <span class="n">windows</span><span class="o">.</span><span class="n">syswow64</span><span class="o">.</span><span class="n">ReadSyswow64Process</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">owner</span><span class="p">))</span>
 
 <div class="viewcode-block" id="WinThread.exit">
 <a class="viewcode-back" href="../../../process.html#windows.winobject.process.WinThread.exit">[docs]</a>
@@ -1069,8 +1149,6 @@
 
     <span class="nd">@staticmethod</span>
     <span class="k">def</span> <span class="nf">_get_thread_id_manual</span><span class="p">(</span><span class="n">handle</span><span class="p">):</span>
-        <span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">32</span> <span class="ow">and</span> <span class="bp">self</span><span class="o">.</span><span class="n">owner</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">64</span><span class="p">:</span>
-            <span class="k">raise</span> <span class="ne">NotImplementedError</span><span class="p">(</span><span class="s2">&quot;[_get_thread_id_manual] 32 -&gt; 64 (XP64 bits + Syswow process ?)&quot;</span><span class="p">)</span>
         <span class="n">res</span> <span class="o">=</span> <span class="n">THREAD_BASIC_INFORMATION</span><span class="p">()</span>
         <span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">NtQueryInformationThread</span><span class="p">(</span><span class="n">handle</span><span class="p">,</span> <span class="n">ThreadBasicInformation</span><span class="p">,</span> <span class="n">byref</span><span class="p">(</span><span class="n">res</span><span class="p">),</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">res</span><span class="p">))</span>
         <span class="n">id2</span> <span class="o">=</span> <span class="n">res</span><span class="o">.</span><span class="n">ClientId</span><span class="o">.</span><span class="n">UniqueThread</span>
@@ -1113,18 +1191,7 @@
         <span class="k">return</span> <span class="bp">cls</span><span class="p">(</span><span class="n">pid</span><span class="o">=</span><span class="n">pid</span><span class="p">,</span> <span class="n">name</span><span class="o">=</span><span class="n">name</span><span class="p">,</span> <span class="n">ppid</span><span class="o">=</span><span class="n">ppid</span><span class="p">)</span>
 
 
-    <span class="nd">@utils</span><span class="o">.</span><span class="n">fixedpropety</span>
-    <span class="k">def</span> <span class="nf">name</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
-<span class="w">        </span><span class="sd">&quot;&quot;&quot;Name of the process</span>
-
-<span class="sd">        :type: :class:`str`</span>
-<span class="sd">		&quot;&quot;&quot;</span>
-        <span class="n">buffer</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">create_unicode_buffer</span><span class="p">(</span><span class="mh">0x1024</span><span class="p">)</span>
-        <span class="n">rsize</span> <span class="o">=</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">GetProcessImageFileNameW</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">limited_handle</span><span class="p">,</span> <span class="n">buffer</span><span class="p">)</span>
-        <span class="c1"># GetProcessImageFileNameW returns the fullpath</span>
-        <span class="k">return</span> <span class="n">buffer</span><span class="p">[:</span><span class="n">rsize</span><span class="p">]</span><span class="o">.</span><span class="n">split</span><span class="p">(</span><span class="s2">&quot;</span><span class="se">\\</span><span class="s2">&quot;</span><span class="p">)[</span><span class="o">-</span><span class="mi">1</span><span class="p">]</span>
-
-    <span class="nd">@utils</span><span class="o">.</span><span class="n">fixedpropety</span>
+    <span class="nd">@utils</span><span class="o">.</span><span class="n">fixedproperty</span>
     <span class="k">def</span> <span class="nf">pid</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
 <span class="w">        </span><span class="sd">&quot;&quot;&quot;Process ID</span>
 
@@ -1149,13 +1216,13 @@
 
 <div class="viewcode-block" id="WinProcess.virtual_alloc">
 <a class="viewcode-back" href="../../../process.html#windows.winobject.process.WinProcess.virtual_alloc">[docs]</a>
-    <span class="k">def</span> <span class="nf">virtual_alloc</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">size</span><span class="p">,</span> <span class="n">prot</span><span class="o">=</span><span class="n">PAGE_EXECUTE_READWRITE</span><span class="p">,</span> <span class="n">addr</span><span class="o">=</span><span class="kc">None</span><span class="p">):</span>
+    <span class="k">def</span> <span class="nf">virtual_alloc</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">size</span><span class="p">,</span> <span class="n">prot</span><span class="o">=</span><span class="n">PAGE_EXECUTE_READWRITE</span><span class="p">,</span> <span class="n">addr</span><span class="o">=</span><span class="kc">None</span><span class="p">,</span> <span class="nb">type</span><span class="o">=</span><span class="n">gdef</span><span class="o">.</span><span class="n">MEM_COMMIT</span><span class="p">):</span>
 <span class="w">        </span><span class="sd">&quot;&quot;&quot;Allocate memory in the process</span>
 
 <span class="sd">        :return: The address of the allocated memory</span>
 <span class="sd">        :rtype: :class:`int`</span>
 <span class="sd">		&quot;&quot;&quot;</span>
-        <span class="k">return</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">VirtualAllocEx</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">lpAddress</span><span class="o">=</span><span class="n">addr</span><span class="p">,</span> <span class="n">dwSize</span><span class="o">=</span><span class="n">size</span><span class="p">,</span> <span class="n">flProtect</span><span class="o">=</span><span class="n">prot</span><span class="p">)</span></div>
+        <span class="k">return</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">VirtualAllocEx</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">lpAddress</span><span class="o">=</span><span class="n">addr</span><span class="p">,</span> <span class="n">dwSize</span><span class="o">=</span><span class="n">size</span><span class="p">,</span> <span class="n">flAllocationType</span><span class="o">=</span><span class="nb">type</span><span class="p">,</span> <span class="n">flProtect</span><span class="o">=</span><span class="n">prot</span><span class="p">)</span></div>
 
 
 <div class="viewcode-block" id="WinProcess.virtual_free">
@@ -1236,11 +1303,16 @@
 
 <span class="sd">            :rtype: :class:`WinThread` or :class:`DeadThread`</span>
 <span class="sd">		&quot;&quot;&quot;</span>
+        <span class="c1"># We are using NtCreateThreadEx as  its more permissive about cross-bitness / cross-architecture</span>
+        <span class="c1"># And we can asume we known what we are doing -&gt; So no safeguard ;)</span>
+        <span class="n">thread_handle</span> <span class="o">=</span> <span class="n">HANDLE</span><span class="p">()</span>
         <span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">32</span> <span class="ow">and</span> <span class="bp">self</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">64</span><span class="p">:</span>
-            <span class="n">thread_handle</span> <span class="o">=</span> <span class="n">HANDLE</span><span class="p">()</span>
+            <span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">_is_x86_on_arm64</span><span class="p">:</span>
+                <span class="k">raise</span> <span class="ne">NotImplementedError</span><span class="p">(</span><span class="s2">&quot;Crossing heaven gate x86 -&gt; arm64 not implemented&quot;</span><span class="p">)</span>
             <span class="n">windows</span><span class="o">.</span><span class="n">syswow64</span><span class="o">.</span><span class="n">NtCreateThreadEx_32_to_64</span><span class="p">(</span><span class="n">ThreadHandle</span><span class="o">=</span><span class="n">byref</span><span class="p">(</span><span class="n">thread_handle</span><span class="p">)</span> <span class="p">,</span><span class="n">ProcessHandle</span><span class="o">=</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">lpStartAddress</span><span class="o">=</span><span class="n">addr</span><span class="p">,</span> <span class="n">lpParameter</span><span class="o">=</span><span class="n">param</span><span class="p">)</span>
-            <span class="k">return</span> <span class="n">WinThread</span><span class="o">.</span><span class="n">_from_handle</span><span class="p">(</span><span class="n">thread_handle</span><span class="o">.</span><span class="n">value</span><span class="p">)</span>
-        <span class="k">return</span> <span class="n">WinThread</span><span class="o">.</span><span class="n">_from_handle</span><span class="p">(</span><span class="n">winproxy</span><span class="o">.</span><span class="n">CreateRemoteThread</span><span class="p">(</span><span class="n">hProcess</span><span class="o">=</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">lpStartAddress</span><span class="o">=</span><span class="n">addr</span><span class="p">,</span> <span class="n">lpParameter</span><span class="o">=</span><span class="n">param</span><span class="p">))</span></div>
+        <span class="k">else</span><span class="p">:</span>
+            <span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">NtCreateThreadEx</span><span class="p">(</span><span class="n">ThreadHandle</span><span class="o">=</span><span class="n">byref</span><span class="p">(</span><span class="n">thread_handle</span><span class="p">)</span> <span class="p">,</span><span class="n">ProcessHandle</span><span class="o">=</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">lpStartAddress</span><span class="o">=</span><span class="n">addr</span><span class="p">,</span> <span class="n">lpParameter</span><span class="o">=</span><span class="n">param</span><span class="p">)</span>
+        <span class="k">return</span> <span class="n">WinThread</span><span class="o">.</span><span class="n">_from_handle</span><span class="p">(</span><span class="n">thread_handle</span><span class="o">.</span><span class="n">value</span><span class="p">)</span></div>
 
 
 <div class="viewcode-block" id="WinProcess.load_library">
@@ -1257,55 +1329,62 @@
 <div class="viewcode-block" id="WinProcess.execute_python">
 <a class="viewcode-back" href="../../../process.html#windows.winobject.process.WinProcess.execute_python">[docs]</a>
     <span class="k">def</span> <span class="nf">execute_python</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">pycode</span><span class="p">):</span>
-<span class="w">        </span><span class="sd">&quot;&quot;&quot;Execute Python code into the remote process.</span>
+<span class="w">        </span><span class="sd">&quot;&quot;&quot;Execute Python code in the remote process.</span>
 
 <span class="sd">        This function waits for the remote process to end and</span>
 <span class="sd">        raises an exception if the remote thread raised one</span>
-<span class="sd">		&quot;&quot;&quot;</span>
+
+<span class="sd">        .. note::</span>
+<span class="sd">            This method is incompatible with Microsoft Store builds of python, as the interpreter DLLs do not grant execute to Users.</span>
+<span class="sd">            See workaround:  https://hakril.github.io/PythonForWindows/build/html/sample.html#microsoft-store-python-injection</span>
+<span class="sd">        &quot;&quot;&quot;</span>
         <span class="k">return</span> <span class="n">injection</span><span class="o">.</span><span class="n">safe_execute_python</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">pycode</span><span class="p">)</span></div>
 
 
 <div class="viewcode-block" id="WinProcess.execute_python_unsafe">
 <a class="viewcode-back" href="../../../process.html#windows.winobject.process.WinProcess.execute_python_unsafe">[docs]</a>
     <span class="k">def</span> <span class="nf">execute_python_unsafe</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">pycode</span><span class="p">):</span>
-<span class="w">        </span><span class="sd">&quot;&quot;&quot;Execute Python code into the remote process.</span>
+<span class="w">        </span><span class="sd">&quot;&quot;&quot;Execute Python code in the remote process.</span>
 
 <span class="sd">        :rtype: :rtype: :class:`WinThread` or :class:`DeadThread` : The thread executing the python code</span>
+
+<span class="sd">        .. note::</span>
+<span class="sd">            This method is incompatible with Microsoft Store builds of python, as the interpreter DLLs do not grant execute to Users.</span>
+<span class="sd">            See workaround:  https://hakril.github.io/PythonForWindows/build/html/sample.html#microsoft-store-python-injection</span>
 <span class="sd">        &quot;&quot;&quot;</span>
         <span class="k">return</span> <span class="n">injection</span><span class="o">.</span><span class="n">execute_python_code</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">pycode</span><span class="p">)</span></div>
 
 
 
-
-
-    <span class="nd">@utils</span><span class="o">.</span><span class="n">fixedpropety</span>
+    <span class="nd">@utils</span><span class="o">.</span><span class="n">fixedproperty</span>
     <span class="k">def</span> <span class="nf">peb_addr</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
-<span class="w">        </span><span class="sd">&quot;&quot;&quot;The address of the PEB</span>
+<span class="w">        </span><span class="sd">&quot;&quot;&quot;The address of the PEB.</span>
 
 <span class="sd">            :type: :class:`int`</span>
 <span class="sd">		&quot;&quot;&quot;</span>
-        <span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">32</span> <span class="ow">and</span> <span class="bp">self</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">64</span><span class="p">:</span>
+        <span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">_is_x86_on_arm64</span> <span class="ow">and</span> <span class="ow">not</span> <span class="bp">self</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">32</span><span class="p">:</span>
+            <span class="k">raise</span> <span class="ne">NotImplementedError</span><span class="p">(</span><span class="s2">&quot;Crossing heaven gate x86 -&gt; arm64 not implemented&quot;</span><span class="p">)</span>
+
+        <span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">32</span> <span class="ow">and</span> <span class="bp">self</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">64</span><span class="p">:</span> <span class="c1"># Intel to Intel</span>
             <span class="n">x</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">remotectypes</span><span class="o">.</span><span class="n">transform_type_to_remote64bits</span><span class="p">(</span><span class="n">PROCESS_BASIC_INFORMATION</span><span class="p">)</span>
             <span class="c1"># Fuck-it &lt;3</span>
             <span class="n">data</span> <span class="o">=</span> <span class="p">(</span><span class="n">ctypes</span><span class="o">.</span><span class="n">c_char</span> <span class="o">*</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">x</span><span class="p">))()</span>
-            <span class="n">windows</span><span class="o">.</span><span class="n">syswow64</span><span class="o">.</span><span class="n">NtQueryInformationProcess_32_to_64</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">ProcessInformation</span><span class="o">=</span><span class="n">data</span><span class="p">,</span> <span class="n">ProcessInformationLength</span><span class="o">=</span><span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">x</span><span class="p">))</span>
+            <span class="n">windows</span><span class="o">.</span><span class="n">syswow64</span><span class="o">.</span><span class="n">NtQueryInformationProcess_32_to_64</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">gdef</span><span class="o">.</span><span class="n">ProcessBasicInformation</span><span class="p">,</span> <span class="n">ProcessInformation</span><span class="o">=</span><span class="n">data</span><span class="p">)</span>
             <span class="n">peb_offset</span> <span class="o">=</span> <span class="n">x</span><span class="o">.</span><span class="n">PebBaseAddress</span><span class="o">.</span><span class="n">offset</span>
             <span class="n">peb_addr</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">unpack</span><span class="p">(</span><span class="s2">&quot;&lt;Q&quot;</span><span class="p">,</span> <span class="n">data</span><span class="p">[</span><span class="n">x</span><span class="o">.</span><span class="n">PebBaseAddress</span><span class="o">.</span><span class="n">offset</span><span class="p">:</span> <span class="n">x</span><span class="o">.</span><span class="n">PebBaseAddress</span><span class="o">.</span><span class="n">offset</span><span class="o">+</span><span class="mi">8</span><span class="p">])[</span><span class="mi">0</span><span class="p">]</span>
         <span class="k">elif</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">64</span> <span class="ow">and</span> <span class="bp">self</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">32</span><span class="p">:</span>
-            <span class="n">information_type</span> <span class="o">=</span> <span class="mi">26</span>
             <span class="n">y</span> <span class="o">=</span> <span class="n">ULONGLONG</span><span class="p">()</span>
-            <span class="n">winproxy</span><span class="o">.</span><span class="n">NtQueryInformationProcess</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">information_type</span><span class="p">,</span> <span class="n">byref</span><span class="p">(</span><span class="n">y</span><span class="p">),</span> <span class="n">sizeof</span><span class="p">(</span><span class="n">y</span><span class="p">))</span>
+            <span class="n">winproxy</span><span class="o">.</span><span class="n">NtQueryInformationProcess</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">gdef</span><span class="o">.</span><span class="n">ProcessWow64Information</span><span class="p">,</span> <span class="n">byref</span><span class="p">(</span><span class="n">y</span><span class="p">),</span> <span class="n">sizeof</span><span class="p">(</span><span class="n">y</span><span class="p">))</span>
             <span class="n">peb_addr</span> <span class="o">=</span> <span class="n">y</span><span class="o">.</span><span class="n">value</span>
         <span class="k">else</span><span class="p">:</span>
-            <span class="n">information_type</span> <span class="o">=</span> <span class="mi">0</span>
             <span class="n">x</span> <span class="o">=</span> <span class="n">PROCESS_BASIC_INFORMATION</span><span class="p">()</span>
-            <span class="n">winproxy</span><span class="o">.</span><span class="n">NtQueryInformationProcess</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">information_type</span><span class="p">,</span> <span class="n">x</span><span class="p">)</span>
+            <span class="n">winproxy</span><span class="o">.</span><span class="n">NtQueryInformationProcess</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">gdef</span><span class="o">.</span><span class="n">ProcessBasicInformation</span><span class="p">,</span> <span class="n">x</span><span class="p">)</span>
             <span class="n">peb_addr</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">cast</span><span class="p">(</span><span class="n">x</span><span class="o">.</span><span class="n">PebBaseAddress</span><span class="p">,</span> <span class="n">PVOID</span><span class="p">)</span><span class="o">.</span><span class="n">value</span>
         <span class="k">if</span> <span class="n">peb_addr</span> <span class="ow">is</span> <span class="kc">None</span><span class="p">:</span>
             <span class="k">raise</span> <span class="ne">ValueError</span><span class="p">(</span><span class="s2">&quot;Could not get peb addr of process </span><span class="si">{0}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">name</span><span class="p">))</span>
         <span class="k">return</span> <span class="n">peb_addr</span>
 
-    <span class="c1"># Not a fixedpropety to prevent ref-cycle and uncollectable WinProcess</span>
+    <span class="c1"># Not a fixedproperty to prevent ref-cycle and uncollectable WinProcess</span>
     <span class="c1"># Try with a weakref ?</span>
     <span class="nd">@property</span>
     <span class="k">def</span> <span class="nf">peb</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
@@ -1319,10 +1398,14 @@
             <span class="k">return</span> <span class="n">RemotePEB32</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">peb_addr</span><span class="p">,</span> <span class="bp">self</span><span class="p">)</span>
         <span class="k">return</span> <span class="n">RemotePEB</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">peb_addr</span><span class="p">,</span> <span class="bp">self</span><span class="p">)</span>
 
-    <span class="nd">@utils</span><span class="o">.</span><span class="n">fixedpropety</span>
+    <span class="nd">@utils</span><span class="o">.</span><span class="n">fixedproperty</span>
     <span class="k">def</span> <span class="nf">peb_syswow_addr</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
         <span class="k">if</span> <span class="ow">not</span> <span class="bp">self</span><span class="o">.</span><span class="n">is_wow_64</span><span class="p">:</span>
             <span class="k">raise</span> <span class="ne">ValueError</span><span class="p">(</span><span class="s2">&quot;Not a syswow process&quot;</span><span class="p">)</span>
+
+        <span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">_is_x86_on_arm64</span><span class="p">:</span>
+            <span class="k">raise</span> <span class="ne">NotImplementedError</span><span class="p">(</span><span class="s2">&quot;Crossing heaven gate x86 -&gt; arm64 not implemented&quot;</span><span class="p">)</span>
+
         <span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">64</span><span class="p">:</span>
             <span class="n">information_type</span> <span class="o">=</span> <span class="mi">0</span>
             <span class="n">x</span> <span class="o">=</span> <span class="n">PROCESS_BASIC_INFORMATION</span><span class="p">()</span>
@@ -1338,7 +1421,7 @@
             <span class="n">peb_addr</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">unpack</span><span class="p">(</span><span class="s2">&quot;&lt;Q&quot;</span><span class="p">,</span> <span class="n">data</span><span class="p">[</span><span class="n">x</span><span class="o">.</span><span class="n">PebBaseAddress</span><span class="o">.</span><span class="n">offset</span><span class="p">:</span> <span class="n">x</span><span class="o">.</span><span class="n">PebBaseAddress</span><span class="o">.</span><span class="n">offset</span><span class="o">+</span><span class="mi">8</span><span class="p">])[</span><span class="mi">0</span><span class="p">]</span>
             <span class="k">return</span> <span class="n">peb_addr</span>
 
-    <span class="c1"># Not a fixedpropety to prevent ref-cycle and uncollectable WinProcess</span>
+    <span class="c1"># Not a fixedproperty to prevent ref-cycle and uncollectable WinProcess</span>
     <span class="c1"># Try with a weakref ?</span>
     <span class="nd">@property</span>
     <span class="k">def</span> <span class="nf">peb_syswow</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
@@ -1362,8 +1445,6 @@
 
 
 
-
-
 <span class="k">def</span> <span class="nf">transform_ctypes_fields</span><span class="p">(</span><span class="n">struct</span><span class="p">,</span> <span class="n">replacement</span><span class="p">):</span>
     <span class="k">return</span> <span class="p">[(</span><span class="n">name</span><span class="p">,</span> <span class="n">replacement</span><span class="o">.</span><span class="n">get</span><span class="p">(</span><span class="n">name</span><span class="p">,</span> <span class="nb">type</span><span class="p">))</span> <span class="k">for</span> <span class="n">name</span><span class="p">,</span> <span class="nb">type</span> <span class="ow">in</span> <span class="n">struct</span><span class="o">.</span><span class="n">_fields_</span><span class="p">]</span>
 
@@ -1409,11 +1490,6 @@
 
 
 
-<span class="k">class</span> <span class="nc">LIST_ENTRY_PTR</span><span class="p">(</span><span class="n">PVOID</span><span class="p">):</span>
-    <span class="k">def</span> <span class="nf">TO_LDR_ENTRY</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
-        <span class="k">return</span> <span class="n">LDR_DATA_TABLE_ENTRY</span><span class="o">.</span><span class="n">from_address</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">value</span> <span class="o">-</span> <span class="n">sizeof</span><span class="p">(</span><span class="n">PVOID</span><span class="p">)</span> <span class="o">*</span> <span class="mi">2</span><span class="p">)</span>
-
-
 <div class="viewcode-block" id="PEB">
 <a class="viewcode-back" href="../../../process.html#windows.winobject.process.PEB">[docs]</a>
 <span class="k">class</span> <span class="nc">PEB</span><span class="p">(</span><span class="n">gdef</span><span class="o">.</span><span class="n">PEB</span><span class="p">):</span>
@@ -1450,13 +1526,13 @@
 <span class="sd">        :type: [:class:`LoadedModule`] -- List of loaded modules</span>
 <span class="sd">		&quot;&quot;&quot;</span>
         <span class="n">res</span> <span class="o">=</span> <span class="p">[]</span>
-        <span class="n">list_entry_ptr</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">cast</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">Ldr</span><span class="o">.</span><span class="n">contents</span><span class="o">.</span><span class="n">InMemoryOrderModuleList</span><span class="o">.</span><span class="n">Flink</span><span class="p">,</span> <span class="n">LIST_ENTRY_PTR</span><span class="p">)</span>
-        <span class="n">current_dll</span> <span class="o">=</span> <span class="n">list_entry_ptr</span><span class="o">.</span><span class="n">TO_LDR_ENTRY</span><span class="p">()</span>
+        <span class="n">first_flink</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">Ldr</span><span class="o">.</span><span class="n">contents</span><span class="o">.</span><span class="n">InMemoryOrderModuleList</span><span class="o">.</span><span class="n">Flink</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span>
+        <span class="n">current_dll</span> <span class="o">=</span> <span class="n">first_flink</span><span class="o">.</span><span class="n">get_real_struct</span><span class="p">(</span><span class="n">LoadedModule</span><span class="p">,</span> <span class="n">LoadedModule</span><span class="o">.</span><span class="n">InMemoryOrderLinks</span><span class="p">)</span>
         <span class="k">while</span> <span class="n">current_dll</span><span class="o">.</span><span class="n">DllBase</span><span class="p">:</span>
             <span class="n">res</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">current_dll</span><span class="p">)</span>
-            <span class="n">list_entry_ptr</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">cast</span><span class="p">(</span><span class="n">current_dll</span><span class="o">.</span><span class="n">InMemoryOrderLinks</span><span class="o">.</span><span class="n">Flink</span><span class="p">,</span> <span class="n">LIST_ENTRY_PTR</span><span class="p">)</span>
-            <span class="n">current_dll</span> <span class="o">=</span> <span class="n">list_entry_ptr</span><span class="o">.</span><span class="n">TO_LDR_ENTRY</span><span class="p">()</span>
-        <span class="k">return</span> <span class="p">[</span><span class="n">LoadedModule</span><span class="o">.</span><span class="n">from_address</span><span class="p">(</span><span class="n">addressof</span><span class="p">(</span><span class="n">LDR</span><span class="p">))</span> <span class="k">for</span> <span class="n">LDR</span> <span class="ow">in</span> <span class="n">res</span><span class="p">]</span>
+            <span class="n">next_flink</span> <span class="o">=</span> <span class="n">current_dll</span><span class="o">.</span><span class="n">InMemoryOrderLinks</span><span class="o">.</span><span class="n">Flink</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span>
+            <span class="n">current_dll</span> <span class="o">=</span> <span class="n">next_flink</span><span class="o">.</span><span class="n">get_real_struct</span><span class="p">(</span><span class="n">LoadedModule</span><span class="p">,</span> <span class="n">LoadedModule</span><span class="o">.</span><span class="n">InMemoryOrderLinks</span><span class="p">)</span>
+        <span class="k">return</span> <span class="n">res</span>
 
     <span class="nd">@staticmethod</span>
     <span class="k">def</span> <span class="nf">_extract_environment</span><span class="p">(</span><span class="n">env_block_addr</span><span class="p">,</span> <span class="n">target</span><span class="p">):</span>
@@ -1487,7 +1563,6 @@
         <span class="k">return</span> <span class="n">apisetmap</span><span class="o">.</span><span class="n">get_api_set_map_for_current_process</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">ApiSetMap</span><span class="p">)</span></div>
 
 
-
 <span class="c1"># Memory stuff</span>
 
 <span class="k">class</span> <span class="nc">EPSAPI_WORKING_SET_BLOCK_BASE</span><span class="p">(</span><span class="nb">object</span><span class="p">):</span>
@@ -1599,9 +1674,24 @@
         <span class="k">raise</span> <span class="ne">NotImplementedError</span><span class="p">(</span><span class="s2">&quot;ApiSetMap for remote process not implemented yet&quot;</span><span class="p">)</span>
 
 
+<span class="c1"># TEB enhanced, same bitness as PEB (current process)</span>
+<span class="k">class</span> <span class="nc">TEB</span><span class="p">(</span><span class="n">gdef</span><span class="o">.</span><span class="n">TEB</span><span class="p">):</span>
+    <span class="nd">@property</span>
+    <span class="k">def</span> <span class="nf">peb</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
+        <span class="k">return</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">cast</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">ProcessEnvironmentBlock</span><span class="p">,</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">POINTER</span><span class="p">(</span><span class="n">PEB</span><span class="p">))[</span><span class="mi">0</span><span class="p">]</span>
 
+<span class="c1"># mote TEB enhanced, same bitness as PEB (current process)</span>
+<span class="k">class</span> <span class="nc">RemoteTEB</span><span class="p">(</span><span class="n">rctypes</span><span class="o">.</span><span class="n">RemoteStructure</span><span class="o">.</span><span class="n">from_structure</span><span class="p">(</span><span class="n">TEB</span><span class="p">)):</span>
+    <span class="nd">@property</span>
+    <span class="k">def</span> <span class="nf">peb</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
+        <span class="n">ctypes_peb</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">ProcessEnvironmentBlock</span><span class="o">.</span><span class="n">value</span>
+        <span class="k">return</span> <span class="n">RemotePEB</span><span class="p">(</span><span class="n">ctypes_peb</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">_target</span><span class="p">)</span>
 
 <span class="k">if</span> <span class="n">CurrentProcess</span><span class="p">()</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">32</span><span class="p">:</span>
+    <span class="n">RemoteLoadedModule32</span> <span class="o">=</span> <span class="n">RemoteLoadedModule</span>
+    <span class="n">RemotePEB32</span> <span class="o">=</span> <span class="n">RemotePEB</span>
+    <span class="n">RemoteTEB32</span> <span class="o">=</span> <span class="n">RemoteTEB</span>
+
     <span class="k">class</span> <span class="nc">RemoteLoadedModule64</span><span class="p">(</span><span class="n">rctypes</span><span class="o">.</span><span class="n">transform_type_to_remote64bits</span><span class="p">(</span><span class="n">LoadedModule</span><span class="p">)):</span>
         <span class="nd">@property</span>
         <span class="k">def</span> <span class="nf">pe</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
@@ -1616,7 +1706,6 @@
         <span class="k">def</span> <span class="nf">ptr_flink_to_remote_module</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">ptr_value</span><span class="p">):</span>
             <span class="k">return</span> <span class="n">RemoteLoadedModule64</span><span class="p">(</span><span class="n">ptr_value</span> <span class="o">-</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">rctypes</span><span class="o">.</span><span class="n">c_void_p64</span><span class="p">)</span> <span class="o">*</span> <span class="mi">2</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">_target</span><span class="p">)</span>
 
-
         <span class="nd">@property</span>
         <span class="k">def</span> <span class="nf">exe</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
 <span class="w">            </span><span class="sd">&quot;&quot;&quot;The executable of the process, as pointed by PEB.ImageBaseAddress</span>
@@ -1649,7 +1738,17 @@
 
         <span class="n">apisetmap</span> <span class="o">=</span> <span class="n">RemotePEB</span><span class="o">.</span><span class="n">apisetmap</span>
 
+    <span class="k">class</span> <span class="nc">RemoteTEB64</span><span class="p">(</span><span class="n">rctypes</span><span class="o">.</span><span class="n">transform_type_to_remote64bits</span><span class="p">(</span><span class="n">TEB</span><span class="p">)):</span>
+        <span class="nd">@property</span>
+        <span class="k">def</span> <span class="nf">peb</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
+            <span class="n">ctypes_peb</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">ProcessEnvironmentBlock</span><span class="o">.</span><span class="n">value</span>
+            <span class="k">return</span> <span class="n">RemotePEB64</span><span class="p">(</span><span class="n">ctypes_peb</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">_target</span><span class="p">)</span>
+
+
 <span class="k">if</span> <span class="n">CurrentProcess</span><span class="p">()</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">64</span><span class="p">:</span>
+    <span class="n">RemoteLoadedModule64</span> <span class="o">=</span> <span class="n">RemoteLoadedModule</span>
+    <span class="n">RemotePEB64</span> <span class="o">=</span> <span class="n">RemotePEB</span>
+    <span class="n">RemoteTEB64</span> <span class="o">=</span> <span class="n">RemoteTEB</span>
 
     <span class="k">class</span> <span class="nc">RemoteLoadedModule32</span><span class="p">(</span><span class="n">rctypes</span><span class="o">.</span><span class="n">transform_type_to_remote32bits</span><span class="p">(</span><span class="n">LoadedModule</span><span class="p">)):</span>
         <span class="nd">@property</span>
@@ -1696,6 +1795,12 @@
             <span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">_extract_environment</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">ProcessParameters</span><span class="o">.</span><span class="n">contents</span><span class="o">.</span><span class="n">Environment</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">_target</span><span class="p">)</span>
 
         <span class="n">apisetmap</span> <span class="o">=</span> <span class="n">RemotePEB</span><span class="o">.</span><span class="n">apisetmap</span>
+
+    <span class="k">class</span> <span class="nc">RemoteTEB32</span><span class="p">(</span><span class="n">rctypes</span><span class="o">.</span><span class="n">transform_type_to_remote32bits</span><span class="p">(</span><span class="n">TEB</span><span class="p">)):</span>
+        <span class="nd">@property</span>
+        <span class="k">def</span> <span class="nf">peb</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
+            <span class="n">ctypes_peb</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">ProcessEnvironmentBlock</span><span class="o">.</span><span class="n">value</span>
+            <span class="k">return</span> <span class="n">RemotePEB32</span><span class="p">(</span><span class="n">ctypes_peb</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">_target</span><span class="p">)</span>
 </pre></div>
 
             <div class="clearer"></div>
@@ -1727,7 +1832,7 @@
         <li class="right" >
           <a href="../../../py-modindex.html" title="Python Module Index"
              >modules</a> |</li>
-        <li class="nav-item nav-item-0"><a href="../../../index.html">PythonForWindows 1.0.2 documentation</a> &#187;</li>
+        <li class="nav-item nav-item-0"><a href="../../../index.html">PythonForWindows 1.0.3 documentation</a> &#187;</li>
           <li class="nav-item nav-item-1"><a href="../../index.html" >Module code</a> &#187;</li>
         <li class="nav-item nav-item-this"><a href="">windows.winobject.process</a></li> 
       </ul>

docs/build/html/_modules/windows/winobject/system.html

@@ -49,7 +49,6 @@
 <span class="kn">import</span> <span class="nn">windows.generated_def</span> <span class="k">as</span> <span class="nn">gdef</span>
 
 
-
 <span class="kn">from</span> <span class="nn">windows.winobject</span> <span class="kn">import</span> <span class="n">process</span>
 <span class="kn">from</span> <span class="nn">windows.winobject</span> <span class="kn">import</span> <span class="n">network</span>
 <span class="kn">from</span> <span class="nn">windows.winobject</span> <span class="kn">import</span> <span class="n">registry</span>
@@ -128,7 +127,7 @@
 
     <span class="nd">@property</span>
     <span class="k">def</span> <span class="nf">logicaldrives</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
-<span class="w">        </span><span class="sd">&quot;&quot;&quot;List of logical drives [C:\, ...]</span>
+<span class="w">        </span><span class="sd">&quot;&quot;&quot;List of logical drives [C:\\, ...]</span>
 
 <span class="sd">        :type: [:class:`~windows.winobject.volume.LogicalDrive`] -- A list of LogicalDrive</span>
 <span class="sd">        &quot;&quot;&quot;</span>
@@ -301,12 +300,77 @@
             <span class="n">result</span> <span class="o">=</span> <span class="nb">tuple</span><span class="p">(</span><span class="n">result_tup</span><span class="p">[:</span><span class="mi">2</span><span class="p">])</span>
         <span class="k">return</span> <span class="n">result</span>
 
+    <span class="c1"># Based on:</span>
+    <span class="c1">#   https://jrsoftware.org/ishelp/index.php?topic=winvernotes</span>
+    <span class="c1">#   https://en.wikipedia.org/wiki/List_of_Microsoft_Windows_versions</span>
+
+    <span class="n">WINDOWS_10_BUILD_NUMBER_VERSION</span> <span class="o">=</span> <span class="p">{</span>
+        <span class="c1"># (build_number, is_workstation): &quot;version_name&quot;</span>
+        <span class="p">(</span><span class="mi">10240</span><span class="p">,</span> <span class="kc">True</span><span class="p">):</span> <span class="sa">u</span><span class="s2">&quot;Windows 10 Version 1507&quot;</span><span class="p">,</span>
+        <span class="p">(</span><span class="mi">10586</span><span class="p">,</span> <span class="kc">True</span><span class="p">):</span> <span class="sa">u</span><span class="s2">&quot;Windows 10 Version 1511&quot;</span><span class="p">,</span>
+        <span class="p">(</span><span class="mi">14393</span><span class="p">,</span> <span class="kc">True</span><span class="p">):</span> <span class="sa">u</span><span class="s2">&quot;Windows 10 Version 1607&quot;</span><span class="p">,</span>
+        <span class="p">(</span><span class="mi">15063</span><span class="p">,</span> <span class="kc">True</span><span class="p">):</span> <span class="sa">u</span><span class="s2">&quot;Windows 10 Version 1703&quot;</span><span class="p">,</span>
+        <span class="p">(</span><span class="mi">16299</span><span class="p">,</span> <span class="kc">True</span><span class="p">):</span> <span class="sa">u</span><span class="s2">&quot;Windows 10 Version 1709&quot;</span><span class="p">,</span>
+        <span class="p">(</span><span class="mi">17134</span><span class="p">,</span> <span class="kc">True</span><span class="p">):</span> <span class="sa">u</span><span class="s2">&quot;Windows 10 Version 1803&quot;</span><span class="p">,</span>
+        <span class="p">(</span><span class="mi">17763</span><span class="p">,</span> <span class="kc">True</span><span class="p">):</span> <span class="sa">u</span><span class="s2">&quot;Windows 10 Version 1809&quot;</span><span class="p">,</span>
+        <span class="p">(</span><span class="mi">18362</span><span class="p">,</span> <span class="kc">True</span><span class="p">):</span> <span class="sa">u</span><span class="s2">&quot;Windows 10 Version 1903&quot;</span><span class="p">,</span>
+        <span class="p">(</span><span class="mi">18363</span><span class="p">,</span> <span class="kc">True</span><span class="p">):</span> <span class="sa">u</span><span class="s2">&quot;Windows 10 Version 1909&quot;</span><span class="p">,</span>
+        <span class="p">(</span><span class="mi">19041</span><span class="p">,</span> <span class="kc">True</span><span class="p">):</span> <span class="sa">u</span><span class="s2">&quot;Windows 10 Version 2004&quot;</span><span class="p">,</span>
+        <span class="p">(</span><span class="mi">19042</span><span class="p">,</span> <span class="kc">True</span><span class="p">):</span> <span class="sa">u</span><span class="s2">&quot;Windows 10 Version 20H2&quot;</span><span class="p">,</span>
+        <span class="p">(</span><span class="mi">19043</span><span class="p">,</span> <span class="kc">True</span><span class="p">):</span> <span class="sa">u</span><span class="s2">&quot;Windows 10 Version 21H1&quot;</span><span class="p">,</span>
+        <span class="p">(</span><span class="mi">19044</span><span class="p">,</span> <span class="kc">True</span><span class="p">):</span> <span class="sa">u</span><span class="s2">&quot;Windows 10 Version 21H2&quot;</span><span class="p">,</span>
+        <span class="p">(</span><span class="mi">19045</span><span class="p">,</span> <span class="kc">True</span><span class="p">):</span> <span class="sa">u</span><span class="s2">&quot;Windows 10 Version 22H2&quot;</span><span class="p">,</span>
+        <span class="p">(</span><span class="mi">22000</span><span class="p">,</span> <span class="kc">True</span><span class="p">):</span> <span class="sa">u</span><span class="s2">&quot;Windows 11 Version 21H2&quot;</span><span class="p">,</span>
+        <span class="p">(</span><span class="mi">22621</span><span class="p">,</span> <span class="kc">True</span><span class="p">):</span> <span class="sa">u</span><span class="s2">&quot;Windows 11 Version 22H2&quot;</span><span class="p">,</span>
+        <span class="p">(</span><span class="mi">22631</span><span class="p">,</span> <span class="kc">True</span><span class="p">):</span> <span class="sa">u</span><span class="s2">&quot;Windows 11 Version 23H2&quot;</span><span class="p">,</span>
+        <span class="p">(</span><span class="mi">26100</span><span class="p">,</span> <span class="kc">True</span><span class="p">):</span> <span class="sa">u</span><span class="s2">&quot;Windows 11 Version 24H2&quot;</span><span class="p">,</span>
+
+        <span class="p">(</span><span class="mi">14393</span><span class="p">,</span> <span class="kc">False</span><span class="p">):</span> <span class="sa">u</span><span class="s2">&quot;Windows Server 2016&quot;</span><span class="p">,</span>
+        <span class="c1"># 16299 : Windows Server, version 1709 ?</span>
+        <span class="c1"># 17134 : Windows Server, version 1803 ?</span>
+        <span class="c1"># 17134 : Windows Server, version 1803 ?</span>
+        <span class="p">(</span><span class="mi">17763</span><span class="p">,</span> <span class="kc">False</span><span class="p">):</span> <span class="sa">u</span><span class="s2">&quot;Windows Server 2019&quot;</span><span class="p">,</span>
+        <span class="c1"># 18362 : Windows Server, version 1903 ?</span>
+        <span class="c1"># 18363 : Windows Server, version 1909 ?</span>
+        <span class="c1"># 19041 : Windows Server, version 2004 ?</span>
+        <span class="c1"># 19042 : Windows Server, version 20H2 ?</span>
+        <span class="p">(</span><span class="mi">20348</span><span class="p">,</span> <span class="kc">False</span><span class="p">):</span> <span class="sa">u</span><span class="s2">&quot;Windows Server 2022&quot;</span><span class="p">,</span>
+        <span class="c1"># 25398 : Windows Server, version 23H2 ?</span>
+        <span class="p">(</span><span class="mi">26100</span><span class="p">,</span> <span class="kc">False</span><span class="p">):</span> <span class="sa">u</span><span class="s2">&quot;Windows Server 2025&quot;</span><span class="p">,</span>
+    <span class="p">}</span>
+
+    <span class="k">def</span> <span class="nf">_get_version_name_for_10_build</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">build_number</span><span class="p">,</span> <span class="n">is_workstation</span><span class="p">):</span>
+        <span class="k">try</span><span class="p">:</span>
+            <span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">WINDOWS_10_BUILD_NUMBER_VERSION</span><span class="p">[(</span><span class="n">build_number</span><span class="p">,</span> <span class="n">is_workstation</span><span class="p">)]</span>
+        <span class="k">except</span> <span class="ne">KeyError</span> <span class="k">as</span> <span class="n">e</span><span class="p">:</span>
+            <span class="k">return</span> <span class="sa">u</span><span class="s2">&quot;Unknown Windows 10+ &lt;versionstr=</span><span class="si">{0}</span><span class="s2"> | is_workstation=</span><span class="si">{1}</span><span class="s2">&gt;&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">versionstr</span><span class="p">,</span> <span class="n">is_workstation</span><span class="p">)</span>
+
     <span class="nd">@utils</span><span class="o">.</span><span class="n">fixedpropety</span>
     <span class="k">def</span> <span class="nf">version_name</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
 <span class="w">        </span><span class="sd">&quot;&quot;&quot;The name of the system version,  values are:</span>
 
+<span class="sd">            * Windows Server 2025</span>
+<span class="sd">            * Windows 11 Version 24H2</span>
+<span class="sd">            * Windows 11 Version 23H2</span>
+<span class="sd">            * Windows 11 Version 22H2</span>
+<span class="sd">            * Windows 11 Version 21H2</span>
+<span class="sd">            * Windows 10 Version 22H2</span>
+<span class="sd">            * Windows 10 Version 21H2</span>
+<span class="sd">            * Windows Server 2022</span>
+<span class="sd">            * Windows 10 Version 21H1</span>
+<span class="sd">            * Windows 10 Version 20H2</span>
+<span class="sd">            * Windows 10 Version 2004</span>
+<span class="sd">            * Windows 10 Version 1909</span>
+<span class="sd">            * Windows 10 Version 1903</span>
+<span class="sd">            * Windows Server 2019</span>
+<span class="sd">            * Windows 10 Version 1809</span>
+<span class="sd">            * Windows 10 Version 1803</span>
+<span class="sd">            * Windows 10 Version 1709</span>
+<span class="sd">            * Windows 10 Version 1703</span>
+<span class="sd">            * Windows 10 Version 1607</span>
+<span class="sd">            * Windows 10 Version 1511</span>
+<span class="sd">            * Windows 10 Version 1507</span>
 <span class="sd">            * Windows Server 2016</span>
-<span class="sd">            * Windows 10</span>
 <span class="sd">            * Windows Server 2012 R2</span>
 <span class="sd">            * Windows 8.1</span>
 <span class="sd">            * Windows Server 2012</span>
@@ -316,19 +380,20 @@
 <span class="sd">            * Windows Server 2008</span>
 <span class="sd">            * Windows Vista</span>
 <span class="sd">            * Windows XP Professional x64 Edition</span>
-<span class="sd">            * TODO: version (5.2) + is_workstation + bitness == 32 (don&#39;t even know if possible..)</span>
+<span class="sd">            * Unknown: version (5.2) + is_workstation + bitness == 32 (don&#39;t even know if possible..)</span>
 <span class="sd">            * Windows Server 2003 R2</span>
 <span class="sd">            * Windows Server 2003</span>
 <span class="sd">            * Windows XP</span>
 <span class="sd">            * Windows 2000</span>
-<span class="sd">            * &quot;Unknow Windows &lt;version={0} | is_workstation={1}&gt;&quot;.format(version, is_workstation)</span>
+<span class="sd">            * &quot;Unknown Windows 10+ &lt;versionstr={0} | is_workstation={1}&gt;&quot;.format(self.versionstr, is_workstation)</span>
+<span class="sd">            * &quot;Unknown Windows &lt;version={0} | is_workstation={1}&gt;&quot;.format(version, is_workstation)</span>
 
-<span class="sd">        :type: :class:`str`</span>
+<span class="sd">        :type: :class:`unicode`</span>
 <span class="sd">        &quot;&quot;&quot;</span>
         <span class="n">version</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">version</span>
         <span class="n">is_workstation</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">product_type</span> <span class="o">==</span> <span class="n">gdef</span><span class="o">.</span><span class="n">VER_NT_WORKSTATION</span>
         <span class="k">if</span> <span class="n">version</span> <span class="o">==</span> <span class="p">(</span><span class="mi">10</span><span class="p">,</span> <span class="mi">0</span><span class="p">):</span>
-            <span class="k">return</span> <span class="p">[</span><span class="sa">u</span><span class="s2">&quot;Windows Server 2016&quot;</span><span class="p">,</span> <span class="sa">u</span><span class="s2">&quot;Windows 10&quot;</span><span class="p">][</span><span class="n">is_workstation</span><span class="p">]</span>
+            <span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">_get_version_name_for_10_build</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">build_number</span><span class="p">,</span> <span class="n">is_workstation</span><span class="p">)</span>
         <span class="k">elif</span> <span class="n">version</span> <span class="o">==</span> <span class="p">(</span><span class="mi">6</span><span class="p">,</span> <span class="mi">3</span><span class="p">):</span>
             <span class="k">return</span>  <span class="p">[</span><span class="sa">u</span><span class="s2">&quot;Windows Server 2012 R2&quot;</span><span class="p">,</span> <span class="sa">u</span><span class="s2">&quot;Windows 8.1&quot;</span><span class="p">][</span><span class="n">is_workstation</span><span class="p">]</span>
         <span class="k">elif</span> <span class="n">version</span> <span class="o">==</span> <span class="p">(</span><span class="mi">6</span><span class="p">,</span> <span class="mi">2</span><span class="p">):</span>
@@ -343,7 +408,7 @@
                 <span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">64</span><span class="p">:</span>
                     <span class="k">return</span> <span class="sa">u</span><span class="s2">&quot;Windows XP Professional x64 Edition&quot;</span>
                 <span class="k">else</span><span class="p">:</span>
-                    <span class="k">return</span> <span class="sa">u</span><span class="s2">&quot;TODO: version (5.2) + is_workstation + bitness == 32&quot;</span>
+                    <span class="k">return</span> <span class="sa">u</span><span class="s2">&quot;Unknown: version (5.2) + is_workstation + bitness == 32&quot;</span>
             <span class="k">elif</span> <span class="n">metric</span> <span class="o">!=</span> <span class="mi">0</span><span class="p">:</span>
                 <span class="k">return</span> <span class="sa">u</span><span class="s2">&quot;Windows Server 2003 R2&quot;</span>
             <span class="k">else</span><span class="p">:</span>
@@ -353,7 +418,7 @@
         <span class="k">elif</span> <span class="n">version</span> <span class="o">==</span> <span class="p">(</span><span class="mi">5</span><span class="p">,</span> <span class="mi">0</span><span class="p">):</span>
             <span class="k">return</span> <span class="sa">u</span><span class="s2">&quot;Windows 2000&quot;</span>
         <span class="k">else</span><span class="p">:</span>
-            <span class="k">return</span> <span class="sa">u</span><span class="s2">&quot;Unknow Windows &lt;version=</span><span class="si">{0}</span><span class="s2"> | is_workstation=</span><span class="si">{1}</span><span class="s2">&gt;&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">version</span><span class="p">,</span> <span class="n">is_workstation</span><span class="p">)</span>
+            <span class="k">return</span> <span class="sa">u</span><span class="s2">&quot;Unknown Windows &lt;version=</span><span class="si">{0}</span><span class="s2"> | is_workstation=</span><span class="si">{1}</span><span class="s2">&gt;&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">version</span><span class="p">,</span> <span class="n">is_workstation</span><span class="p">)</span>
 
     <span class="n">VERSION_MAPPER</span> <span class="o">=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">FlagMapper</span><span class="p">(</span><span class="n">gdef</span><span class="o">.</span><span class="n">VER_NT_WORKSTATION</span><span class="p">,</span> <span class="n">gdef</span><span class="o">.</span><span class="n">VER_NT_DOMAIN_CONTROLLER</span><span class="p">,</span> <span class="n">gdef</span><span class="o">.</span><span class="n">VER_NT_SERVER</span><span class="p">)</span>
     <span class="nd">@utils</span><span class="o">.</span><span class="n">fixedpropety</span>
@@ -561,6 +626,24 @@
         <span class="c1"># These are the part that do not move much between XP &amp; Win10</span>
         <span class="k">return</span> <span class="n">gdef</span><span class="o">.</span><span class="n">PFW_MINIMAL_KUSER_SHARED_DATA</span><span class="o">.</span><span class="n">from_address</span><span class="p">(</span><span class="n">gdef</span><span class="o">.</span><span class="n">MM_SHARED_USER_DATA_VA</span><span class="p">)</span>
 
+    <span class="nd">@utils</span><span class="o">.</span><span class="n">fixedproperty</span>
+    <span class="k">def</span> <span class="nf">architecture</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
+        <span class="c1"># Retrieve system processor architecture</span>
+        <span class="c1"># It&#39;s not that easy as x64-on-ARM64 will lie on most API except IsWow64Process2</span>
+        <span class="c1"># EX: GetNativeSystemInfo will returns PROCESSOR_ARCHITECTURE_AMD64</span>
+        <span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">is_implemented</span><span class="p">(</span><span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">IsWow64Process2</span><span class="p">):</span>
+            <span class="n">process_machine</span><span class="p">,</span> <span class="n">native_machine</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">is_wow_64_2</span>
+            <span class="k">try</span><span class="p">:</span>
+                <span class="k">return</span> <span class="n">utils</span><span class="o">.</span><span class="n">image_file_machine_to_processor_architecture</span><span class="p">(</span><span class="n">native_machine</span><span class="p">)</span>
+            <span class="k">except</span> <span class="ne">KeyError</span> <span class="k">as</span> <span class="n">e</span><span class="p">:</span>
+                <span class="k">raise</span> <span class="ne">ValueError</span><span class="p">(</span><span class="s2">&quot;Unknown IsWow64Process2(native_machine:#x) -&gt; </span><span class="si">{0}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">native_machine</span><span class="p">))</span>
+
+        <span class="c1"># No IsWow64Process2 -&gt; assert it cannot be ARM64 and thus GetNativeSystemInfo will not lie ?</span>
+        <span class="n">sysinfo</span> <span class="o">=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">SYSTEM_INFO</span><span class="p">()</span>
+        <span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">GetNativeSystemInfo</span><span class="p">(</span><span class="n">sysinfo</span><span class="p">)</span>
+        <span class="k">return</span> <span class="n">gdef</span><span class="o">.</span><span class="n">PROCESSOR_ARCHITECTURE_MAPPER</span><span class="p">[</span><span class="n">sysinfo</span><span class="o">.</span><span class="n">wProcessorArchitecture</span><span class="p">]</span>
+
+
 
     <span class="nd">@staticmethod</span>
     <span class="k">def</span> <span class="nf">enumerate_processes</span><span class="p">():</span>
@@ -596,7 +679,7 @@
 
     <span class="nd">@staticmethod</span>
     <span class="k">def</span> <span class="nf">enumerate_threads</span><span class="p">():</span>
-        <span class="k">return</span> <span class="p">[</span><span class="n">WinThread</span><span class="o">.</span><span class="n">_from_THREADENTRY32</span><span class="p">(</span><span class="n">th</span><span class="p">)</span> <span class="k">for</span> <span class="n">th</span> <span class="ow">in</span> <span class="n">System</span><span class="o">.</span><span class="n">enumerate_threads_generator</span><span class="p">()]</span>
+        <span class="k">return</span> <span class="p">[</span><span class="n">process</span><span class="o">.</span><span class="n">WinThread</span><span class="o">.</span><span class="n">_from_THREADENTRY32</span><span class="p">(</span><span class="n">th</span><span class="p">)</span> <span class="k">for</span> <span class="n">th</span> <span class="ow">in</span> <span class="n">System</span><span class="o">.</span><span class="n">enumerate_threads_generator</span><span class="p">()]</span>
 
 
     <span class="k">def</span> <span class="nf">enumerate_threads_setup_owners</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>

docs/build/html/_modules/windows/winobject/system_module.html

@@ -4,12 +4,12 @@
   <head>
     <meta charset="utf-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-    <title>windows.winobject.system_module &#8212; PythonForWindows 1.0.2 documentation</title>
+    <title>windows.winobject.system_module &#8212; PythonForWindows 1.0.3 documentation</title>
     <link rel="stylesheet" type="text/css" href="../../../_static/pygments.css?v=fa44fd50" />
     <link rel="stylesheet" type="text/css" href="../../../_static/classic.css?v=def86cc0" />
     <link rel="stylesheet" type="text/css" href="../../../_static/css/mbasic.css?v=957880af" />
     
-    <script src="../../../_static/documentation_options.js?v=1ed6394b"></script>
+    <script src="../../../_static/documentation_options.js?v=baaebd52"></script>
     <script src="../../../_static/doctools.js?v=9a2dae69"></script>
     <script src="../../../_static/sphinx_highlight.js?v=dc90522c"></script>
     
@@ -25,7 +25,7 @@
         <li class="right" >
           <a href="../../../py-modindex.html" title="Python Module Index"
              >modules</a> |</li>
-        <li class="nav-item nav-item-0"><a href="../../../index.html">PythonForWindows 1.0.2 documentation</a> &#187;</li>
+        <li class="nav-item nav-item-0"><a href="../../../index.html">PythonForWindows 1.0.3 documentation</a> &#187;</li>
           <li class="nav-item nav-item-1"><a href="../../index.html" accesskey="U">Module code</a> &#187;</li>
         <li class="nav-item nav-item-this"><a href="">windows.winobject.system_module</a></li> 
       </ul>
@@ -92,6 +92,8 @@
     <span class="k">return</span> <span class="nb">list</span><span class="p">(</span><span class="n">modules</span><span class="p">)</span>
 
 <span class="k">def</span> <span class="nf">enumerate_kernel_modules_syswow64</span><span class="p">():</span>
+    <span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">_is_x86_on_arm64</span><span class="p">:</span>
+        <span class="k">raise</span> <span class="ne">NotImplementedError</span><span class="p">(</span><span class="s2">&quot;Crossing heaven gate x86 -&gt; arm64 not implemented&quot;</span><span class="p">)</span>
     <span class="n">cbsize</span> <span class="o">=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">DWORD</span><span class="p">()</span>
     <span class="n">windows</span><span class="o">.</span><span class="n">syswow64</span><span class="o">.</span><span class="n">NtQuerySystemInformation_32_to_64</span><span class="p">(</span><span class="n">gdef</span><span class="o">.</span><span class="n">SystemModuleInformation</span><span class="p">,</span> <span class="kc">None</span><span class="p">,</span> <span class="mi">0</span><span class="p">,</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">addressof</span><span class="p">(</span><span class="n">cbsize</span><span class="p">))</span>
     <span class="n">raw_buffer</span> <span class="o">=</span> <span class="p">(</span><span class="n">cbsize</span><span class="o">.</span><span class="n">value</span> <span class="o">*</span> <span class="n">gdef</span><span class="o">.</span><span class="n">BYTE</span><span class="p">)()</span>
@@ -130,7 +132,7 @@
         <li class="right" >
           <a href="../../../py-modindex.html" title="Python Module Index"
              >modules</a> |</li>
-        <li class="nav-item nav-item-0"><a href="../../../index.html">PythonForWindows 1.0.2 documentation</a> &#187;</li>
+        <li class="nav-item nav-item-0"><a href="../../../index.html">PythonForWindows 1.0.3 documentation</a> &#187;</li>
           <li class="nav-item nav-item-1"><a href="../../index.html" >Module code</a> &#187;</li>
         <li class="nav-item nav-item-this"><a href="">windows.winobject.system_module</a></li> 
       </ul>

docs/build/html/_modules/windows/winobject/wmi.html

@@ -4,12 +4,12 @@
   <head>
     <meta charset="utf-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-    <title>windows.winobject.wmi &#8212; PythonForWindows 1.0.2 documentation</title>
+    <title>windows.winobject.wmi &#8212; PythonForWindows 1.0.3 documentation</title>
     <link rel="stylesheet" type="text/css" href="../../../_static/pygments.css?v=fa44fd50" />
     <link rel="stylesheet" type="text/css" href="../../../_static/classic.css?v=def86cc0" />
     <link rel="stylesheet" type="text/css" href="../../../_static/css/mbasic.css?v=957880af" />
     
-    <script src="../../../_static/documentation_options.js?v=1ed6394b"></script>
+    <script src="../../../_static/documentation_options.js?v=baaebd52"></script>
     <script src="../../../_static/doctools.js?v=9a2dae69"></script>
     <script src="../../../_static/sphinx_highlight.js?v=dc90522c"></script>
     
@@ -25,7 +25,7 @@
         <li class="right" >
           <a href="../../../py-modindex.html" title="Python Module Index"
              >modules</a> |</li>
-        <li class="nav-item nav-item-0"><a href="../../../index.html">PythonForWindows 1.0.2 documentation</a> &#187;</li>
+        <li class="nav-item nav-item-0"><a href="../../../index.html">PythonForWindows 1.0.3 documentation</a> &#187;</li>
           <li class="nav-item nav-item-1"><a href="../../index.html" accesskey="U">Module code</a> &#187;</li>
         <li class="nav-item nav-item-this"><a href="">windows.winobject.wmi</a></li> 
       </ul>
@@ -602,11 +602,11 @@
 <div class="viewcode-block" id="WmiManager">
 <a class="viewcode-back" href="../../../wmi.html#windows.winobject.wmi.WmiManager">[docs]</a>
 <span class="k">class</span> <span class="nc">WmiManager</span><span class="p">(</span><span class="nb">dict</span><span class="p">):</span>
-<span class="w">    </span><span class="sd">&quot;&quot;&quot;The main WMI class exposed, used to list and access differents WMI namespace, can be used as a dict to access</span>
+<span class="w">    </span><span class="sa">r</span><span class="sd">&quot;&quot;&quot;The main WMI class exposed, used to list and access differents WMI namespace, can be used as a dict to access</span>
 <span class="sd">    :class:`WmiNamespace` by name</span>
 
 <span class="sd">    Example:</span>
-<span class="sd">        &gt;&gt;&gt; windows.system.wmi[&quot;root\\SecurityCenter2&quot;]</span>
+<span class="sd">        &gt;&gt;&gt; windows.system.wmi[r&quot;root\SecurityCenter2&quot;]</span>
 <span class="sd">        &lt;WmiNamespace &quot;root\SecurityCenter2&quot;&gt;</span>
 <span class="sd">    &quot;&quot;&quot;</span>
     <span class="n">DEFAULT_NAMESPACE</span> <span class="o">=</span> <span class="s2">&quot;root</span><span class="se">\\</span><span class="s2">cimv2&quot;</span> <span class="c1">#: The default namespace for :func:`select` &amp; :func:`query`</span>
@@ -676,7 +676,7 @@
         <li class="right" >
           <a href="../../../py-modindex.html" title="Python Module Index"
              >modules</a> |</li>
-        <li class="nav-item nav-item-0"><a href="../../../index.html">PythonForWindows 1.0.2 documentation</a> &#187;</li>
+        <li class="nav-item nav-item-0"><a href="../../../index.html">PythonForWindows 1.0.3 documentation</a> &#187;</li>
           <li class="nav-item nav-item-1"><a href="../../index.html" >Module code</a> &#187;</li>
         <li class="nav-item nav-item-this"><a href="">windows.winobject.wmi</a></li> 
       </ul>

docs/build/html/_sources/sample.rst.txt

@@ -69,6 +69,20 @@ Output
 
 .. _token_sample:
 
+
+Microsoft Store Python Injection
+''''''''''''''''''''''''''''''''
+
+Python execution in remote process fails with Microsoft Store builds of pythons (`mspython`), as the interpreter DLLs do not grant execute to Users.
+This sample shows a workaround by user https://github.com/dariushoule by copying needed mspython files to a temporary directory and injecting those instead.
+
+.. literalinclude:: ..\..\samples\process\msstore_interpreter_remote_python.py
+
+Output
+
+.. literalinclude:: samples_output\process_msstore_interpreter_remote_python.txt
+
+
 Token
 """""
 

docs/build/html/_sources/windef_generated.rst.txt

@@ -152,6 +152,9 @@ WinDef
 .. autodata:: SORF_OXRES8
 .. autodata:: SORF_NULL
 .. autodata:: SORF_NOPING
+.. autodata:: UNIQUE_FLAG_PADDING
+.. autodata:: MAINHDRSIG
+.. autodata:: ENTRYHDRSIG
 .. autodata:: CWCSTORAGENAME
 .. autodata:: STGM_DIRECT
 .. autodata:: STGM_TRANSACTED
@@ -496,6 +499,15 @@ WinDef
 .. autodata:: ERROR_SEVERITY_INFORMATIONAL
 .. autodata:: ERROR_SEVERITY_WARNING
 .. autodata:: ERROR_SEVERITY_ERROR
+.. autodata:: FACILITY_WINDOWS
+.. autodata:: FACILITY_WIN32
+.. autodata:: FACILITY_STORAGE
+.. autodata:: FACILITY_RPC
+.. autodata:: FACILITY_NULL
+.. autodata:: FACILITY_ITF
+.. autodata:: FACILITY_DISPATCH
+.. autodata:: STATUS_SEVERITY_SUCCESS
+.. autodata:: STATUS_SEVERITY_COERROR
 .. autodata:: EVENT_TRACE_FLAG_DISPATCHER
 .. autodata:: EVENT_TRACE_FLAG_VIRTUAL_ALLOC
 .. autodata:: EVENT_TRACE_FLAG_VAMAP
@@ -1133,6 +1145,89 @@ WinDef
 .. autodata:: NMPWAIT_WAIT_FOREVER
 .. autodata:: NMPWAIT_NOWAIT
 .. autodata:: NMPWAIT_USE_DEFAULT_WAIT
+.. autodata:: ProcThreadAttributeParentProcess
+.. autodata:: ProcThreadAttributeExtendedFlags
+.. autodata:: ProcThreadAttributeHandleList
+.. autodata:: ProcThreadAttributeGroupAffinity
+.. autodata:: ProcThreadAttributePreferredNode
+.. autodata:: ProcThreadAttributeIdealProcessor
+.. autodata:: ProcThreadAttributeUmsThread
+.. autodata:: ProcThreadAttributeMitigationPolicy
+.. autodata:: ProcThreadAttributePackageFullName
+.. autodata:: ProcThreadAttributeSecurityCapabilities
+.. autodata:: ProcThreadAttributeConsoleReference
+.. autodata:: ProcThreadAttributeProtectionLevel
+.. autodata:: ProcThreadAttributeOsMaxVersionTested
+.. autodata:: ProcThreadAttributeJobList
+.. autodata:: ProcThreadAttributeChildProcessPolicy
+.. autodata:: ProcThreadAttributeAllApplicationPackagesPolicy
+.. autodata:: ProcThreadAttributeWin32kFilter
+.. autodata:: ProcThreadAttributeSafeOpenPromptOriginClaim
+.. autodata:: ProcThreadAttributeDesktopAppPolicy
+.. autodata:: ProcThreadAttributeBnoIsolation
+.. autodata:: ProcThreadAttributePseudoConsole
+.. autodata:: ProcThreadAttributeIsolationManifest
+.. autodata:: ProcThreadAttributeMitigationAuditPolicy
+.. autodata:: ProcThreadAttributeMachineType
+.. autodata:: ProcThreadAttributeComponentFilter
+.. autodata:: ProcThreadAttributeEnableOptionalXStateFeatures
+.. autodata:: ProcThreadAttributeCreateStore
+.. autodata:: ProcThreadAttributeTrustedApp
+.. autodata:: ProcThreadAttributeSveVectorLength
+.. autodata:: PROC_THREAD_ATTRIBUTE_NUMBER
+.. autodata:: PROC_THREAD_ATTRIBUTE_THREAD
+.. autodata:: PROC_THREAD_ATTRIBUTE_INPUT
+.. autodata:: PROC_THREAD_ATTRIBUTE_ADDITIVE
+.. autodata:: PROC_THREAD_ATTRIBUTE_PARENT_PROCESS
+.. autodata:: PROC_THREAD_ATTRIBUTE_HANDLE_LIST
+.. autodata:: PROC_THREAD_ATTRIBUTE_GROUP_AFFINITY
+.. autodata:: PROC_THREAD_ATTRIBUTE_PREFERRED_NODE
+.. autodata:: PROC_THREAD_ATTRIBUTE_IDEAL_PROCESSOR
+.. autodata:: PROC_THREAD_ATTRIBUTE_UMS_THREAD
+.. autodata:: PROC_THREAD_ATTRIBUTE_MITIGATION_POLICY
+.. autodata:: PROC_THREAD_ATTRIBUTE_SECURITY_CAPABILITIES
+.. autodata:: PROC_THREAD_ATTRIBUTE_PROTECTION_LEVEL
+.. autodata:: PROC_THREAD_ATTRIBUTE_PSEUDOCONSOLE
+.. autodata:: PROC_THREAD_ATTRIBUTE_MACHINE_TYPE
+.. autodata:: PROC_THREAD_ATTRIBUTE_ENABLE_OPTIONAL_XSTATE_FEATURES
+.. autodata:: PROC_THREAD_ATTRIBUTE_SVE_VECTOR_LENGTH
+.. autodata:: PROCESSOR_INTEL_386
+.. autodata:: PROCESSOR_INTEL_486
+.. autodata:: PROCESSOR_INTEL_PENTIUM
+.. autodata:: PROCESSOR_INTEL_IA64
+.. autodata:: PROCESSOR_MIPS_R4000
+.. autodata:: PROCESSOR_ALPHA_21064
+.. autodata:: PROCESSOR_PPC_601
+.. autodata:: PROCESSOR_PPC_603
+.. autodata:: PROCESSOR_PPC_604
+.. autodata:: PROCESSOR_PPC_620
+.. autodata:: PROCESSOR_HITACHI_SH3
+.. autodata:: PROCESSOR_HITACHI_SH3E
+.. autodata:: PROCESSOR_HITACHI_SH4
+.. autodata:: PROCESSOR_MOTOROLA_821
+.. autodata:: PROCESSOR_SHx_SH3
+.. autodata:: PROCESSOR_SHx_SH4
+.. autodata:: PROCESSOR_STRONGARM
+.. autodata:: PROCESSOR_ARM720
+.. autodata:: PROCESSOR_ARM820
+.. autodata:: PROCESSOR_ARM920
+.. autodata:: PROCESSOR_ARM_7TDMI
+.. autodata:: PROCESSOR_OPTIL
+.. autodata:: PROCESSOR_ARCHITECTURE_INTEL
+.. autodata:: PROCESSOR_ARCHITECTURE_MIPS
+.. autodata:: PROCESSOR_ARCHITECTURE_ALPHA
+.. autodata:: PROCESSOR_ARCHITECTURE_PPC
+.. autodata:: PROCESSOR_ARCHITECTURE_SHX
+.. autodata:: PROCESSOR_ARCHITECTURE_ARM
+.. autodata:: PROCESSOR_ARCHITECTURE_IA64
+.. autodata:: PROCESSOR_ARCHITECTURE_ALPHA64
+.. autodata:: PROCESSOR_ARCHITECTURE_MSIL
+.. autodata:: PROCESSOR_ARCHITECTURE_AMD64
+.. autodata:: PROCESSOR_ARCHITECTURE_IA32_ON_WIN64
+.. autodata:: PROCESSOR_ARCHITECTURE_NEUTRAL
+.. autodata:: PROCESSOR_ARCHITECTURE_ARM64
+.. autodata:: PROCESSOR_ARCHITECTURE_ARM32_ON_WIN64
+.. autodata:: PROCESSOR_ARCHITECTURE_UNKNOWN
 .. autodata:: HKEY_CLASSES_ROOT
 .. autodata:: HKEY_CURRENT_USER
 .. autodata:: HKEY_LOCAL_MACHINE
@@ -1754,6 +1849,45 @@ WinDef
 .. autodata:: SPC_FINANCIAL_CRITERIA_OBJID
 .. autodata:: SPC_LINK_OBJID
 .. autodata:: SPC_SIGINFO_OBJID
+.. autodata:: CONTEXT_I386
+.. autodata:: CONTEXT_AMD64
+.. autodata:: CONTEXT_ARM
+.. autodata:: CONTEXT_ARM64
+.. autodata:: CONTEXT_i386
+.. autodata:: CONTEXT_i486
+.. autodata:: WOW64_CONTEXT_i386
+.. autodata:: WOW64_CONTEXT_i486
+.. autodata:: CONTEXT_CONTROL
+.. autodata:: CONTEXT_INTEGER
+.. autodata:: CONTEXT_SEGMENTS
+.. autodata:: CONTEXT_FLOATING_POINT
+.. autodata:: CONTEXT_DEBUG_REGISTERS
+.. autodata:: CONTEXT_EXTENDED_REGISTERS
+.. autodata:: CONTEXT_FULL
+.. autodata:: CONTEXT_ALL
+.. autodata:: CONTEXT_XSTATE
+.. autodata:: WOW64_CONTEXT_CONTROL
+.. autodata:: WOW64_CONTEXT_INTEGER
+.. autodata:: WOW64_CONTEXT_SEGMENTS
+.. autodata:: WOW64_CONTEXT_FLOATING_POINT
+.. autodata:: WOW64_CONTEXT_DEBUG_REGISTERS
+.. autodata:: WOW64_CONTEXT_EXTENDED_REGISTERS
+.. autodata:: WOW64_CONTEXT_FULL
+.. autodata:: WOW64_CONTEXT_ALL
+.. autodata:: WOW64_CONTEXT_XSTATE
+.. autodata:: WOW64_CONTEXT_EXCEPTION_ACTIVE
+.. autodata:: WOW64_CONTEXT_SERVICE_ACTIVE
+.. autodata:: WOW64_CONTEXT_EXCEPTION_REQUEST
+.. autodata:: WOW64_CONTEXT_EXCEPTION_REPORTING
+.. autodata:: CONTEXT_ARM64_CONTROL
+.. autodata:: CONTEXT_ARM64_INTEGER
+.. autodata:: CONTEXT_ARM64_FLOATING_POINT
+.. autodata:: CONTEXT_ARM64_DEBUG_REGISTERS
+.. autodata:: CONTEXT_ARM64_X18
+.. autodata:: CONTEXT_UNWOUND_TO_CALL
+.. autodata:: CONTEXT_RET_TO_GUEST
+.. autodata:: ARM64_MAX_BREAKPOINTS
+.. autodata:: ARM64_MAX_WATCHPOINTS
 .. autodata:: FILE_VER_GET_LOCALISED
 .. autodata:: FILE_VER_GET_NEUTRAL
 .. autodata:: FILE_VER_GET_PREFETCHED
@@ -1865,19 +1999,6 @@ WinDef
 .. autodata:: TH32CS_SNAPMODULE32
 .. autodata:: TH32CS_SNAPALL
 .. autodata:: TH32CS_INHERIT
-.. autodata:: CONTEXT_I386
-.. autodata:: CONTEXT_AMD64
-.. autodata:: CONTEXT_ARM
-.. autodata:: CONTEXT_ARM64
-.. autodata:: CONTEXT_CONTROL
-.. autodata:: CONTEXT_INTEGER
-.. autodata:: CONTEXT_SEGMENTS
-.. autodata:: CONTEXT_FLOATING_POINT
-.. autodata:: CONTEXT_DEBUG_REGISTERS
-.. autodata:: CONTEXT_EXTENDED_REGISTERS
-.. autodata:: CONTEXT_FULL
-.. autodata:: CONTEXT_ALL
-.. autodata:: CONTEXT_XSTATE
 .. autodata:: PAGE_NOACCESS
 .. autodata:: PAGE_READONLY
 .. autodata:: PAGE_READWRITE
@@ -2910,6 +3031,7 @@ WinDef
 .. autodata:: IMAGE_FILE_MACHINE_M32R
 .. autodata:: IMAGE_FILE_MACHINE_CEE
 .. autodata:: IMAGE_FILE_MACHINE_ARM64
+.. autodata:: IMAGE_FILE_MACHINE_TARGET_HOST
 .. autodata:: CERT_QUERY_OBJECT_FILE
 .. autodata:: CERT_QUERY_OBJECT_BLOB
 .. autodata:: CERT_QUERY_CONTENT_CERT
@@ -3222,6 +3344,37 @@ WinDef
 .. autodata:: CRYPT_SGCKEY
 .. autodata:: CRYPT_ARCHIVABLE
 .. autodata:: CRYPT_FORCE_KEY_PROTECTION_HIGH
+.. autodata:: CERT_RDN_ANY_TYPE
+.. autodata:: CERT_RDN_ENCODED_BLOB
+.. autodata:: CERT_RDN_OCTET_STRING
+.. autodata:: CERT_RDN_NUMERIC_STRING
+.. autodata:: CERT_RDN_PRINTABLE_STRING
+.. autodata:: CERT_RDN_TELETEX_STRING
+.. autodata:: CERT_RDN_T61_STRING
+.. autodata:: CERT_RDN_VIDEOTEX_STRING
+.. autodata:: CERT_RDN_IA5_STRING
+.. autodata:: CERT_RDN_GRAPHIC_STRING
+.. autodata:: CERT_RDN_VISIBLE_STRING
+.. autodata:: CERT_RDN_ISO646_STRING
+.. autodata:: CERT_RDN_GENERAL_STRING
+.. autodata:: CERT_RDN_UNIVERSAL_STRING
+.. autodata:: CERT_RDN_INT4_STRING
+.. autodata:: CERT_RDN_BMP_STRING
+.. autodata:: CERT_RDN_UNICODE_STRING
+.. autodata:: CERT_RDN_UTF8_STRING
+.. autodata:: CERT_RDN_TYPE_MASK
+.. autodata:: CERT_RDN_FLAGS_MASK
+.. autodata:: CERT_RDN_ENABLE_T61_UNICODE_FLAG
+.. autodata:: CERT_RDN_ENABLE_UTF8_UNICODE_FLAG
+.. autodata:: CERT_RDN_FORCE_UTF8_UNICODE_FLAG
+.. autodata:: CERT_RDN_DISABLE_CHECK_TYPE_FLAG
+.. autodata:: CERT_RDN_DISABLE_IE4_UTF8_FLAG
+.. autodata:: CRYPT_DECODE_NOCOPY_FLAG
+.. autodata:: CRYPT_DECODE_TO_BE_SIGNED_FLAG
+.. autodata:: CRYPT_DECODE_SHARE_OID_STRING_FLAG
+.. autodata:: CRYPT_DECODE_NO_SIGNATURE_BYTE_REVERSAL_FLAG
+.. autodata:: CRYPT_DECODE_ALLOC_FLAG
+.. autodata:: CRYPT_UNICODE_NAME_DECODE_DISABLE_IE4_UTF8_FLAG
 .. autodata:: CRYPT_ENCODE_DECODE_NONE
 .. autodata:: X509_CERT
 .. autodata:: X509_CERT_TO_BE_SIGNED
@@ -3360,6 +3513,10 @@ WinDef
 .. autodata:: CMSG_CTRL_VERIFY_SIGNATURE_EX
 .. autodata:: CMSG_CTRL_ADD_CMS_SIGNER_INFO
 .. autodata:: CMSG_CTRL_ENABLE_STRONG_SIGNATURE
+.. autodata:: CERT_SET_KEY_PROV_HANDLE_PROP_ID
+.. autodata:: CERT_SET_KEY_CONTEXT_PROP_ID
+.. autodata:: CERT_NCRYPT_KEY_SPEC
+.. autodata:: CERT_REQUEST_V1
 .. autodata:: WSADESCRIPTION_LEN
 .. autodata:: WSASYS_STATUS_LEN
 .. autodata:: WSAPROTOCOL_LEN

docs/build/html/_sources/winfuncs_generated.rst.txt

@@ -326,6 +326,10 @@ Functions
 
 .. function:: CertCloseStore(hCertStore, dwFlags)
 
+.. function:: CryptSignAndEncodeCertificate(hBCryptKey, dwKeySpec, dwCertEncodingType, lpszStructType, pvStructInfo, pSignatureAlgorithm, pvHashAuxInfo, pbEncoded, pcbEncoded)
+
+.. function:: CryptSignCertificate(hBCryptKey, dwKeySpec, dwCertEncodingType, pbEncodedToBeSigned, cbEncodedToBeSigned, pSignatureAlgorithm, pvHashAuxInfo, pbSignature, pcbSignature)
+
 .. function:: OpenVirtualDisk(VirtualStorageType, Path, VirtualDiskAccessMask, Flags, Parameters, Handle)
 
 .. function:: AttachVirtualDisk(VirtualDiskHandle, SecurityDescriptor, Flags, ProviderSpecificFlags, Parameters, Overlapped)
@@ -592,6 +596,10 @@ Functions
 
 .. function:: UnmapViewOfFile(lpBaseAddress)
 
+.. function:: NCryptOpenKey(hProvider, phKey, pszKeyName, dwLegacyKeySpec, dwFlags)
+
+.. function:: NCryptOpenStorageProvider(phProvider, pszProviderName, dwFlags)
+
 .. function:: NetQueryDisplayInformation(ServerName, Level, Index, EntriesRequested, PreferredMaximumLength, ReturnedEntryCount, SortedBuffer)
 
 .. function:: NetUserEnum(servername, level, filter, bufptr, prefmaxlen, entriesread, totalentries, resume_handle)
@@ -696,6 +704,12 @@ Functions
 
 .. function:: FreeLibrary(hLibModule)
 
+.. function:: GetProcessInformation(hProcess, ProcessInformationClass, ProcessInformation, ProcessInformationSize)
+
+.. function:: SetProcessInformation(hProcess, ProcessInformationClass, ProcessInformation, ProcessInformationSize)
+
+.. function:: RtlGetCurrentPeb()
+
 .. function:: RegQueryValueExA(hKey, lpValueName, lpReserved, lpType, lpData, lpcbData)
 
 .. function:: RegQueryValueExW(hKey, lpValueName, lpReserved, lpType, lpData, lpcbData)
@@ -1212,6 +1226,42 @@ Functions
 
 .. function:: LookupAccountNameW(lpSystemName, lpAccountName, Sid, cbSid, ReferencedDomainName, cchReferencedDomainName, peUse)
 
+.. function:: GetNativeSystemInfo(lpSystemInfo)
+
+.. function:: GetSystemInfo(lpSystemInfo)
+
+.. function:: IsWow64Process(hProcess, Wow64Process)
+
+.. function:: IsWow64Process2(hProcess, pProcessMachine, pNativeMachine)
+
+.. function:: IsWow64GuestMachineSupported(WowGuestMachine, MachineIsSupported)
+
+.. function:: GetSystemWow64DirectoryA(lpBuffer, uSize)
+
+.. function:: GetSystemWow64DirectoryW(lpBuffer, uSize)
+
+.. function:: GetSystemWow64Directory2A(lpBuffer, uSize, ImageFileMachineType)
+
+.. function:: GetSystemWow64Directory2W(lpBuffer, uSize, ImageFileMachineType)
+
+.. function:: Wow64DisableWow64FsRedirection(OldValue)
+
+.. function:: Wow64EnableWow64FsRedirection(Wow64FsEnableRedirection)
+
+.. function:: Wow64RevertWow64FsRedirection(OlValue)
+
+.. function:: Wow64GetThreadContext(hThread, lpContext)
+
+.. function:: Wow64SetThreadContext(hThread, lpContext)
+
+.. function:: Wow64SetThreadDefaultGuestMachine(Machine)
+
+.. function:: Wow64SuspendThread(hThread)
+
+.. function:: NtWow64ReadVirtualMemory64(hProcess, lpBaseAddress, lpBuffer, nSize, lpNumberOfBytesRead)
+
+.. function:: NtWow64WriteVirtualMemory64(hProcess, lpBaseAddress, lpBuffer, nSize, lpNumberOfBytesWritten)
+
 .. function:: FileTimeToSystemTime(lpFileTime, lpSystemTime)
 
 .. function:: SystemTimeToFileTime(lpSystemTime, lpFileTime)
@@ -1348,6 +1398,8 @@ Functions
 
 .. function:: CreateRemoteThread(hProcess, lpThreadAttributes, dwStackSize, lpStartAddress, lpParameter, dwCreationFlags, lpThreadId)
 
+.. function:: CreateRemoteThreadEx(hProcess, lpThreadAttributes, dwStackSize, lpStartAddress, lpParameter, dwCreationFlags, lpAttributeList, lpThreadId)
+
 .. function:: CreateProcessA(lpApplicationName, lpCommandLine, lpProcessAttributes, lpThreadAttributes, bInheritHandles, dwCreationFlags, lpEnvironment, lpCurrentDirectory, lpStartupInfo, lpProcessInformation)
 
 .. function:: CreateProcessW(lpApplicationName, lpCommandLine, lpProcessAttributes, lpThreadAttributes, bInheritHandles, dwCreationFlags, lpEnvironment, lpCurrentDirectory, lpStartupInfo, lpProcessInformation)
@@ -1368,12 +1420,8 @@ Functions
 
 .. function:: ReadProcessMemory(hProcess, lpBaseAddress, lpBuffer, nSize, lpNumberOfBytesRead)
 
-.. function:: NtWow64ReadVirtualMemory64(hProcess, lpBaseAddress, lpBuffer, nSize, lpNumberOfBytesRead)
-
 .. function:: WriteProcessMemory(hProcess, lpBaseAddress, lpBuffer, nSize, lpNumberOfBytesWritten)
 
-.. function:: NtWow64WriteVirtualMemory64(hProcess, lpBaseAddress, lpBuffer, nSize, lpNumberOfBytesWritten)
-
 .. function:: GetCurrentProcess()
 
 .. function:: CreateFileA(lpFileName, dwDesiredAccess, dwShareMode, lpSecurityAttributes, dwCreationDisposition, dwFlagsAndAttributes, hTemplateFile)
@@ -1466,14 +1514,6 @@ Functions
 
 .. function:: DeviceIoControl(hDevice, dwIoControlCode, lpInBuffer, nInBufferSize, lpOutBuffer, nOutBufferSize, lpBytesReturned, lpOverlapped)
 
-.. function:: Wow64DisableWow64FsRedirection(OldValue)
-
-.. function:: Wow64RevertWow64FsRedirection(OldValue)
-
-.. function:: Wow64EnableWow64FsRedirection(Wow64FsEnableRedirection)
-
-.. function:: Wow64GetThreadContext(hThread, lpContext)
-
 .. function:: SetConsoleCtrlHandler(HandlerRoutine, Add)
 
 .. function:: GlobalAlloc(uFlags, dwBytes)
@@ -1528,8 +1568,6 @@ Functions
 
 .. function:: GetProcessId(Process)
 
-.. function:: Wow64SetThreadContext(hThread, lpContext)
-
 .. function:: GetMappedFileNameW(hProcess, lpv, lpFilename, nSize)
 
 .. function:: GetMappedFileNameA(hProcess, lpv, lpFilename, nSize)

docs/build/html/crypto.html

@@ -375,6 +375,13 @@ See <a class="reference external" href="https://msdn.microsoft.com/en-us/library
 (see <a class="reference external" href="https://msdn.microsoft.com/en-us/library/windows/desktop/aa388136(v=vs.85).aspx">System Store Locations</a>)</p>
 </dd></dl>
 
+<dl class="py method">
+<dt class="sig sig-object py" id="windows.crypto.CertificateStore.from_user_store">
+<em class="property"><span class="pre">classmethod</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">from_user_store</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">store_name</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">user</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">True</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/crypto/certificate.html#CertificateStore.from_user_store"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.crypto.CertificateStore.from_user_store" title="Link to this definition">¶</a></dt>
+<dd><p>Create a new <a class="reference internal" href="#windows.crypto.CertificateStore" title="windows.crypto.CertificateStore"><code class="xref py py-class docutils literal notranslate"><span class="pre">CertificateStore</span></code></a> from system store <code class="docutils literal notranslate"><span class="pre">store_name</span></code>
+(see <a class="reference external" href="https://msdn.microsoft.com/en-us/library/windows/desktop/aa388136(v=vs.85).aspx">System Store Locations</a>)</p>
+</dd></dl>
+
 <dl class="py method">
 <dt class="sig sig-object py" id="windows.crypto.CertificateStore.new_in_memory">
 <em class="property"><span class="pre">classmethod</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">new_in_memory</span></span><span class="sig-paren">(</span><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/crypto/certificate.html#CertificateStore.new_in_memory"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.crypto.CertificateStore.new_in_memory" title="Link to this definition">¶</a></dt>
@@ -665,6 +672,7 @@ See <a class="reference external" href="https://msdn.microsoft.com/en-us/library
 <li><a class="reference internal" href="#windows.crypto.CertificateStore.from_file"><code class="docutils literal notranslate"><span class="pre">from_file()</span></code></a></li>
 <li><a class="reference internal" href="#windows.crypto.CertificateStore.from_param"><code class="docutils literal notranslate"><span class="pre">from_param()</span></code></a></li>
 <li><a class="reference internal" href="#windows.crypto.CertificateStore.from_system_store"><code class="docutils literal notranslate"><span class="pre">from_system_store()</span></code></a></li>
+<li><a class="reference internal" href="#windows.crypto.CertificateStore.from_user_store"><code class="docutils literal notranslate"><span class="pre">from_user_store()</span></code></a></li>
 <li><a class="reference internal" href="#windows.crypto.CertificateStore.new_in_memory"><code class="docutils literal notranslate"><span class="pre">new_in_memory()</span></code></a></li>
 <li><a class="reference internal" href="#windows.crypto.CertificateStore.value"><code class="docutils literal notranslate"><span class="pre">value</span></code></a></li>
 </ul>

docs/build/html/debug.html

@@ -1050,7 +1050,7 @@ This can be completly virtual (particularly in the case of <a class="reference i
 <dt>Exemple:</dt><dd><div class="doctest highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">&gt;&gt;&gt; </span><span class="n">sh</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">debug</span><span class="o">.</span><span class="n">symbols</span><span class="o">.</span><span class="n">VirtualSymbolHandler</span><span class="p">()</span>
 <span class="gp">&gt;&gt;&gt; </span><span class="n">mod</span> <span class="o">=</span> <span class="n">sh</span><span class="o">.</span><span class="n">load_file</span><span class="p">(</span><span class="sa">r</span><span class="s2">&quot;c:\windows\system32\kernelbase.dll&quot;</span><span class="p">)</span>
 <span class="gp">&gt;&gt;&gt; </span><span class="n">mod</span><span class="o">.</span><span class="n">pdb</span>
-<span class="go">&#39;d:\symbols\wkernelbase.pdb\017FA9C5278235B7E6BFBA74A9A5AAD91\wkernelbase.pdb&#39;</span>
+<span class="go">&#39;d:\\symbols\\wkernelbase.pdb\\017FA9C5278235B7E6BFBA74A9A5AAD91\\wkernelbase.pdb&#39;</span>
 </pre></div>
 </div>
 </dd>

docs/build/html/object_manager.html

@@ -101,7 +101,7 @@
 <span class="go">&lt;KernelObject &quot;\Windows&quot; (type=&quot;Directory&quot;)&gt;</span>
 <span class="gp">&gt;&gt;&gt; </span><span class="n">obj</span><span class="p">[</span><span class="s2">&quot;WindowStations&quot;</span><span class="p">][</span><span class="s2">&quot;WinSta0&quot;</span><span class="p">]</span>
 <span class="go">&lt;KernelObject &quot;\Windows\WindowStations&quot; (type=&quot;Directory&quot;)&gt;</span>
-<span class="gp">&gt;&gt;&gt; </span><span class="n">obj</span><span class="p">[</span><span class="s2">&quot;WindowStations\WinSta0&quot;</span><span class="p">]</span>
+<span class="gp">&gt;&gt;&gt; </span><span class="n">obj</span><span class="p">[</span><span class="sa">r</span><span class="s2">&quot;WindowStations</span><span class="se">\\</span><span class="s2">WinSta0&quot;</span><span class="p">]</span>
 <span class="go">&lt;KernelObject &quot;\Windows\WindowStations&quot; (type=&quot;Directory&quot;)&gt;</span>
 </pre></div>
 </div>

docs/build/html/process.html

@@ -189,6 +189,17 @@
 </dl>
 </dd></dl>
 
+<dl class="py property">
+<dt class="sig sig-object py" id="windows.winobject.process.CurrentProcess.name">
+<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">name</span></span><a class="headerlink" href="#windows.winobject.process.CurrentProcess.name" title="Link to this definition">¶</a></dt>
+<dd><p>Name of the process</p>
+<dl class="field-list simple">
+<dt class="field-odd">Type<span class="colon">:</span></dt>
+<dd class="field-odd"><p><code class="xref py py-class docutils literal notranslate"><span class="pre">str</span></code></p>
+</dd>
+</dl>
+</dd></dl>
+
 <dl class="py method">
 <dt class="sig sig-object py" id="windows.winobject.process.CurrentProcess.open_token">
 <span class="sig-name descname"><span class="pre">open_token</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">flags</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">MAXIMUM_ALLOWED(0x2000000)</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.CurrentProcess.open_token" title="Link to this definition">¶</a></dt>
@@ -346,7 +357,7 @@
 
 <dl class="py method">
 <dt class="sig sig-object py" id="windows.winobject.process.CurrentProcess.virtual_alloc">
-<span class="sig-name descname"><span class="pre">virtual_alloc</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">size</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">prot</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">PAGE_EXECUTE_READWRITE(0x40)</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/process.html#CurrentProcess.virtual_alloc"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.winobject.process.CurrentProcess.virtual_alloc" title="Link to this definition">¶</a></dt>
+<span class="sig-name descname"><span class="pre">virtual_alloc</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">size</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">prot</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">PAGE_EXECUTE_READWRITE(0x40)</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">addr</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">None</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">type</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">MEM_COMMIT(0x1000)</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/process.html#CurrentProcess.virtual_alloc"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.winobject.process.CurrentProcess.virtual_alloc" title="Link to this definition">¶</a></dt>
 <dd><p>Allocate memory in the process</p>
 <dl class="field-list simple">
 <dt class="field-odd">Returns<span class="colon">:</span></dt>
@@ -583,7 +594,7 @@ raises an exception if the remote thread raised one</p>
 <div class="admonition note">
 <p class="admonition-title">Note</p>
 <p>This method is incompatible with Microsoft Store builds of python, as the interpreter DLLs do not grant execute to Users.
-See workaround:  <a class="reference external" href="https://github.com/hakril/PythonForWindows/tree/master/samples/process/msstore_interpreter_remote_python.py">https://github.com/hakril/PythonForWindows/tree/master/samples/process/msstore_interpreter_remote_python.py</a></p>
+See workaround:  <a class="reference external" href="https://hakril.github.io/PythonForWindows/build/html/sample.html#microsoft-store-python-injection">https://hakril.github.io/PythonForWindows/build/html/sample.html#microsoft-store-python-injection</a></p>
 </div>
 </dd></dl>
 
@@ -604,7 +615,7 @@ See workaround:  <a class="reference external" href="https://github.com/hakril/P
 <div class="admonition note">
 <p class="admonition-title">Note</p>
 <p>This method is incompatible with Microsoft Store builds of python, as the interpreter DLLs do not grant execute to Users.
-See workaround:  <a class="reference external" href="https://github.com/hakril/PythonForWindows/tree/master/samples/process/msstore_interpreter_remote_python.py">https://github.com/hakril/PythonForWindows/tree/master/samples/process/msstore_interpreter_remote_python.py</a></p>
+See workaround:  <a class="reference external" href="https://hakril.github.io/PythonForWindows/build/html/sample.html#microsoft-store-python-injection">https://hakril.github.io/PythonForWindows/build/html/sample.html#microsoft-store-python-injection</a></p>
 </div>
 </dd></dl>
 
@@ -731,7 +742,7 @@ See workaround:  <a class="reference external" href="https://github.com/hakril/P
 <dl class="py property">
 <dt class="sig sig-object py" id="windows.winobject.process.WinProcess.peb_addr">
 <em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">peb_addr</span></span><a class="headerlink" href="#windows.winobject.process.WinProcess.peb_addr" title="Link to this definition">¶</a></dt>
-<dd><p>The address of the PEB</p>
+<dd><p>The address of the PEB.</p>
 <dl class="field-list simple">
 <dt class="field-odd">Type<span class="colon">:</span></dt>
 <dd class="field-odd"><p><code class="xref py py-class docutils literal notranslate"><span class="pre">int</span></code></p>
@@ -885,7 +896,7 @@ See workaround:  <a class="reference external" href="https://github.com/hakril/P
 
 <dl class="py method">
 <dt class="sig sig-object py" id="windows.winobject.process.WinProcess.virtual_alloc">
-<span class="sig-name descname"><span class="pre">virtual_alloc</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">size</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">prot</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">PAGE_EXECUTE_READWRITE(0x40)</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">addr</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">None</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/process.html#WinProcess.virtual_alloc"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.winobject.process.WinProcess.virtual_alloc" title="Link to this definition">¶</a></dt>
+<span class="sig-name descname"><span class="pre">virtual_alloc</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">size</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">prot</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">PAGE_EXECUTE_READWRITE(0x40)</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">addr</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">None</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">type</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">MEM_COMMIT(0x1000)</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/process.html#WinProcess.virtual_alloc"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.winobject.process.WinProcess.virtual_alloc" title="Link to this definition">¶</a></dt>
 <dd><p>Allocate memory in the process</p>
 <dl class="field-list simple">
 <dt class="field-odd">Returns<span class="colon">:</span></dt>
@@ -1452,6 +1463,18 @@ The behavior should match the non-exported function <code class="docutils litera
 <dt class="sig sig-object py" id="windows.pe_parse.PEFile">
 <em class="property"><span class="pre">class</span><span class="w"> </span></em><span class="sig-prename descclassname"><span class="pre">windows.pe_parse.</span></span><span class="sig-name descname"><span class="pre">PEFile</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">target</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">baseaddr</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">targetedbitness</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">transformers</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/pe_parse.html#PEFile"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.pe_parse.PEFile" title="Link to this definition">¶</a></dt>
 <dd><p>Represent a PE loaded in a process (current or remote)</p>
+<dl class="py property">
+<dt class="sig sig-object py" id="windows.pe_parse.PEFile.binid">
+<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">binid</span></span><a class="headerlink" href="#windows.pe_parse.PEFile.binid" title="Link to this definition">¶</a></dt>
+<dd><p>Return the hex-string {TimeStamp}{SizeOfCode} used by PDB to identify a PE.</p>
+<p>I do not know the official name of this value…</p>
+<dl class="field-list simple">
+<dt class="field-odd">Type<span class="colon">:</span></dt>
+<dd class="field-odd"><p><code class="xref py py-class docutils literal notranslate"><span class="pre">str</span></code></p>
+</dd>
+</dl>
+</dd></dl>
+
 <dl class="py property">
 <dt class="sig sig-object py" id="windows.pe_parse.PEFile.export_name">
 <em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">export_name</span></span><a class="headerlink" href="#windows.pe_parse.PEFile.export_name" title="Link to this definition">¶</a></dt>
@@ -1590,6 +1613,7 @@ You MUST keep a reference to the hook while the hook is enabled.</p>
 <li><a class="reference internal" href="#windows.winobject.process.CurrentProcess.is_wow_64"><code class="docutils literal notranslate"><span class="pre">is_wow_64</span></code></a></li>
 <li><a class="reference internal" href="#windows.winobject.process.CurrentProcess.load_library"><code class="docutils literal notranslate"><span class="pre">load_library()</span></code></a></li>
 <li><a class="reference internal" href="#windows.winobject.process.CurrentProcess.memory_state"><code class="docutils literal notranslate"><span class="pre">memory_state()</span></code></a></li>
+<li><a class="reference internal" href="#windows.winobject.process.CurrentProcess.name"><code class="docutils literal notranslate"><span class="pre">name</span></code></a></li>
 <li><a class="reference internal" href="#windows.winobject.process.CurrentProcess.open_token"><code class="docutils literal notranslate"><span class="pre">open_token()</span></code></a></li>
 <li><a class="reference internal" href="#windows.winobject.process.CurrentProcess.peb"><code class="docutils literal notranslate"><span class="pre">peb</span></code></a></li>
 <li><a class="reference internal" href="#windows.winobject.process.CurrentProcess.peb_syswow"><code class="docutils literal notranslate"><span class="pre">peb_syswow</span></code></a></li>
@@ -1774,6 +1798,7 @@ You MUST keep a reference to the hook while the hook is enabled.</p>
 <li><a class="reference internal" href="#windows.pe_parse.GetPEFile"><code class="docutils literal notranslate"><span class="pre">GetPEFile()</span></code></a></li>
 <li><a class="reference internal" href="#pefile">2.3.1.1. PEFile</a><ul>
 <li><a class="reference internal" href="#windows.pe_parse.PEFile"><code class="docutils literal notranslate"><span class="pre">PEFile</span></code></a><ul>
+<li><a class="reference internal" href="#windows.pe_parse.PEFile.binid"><code class="docutils literal notranslate"><span class="pre">binid</span></code></a></li>
 <li><a class="reference internal" href="#windows.pe_parse.PEFile.export_name"><code class="docutils literal notranslate"><span class="pre">export_name</span></code></a></li>
 <li><a class="reference internal" href="#windows.pe_parse.PEFile.exports"><code class="docutils literal notranslate"><span class="pre">exports</span></code></a></li>
 <li><a class="reference internal" href="#windows.pe_parse.PEFile.imports"><code class="docutils literal notranslate"><span class="pre">imports</span></code></a></li>

docs/build/html/rpc.html

@@ -447,7 +447,7 @@ an attribute <code class="docutils literal notranslate"><span class="pre">MEMBER
 <h3><span class="section-number">13.3.1. </span>NDR STREAM<a class="headerlink" href="#ndr-stream" title="Link to this heading">¶</a></h3>
 <dl class="py class">
 <dt class="sig sig-object py" id="windows.rpc.ndr.NdrStream">
-<em class="property"><span class="pre">class</span><span class="w"> </span></em><span class="sig-prename descclassname"><span class="pre">windows.rpc.ndr.</span></span><span class="sig-name descname"><span class="pre">NdrStream</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">data</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/rpc/ndr.html#NdrStream"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.rpc.ndr.NdrStream" title="Link to this definition">¶</a></dt>
+<em class="property"><span class="pre">class</span><span class="w"> </span></em><span class="sig-prename descclassname"><span class="pre">windows.rpc.ndr.</span></span><span class="sig-name descname"><span class="pre">NdrStream</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">data</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">use_memoryview</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">False</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/rpc/ndr.html#NdrStream"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.rpc.ndr.NdrStream" title="Link to this definition">¶</a></dt>
 <dd><p>A stream of bytes used for NDR unpacking</p>
 <dl class="py method">
 <dt class="sig sig-object py" id="windows.rpc.ndr.NdrStream.align">

docs/build/html/sample.html

@@ -473,9 +473,182 @@ Sections: [<PESection ".text">, <PESection ".rdata"
 </pre></div>
 </div>
 </section>
+<section id="microsoft-store-python-injection">
+<span id="token-sample"></span><h3><span class="section-number">18.1.6. </span>Microsoft Store Python Injection<a class="headerlink" href="#microsoft-store-python-injection" title="Link to this heading">¶</a></h3>
+<p>Python execution in remote process fails with Microsoft Store builds of pythons (<cite>mspython</cite>), as the interpreter DLLs do not grant execute to Users.
+This sample shows a workaround by user <a class="reference external" href="https://github.com/dariushoule">https://github.com/dariushoule</a> by copying needed mspython files to a temporary directory and injecting those instead.</p>
+<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="c1"># Some python interpreters run in environments with restrictive ACLs (no Users/* execute) on bundled DLLs.</span>
+<span class="c1"># The Microsoft Store version of python is the prime example of this.</span>
+<span class="c1">#</span>
+<span class="c1"># Remote execution of python is still possible by creating a minimal set of the dependencies outside of the restricted directory.</span>
+<span class="c1">#</span>
+<span class="c1"># This can be very helpful when operating PFW in environments with restrive GPOs / AppLocker.</span>
+
+
+<span class="kn">import</span> <span class="nn">ctypes</span>
+<span class="kn">import</span> <span class="nn">glob</span>
+<span class="kn">import</span> <span class="nn">os</span>
+<span class="kn">import</span> <span class="nn">shutil</span>
+<span class="kn">import</span> <span class="nn">tempfile</span>
+<span class="kn">import</span> <span class="nn">time</span>
+<span class="kn">import</span> <span class="nn">sys</span>
+<span class="kn">import</span> <span class="nn">struct</span>
+
+<span class="kn">import</span> <span class="nn">windows</span>
+<span class="kn">from</span> <span class="nn">windows.generated_def.ntstatus</span> <span class="kn">import</span> <span class="n">STATUS_THREAD_IS_TERMINATING</span>
+<span class="kn">from</span> <span class="nn">windows.generated_def.windef</span> <span class="kn">import</span> <span class="n">CREATE_SUSPENDED</span>
+<span class="kn">from</span> <span class="nn">windows.generated_def.winstructs</span> <span class="kn">import</span> <span class="n">PROCESS_INFORMATION</span><span class="p">,</span> <span class="n">STARTUPINFOW</span>
+<span class="kn">from</span> <span class="nn">windows.injection</span> <span class="kn">import</span> <span class="n">RemotePythonError</span><span class="p">,</span> \
+    <span class="n">find_python_dll_to_inject</span><span class="p">,</span> <span class="n">get_dll_name_from_python_version</span><span class="p">,</span> <span class="n">inject_python_command</span><span class="p">,</span> <span class="n">load_dll_in_remote_process</span><span class="p">,</span> <span class="n">retrieve_exc</span>
+
+
+<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Executable is: </span><span class="si">{0}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">sys</span><span class="o">.</span><span class="n">executable</span><span class="p">))</span>
+
+<span class="n">CACHE_DIR</span> <span class="o">=</span> <span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">join</span><span class="p">(</span><span class="n">tempfile</span><span class="o">.</span><span class="n">gettempdir</span><span class="p">(),</span> <span class="s1">&#39;pfw_dllcache&#39;</span><span class="p">)</span>
+<span class="n">INTERPRETER_DIR</span> <span class="o">=</span> <span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">dirname</span><span class="p">(</span><span class="n">find_python_dll_to_inject</span><span class="p">(</span><span class="mi">64</span><span class="p">))</span> <span class="c1"># Tailor bitness to your needs</span>
+
+
+<span class="k">def</span> <span class="nf">mspython_acl_workaround</span><span class="p">(</span><span class="n">target</span><span class="p">,</span> <span class="n">pydll_path</span><span class="p">):</span>
+<span class="w">    </span><span class="sd">&quot;&quot;&quot;</span>
+<span class="sd">    Works around mspython ACL restrictions on mspython interpreters</span>
+<span class="sd">    by copying the critical DLLs to a TEMP dir and orienting the interpreter</span>
+<span class="sd">    against that TEMP dir.</span>
+<span class="sd">    &quot;&quot;&quot;</span>
+
+    <span class="k">if</span> <span class="ow">not</span> <span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">exists</span><span class="p">(</span><span class="n">CACHE_DIR</span><span class="p">):</span>
+        <span class="n">os</span><span class="o">.</span><span class="n">mkdir</span><span class="p">(</span><span class="n">CACHE_DIR</span><span class="p">)</span>
+
+    <span class="k">for</span> <span class="n">dll</span> <span class="ow">in</span> <span class="p">[</span><span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">join</span><span class="p">(</span><span class="n">INTERPRETER_DIR</span><span class="p">,</span> <span class="s1">&#39;vcruntime140.dll&#39;</span><span class="p">),</span> <span class="n">pydll_path</span><span class="p">]:</span>
+        <span class="n">cache_dll_path</span> <span class="o">=</span> <span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">join</span><span class="p">(</span><span class="n">CACHE_DIR</span><span class="p">,</span> <span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">basename</span><span class="p">(</span><span class="n">dll</span><span class="p">))</span>
+        <span class="k">try</span><span class="p">:</span>
+            <span class="c1"># Creates a copy of the DLL without bringing over restrictive ACLs</span>
+            <span class="n">shutil</span><span class="o">.</span><span class="n">copyfile</span><span class="p">(</span><span class="n">dll</span><span class="p">,</span> <span class="n">cache_dll_path</span><span class="p">)</span>
+        <span class="k">except</span> <span class="ne">Exception</span> <span class="k">as</span> <span class="n">e</span><span class="p">:</span>
+            <span class="c1"># If its not writeable good chance these DLLs are just already loaded somewhere</span>
+            <span class="nb">print</span><span class="p">(</span><span class="n">e</span><span class="p">)</span>
+
+        <span class="c1"># Preloading python DLL and vcruntime so they don&#39;t get loaded from the path tree with restrictive ACLs</span>
+        <span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Injecting: </span><span class="si">{0}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">cache_dll_path</span><span class="p">))</span>
+        <span class="n">load_dll_in_remote_process</span><span class="p">(</span><span class="n">target</span><span class="p">,</span> <span class="n">cache_dll_path</span><span class="p">)</span>
+
+    <span class="k">for</span> <span class="n">dll</span> <span class="ow">in</span> <span class="n">glob</span><span class="o">.</span><span class="n">glob</span><span class="p">(</span><span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">join</span><span class="p">(</span><span class="n">INTERPRETER_DIR</span><span class="p">,</span> <span class="s1">&#39;dlls&#39;</span><span class="p">,</span> <span class="s1">&#39;*&#39;</span><span class="p">)):</span>
+        <span class="n">cache_dll_path</span> <span class="o">=</span> <span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">join</span><span class="p">(</span><span class="n">CACHE_DIR</span><span class="p">,</span> <span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">basename</span><span class="p">(</span><span class="n">dll</span><span class="p">))</span>
+        <span class="k">try</span><span class="p">:</span>
+            <span class="c1"># Dynamic lib DLLs with restrictive ACLs copied to unrestricted parent</span>
+            <span class="n">shutil</span><span class="o">.</span><span class="n">copyfile</span><span class="p">(</span><span class="n">dll</span><span class="p">,</span> <span class="n">cache_dll_path</span><span class="p">)</span>
+        <span class="k">except</span> <span class="ne">Exception</span> <span class="k">as</span> <span class="n">e</span><span class="p">:</span>
+            <span class="nb">print</span><span class="p">(</span><span class="n">e</span><span class="p">)</span>
+
+    <span class="n">target</span><span class="o">.</span><span class="n">_workaround_applied</span> <span class="o">=</span> <span class="kc">True</span>
+
+
+<span class="c1"># Adapted from windows\winobject\process.py</span>
+<span class="k">def</span> <span class="nf">execute_python_code</span><span class="p">(</span><span class="n">process</span><span class="p">,</span> <span class="n">code</span><span class="p">):</span>
+    <span class="n">py_dll_name</span> <span class="o">=</span> <span class="n">get_dll_name_from_python_version</span><span class="p">()</span>
+    <span class="n">pydll_path</span> <span class="o">=</span> <span class="n">find_python_dll_to_inject</span><span class="p">(</span><span class="n">process</span><span class="o">.</span><span class="n">bitness</span><span class="p">)</span>
+
+    <span class="k">if</span> <span class="ow">not</span> <span class="nb">getattr</span><span class="p">(</span><span class="n">process</span><span class="p">,</span> <span class="s2">&quot;_workaround_applied&quot;</span><span class="p">,</span> <span class="kc">None</span><span class="p">):</span>
+        <span class="n">mspython_acl_workaround</span><span class="p">(</span><span class="n">process</span><span class="p">,</span> <span class="n">pydll_path</span><span class="p">)</span>
+    <span class="n">shellcode</span><span class="p">,</span> <span class="n">pythoncode</span> <span class="o">=</span> <span class="n">inject_python_command</span><span class="p">(</span><span class="n">process</span><span class="p">,</span> <span class="n">code</span><span class="p">,</span> <span class="n">py_dll_name</span><span class="p">)</span>
+    <span class="n">t</span> <span class="o">=</span> <span class="n">process</span><span class="o">.</span><span class="n">create_thread</span><span class="p">(</span><span class="n">shellcode</span><span class="p">,</span> <span class="n">pythoncode</span><span class="p">)</span>
+    <span class="k">return</span> <span class="n">t</span>
+
+
+<span class="k">def</span> <span class="nf">safe_execute_python</span><span class="p">(</span><span class="n">process</span><span class="p">,</span> <span class="n">code</span><span class="p">):</span>
+    <span class="n">t</span> <span class="o">=</span> <span class="n">execute_python_code</span><span class="p">(</span><span class="n">process</span><span class="p">,</span> <span class="n">code</span><span class="p">)</span>
+    <span class="n">t</span><span class="o">.</span><span class="n">wait</span><span class="p">()</span> <span class="c1"># Wait termination of the thread</span>
+    <span class="k">if</span> <span class="n">t</span><span class="o">.</span><span class="n">exit_code</span> <span class="o">==</span> <span class="mi">0</span><span class="p">:</span>
+        <span class="k">return</span> <span class="kc">True</span>
+    <span class="k">if</span> <span class="n">t</span><span class="o">.</span><span class="n">exit_code</span> <span class="o">==</span> <span class="n">STATUS_THREAD_IS_TERMINATING</span> <span class="ow">or</span> <span class="n">process</span><span class="o">.</span><span class="n">is_exit</span><span class="p">:</span>
+        <span class="k">raise</span> <span class="ne">WindowsError</span><span class="p">(</span><span class="s2">&quot;</span><span class="si">{0}</span><span class="s2"> died during execution of python command&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">process</span><span class="p">))</span>
+    <span class="k">if</span> <span class="n">t</span><span class="o">.</span><span class="n">exit_code</span> <span class="o">!=</span> <span class="mh">0xffffffff</span><span class="p">:</span>
+        <span class="k">raise</span> <span class="ne">ValueError</span><span class="p">(</span><span class="s2">&quot;Unknown exit code </span><span class="si">{0}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="nb">hex</span><span class="p">(</span><span class="n">t</span><span class="o">.</span><span class="n">exit_code</span><span class="p">)))</span>
+    <span class="n">data</span> <span class="o">=</span> <span class="n">retrieve_last_exception_data</span><span class="p">(</span><span class="n">process</span><span class="p">)</span>
+    <span class="k">raise</span> <span class="n">RemotePythonError</span><span class="p">(</span><span class="n">data</span><span class="p">)</span>
+
+<span class="c1"># Adapted from windows\injection.py</span>
+<span class="k">def</span> <span class="nf">retrieve_last_exception_data</span><span class="p">(</span><span class="n">process</span><span class="p">):</span>
+    <span class="k">with</span> <span class="n">process</span><span class="o">.</span><span class="n">allocated_memory</span><span class="p">(</span><span class="mh">0x1000</span><span class="p">)</span> <span class="k">as</span> <span class="n">mem</span><span class="p">:</span>
+        <span class="n">execute_python_code</span><span class="p">(</span><span class="n">process</span><span class="p">,</span> <span class="n">retrieve_exc</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">mem</span><span class="p">))</span><span class="o">.</span><span class="n">wait</span><span class="p">()</span>
+        <span class="n">size</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">unpack</span><span class="p">(</span><span class="s2">&quot;&lt;I&quot;</span><span class="p">,</span> <span class="n">process</span><span class="o">.</span><span class="n">read_memory</span><span class="p">(</span><span class="n">mem</span><span class="p">,</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">ctypes</span><span class="o">.</span><span class="n">c_uint</span><span class="p">)))[</span><span class="mi">0</span><span class="p">]</span>
+        <span class="n">data</span> <span class="o">=</span> <span class="n">process</span><span class="o">.</span><span class="n">read_memory</span><span class="p">(</span><span class="n">mem</span> <span class="o">+</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">ctypes</span><span class="o">.</span><span class="n">c_uint</span><span class="p">),</span> <span class="n">size</span><span class="p">)</span>
+    <span class="k">return</span> <span class="n">data</span>
+
+<span class="c1"># First: show what happen when injecting mspython normally</span>
+<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Trying normal execute_python()&quot;</span><span class="p">)</span>
+<span class="n">proc1</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">utils</span><span class="o">.</span><span class="n">create_process</span><span class="p">(</span><span class="sa">r</span><span class="s2">&quot;C:\Windows\system32\winver.exe&quot;</span><span class="p">)</span>
+<span class="k">try</span><span class="p">:</span>
+    <span class="n">proc1</span><span class="o">.</span><span class="n">execute_python</span><span class="p">(</span><span class="s2">&quot;2 + 2 == 5&quot;</span><span class="p">)</span>
+<span class="k">except</span> <span class="ne">Exception</span> <span class="k">as</span> <span class="n">e</span><span class="p">:</span>
+    <span class="nb">print</span><span class="p">(</span><span class="s2">&quot;    Exception during proc1.execute_python():&quot;</span><span class="p">)</span>
+    <span class="nb">print</span><span class="p">(</span><span class="s2">&quot;    </span><span class="si">{0}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="nb">repr</span><span class="p">(</span><span class="n">e</span><span class="p">)))</span>
+<span class="n">proc1</span><span class="o">.</span><span class="n">exit</span><span class="p">()</span>
+
+<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Trying mspython workaround:&quot;</span><span class="p">)</span>
+<span class="n">proc_info</span> <span class="o">=</span> <span class="n">PROCESS_INFORMATION</span><span class="p">()</span>
+<span class="n">StartupInfo</span> <span class="o">=</span> <span class="n">STARTUPINFOW</span><span class="p">()</span>
+<span class="n">StartupInfo</span><span class="o">.</span><span class="n">cb</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">StartupInfo</span><span class="p">)</span>
+<span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">CreateProcessW</span><span class="p">(</span>
+    <span class="sa">r</span><span class="s2">&quot;C:\Windows\system32\winver.exe&quot;</span><span class="p">,</span>
+    <span class="n">dwCreationFlags</span><span class="o">=</span><span class="n">CREATE_SUSPENDED</span><span class="p">,</span>
+    <span class="c1"># Point PYTHONHOME to the interpreter dir so non-DLL libs can load</span>
+    <span class="c1"># Point PYTHONPATH to the newly created cache directory so DLL libs are loaded from there</span>
+    <span class="n">lpEnvironment</span><span class="o">=</span><span class="p">(</span><span class="s1">&#39;</span><span class="se">\0</span><span class="s1">&#39;</span><span class="o">.</span><span class="n">join</span><span class="p">(</span><span class="s1">&#39;</span><span class="si">{}</span><span class="s1">=</span><span class="si">{}</span><span class="s1">&#39;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">e</span><span class="p">,</span> <span class="n">v</span><span class="p">)</span> <span class="k">for</span> <span class="n">e</span><span class="p">,</span> <span class="n">v</span> <span class="ow">in</span> <span class="n">os</span><span class="o">.</span><span class="n">environ</span><span class="o">.</span><span class="n">items</span><span class="p">())</span> <span class="o">+</span> \
+                   <span class="s1">&#39;</span><span class="se">\0</span><span class="s1">PYTHONHOME=</span><span class="si">{}</span><span class="se">\0</span><span class="s1">PYTHONPATH=</span><span class="si">{}</span><span class="se">\0\0</span><span class="s1">&#39;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">INTERPRETER_DIR</span><span class="p">,</span> <span class="n">CACHE_DIR</span><span class="p">))</span><span class="o">.</span><span class="n">encode</span><span class="p">(),</span>
+    <span class="n">lpProcessInformation</span><span class="o">=</span><span class="n">ctypes</span><span class="o">.</span><span class="n">byref</span><span class="p">(</span><span class="n">proc_info</span><span class="p">),</span>
+    <span class="n">lpStartupInfo</span><span class="o">=</span><span class="n">ctypes</span><span class="o">.</span><span class="n">byref</span><span class="p">(</span><span class="n">StartupInfo</span><span class="p">))</span>
+
+<span class="n">process</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">winobject</span><span class="o">.</span><span class="n">process</span><span class="o">.</span><span class="n">WinProcess</span><span class="p">(</span><span class="n">pid</span><span class="o">=</span><span class="n">proc_info</span><span class="o">.</span><span class="n">dwProcessId</span><span class="p">,</span> <span class="n">handle</span><span class="o">=</span><span class="n">proc_info</span><span class="o">.</span><span class="n">hProcess</span><span class="p">)</span>
+
+<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;    Executing python code!&quot;</span><span class="p">)</span>
+<span class="n">safe_execute_python</span><span class="p">(</span><span class="n">process</span><span class="p">,</span> <span class="s2">&quot;&quot;&quot;</span>
+<span class="s2">import windows</span>
+<span class="s2">windows.utils.create_console()</span>
+<span class="s2">print(&#39;hello from inside the suspended process!&#39;, flush=True)</span>
+<span class="s2">&quot;&quot;&quot;</span><span class="p">)</span>
+
+<span class="n">process</span><span class="o">.</span><span class="n">threads</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span><span class="o">.</span><span class="n">resume</span><span class="p">()</span>
+
+<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;    Executing more python code!&quot;</span><span class="p">)</span>
+<span class="n">safe_execute_python</span><span class="p">(</span><span class="n">process</span><span class="p">,</span> <span class="s2">&quot;&quot;&quot;</span>
+<span class="s2">print(&#39;hello from inside the resumed process!&#39;, flush=True)</span>
+<span class="s2">&quot;&quot;&quot;</span><span class="p">)</span>
+
+<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;    Executing an error python code!&quot;</span><span class="p">)</span>
+<span class="k">try</span><span class="p">:</span>
+    <span class="n">safe_execute_python</span><span class="p">(</span><span class="n">process</span><span class="p">,</span> <span class="s2">&quot;&quot;&quot;BAD_VARIABLE&quot;&quot;&quot;</span><span class="p">)</span>
+<span class="k">except</span> <span class="n">RemotePythonError</span> <span class="k">as</span> <span class="n">e</span><span class="p">:</span>
+    <span class="nb">print</span><span class="p">(</span><span class="s2">&quot;        Expected error during safe_execute_python&quot;</span><span class="p">)</span>
+    <span class="nb">print</span><span class="p">(</span><span class="s2">&quot;        </span><span class="si">{0}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="n">e</span><span class="p">))</span>
+
+<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;   Sleeping a little&quot;</span><span class="p">)</span>
+<span class="n">time</span><span class="o">.</span><span class="n">sleep</span><span class="p">(</span><span class="mi">5</span><span class="p">)</span>
+<span class="nb">print</span><span class="p">(</span><span class="s2">&quot;   Killing target process !&quot;</span><span class="p">)</span>
+<span class="n">process</span><span class="o">.</span><span class="n">exit</span><span class="p">()</span>
+</pre></div>
+</div>
+<p>Output</p>
+<div class="highlight-default notranslate"><div class="highlight"><pre><span></span>PS C:\Users\hakril\PythonForWindows&gt; py .\samples\process\msstore_interpreter_remote_python.py
+Executable is: C:\Users\hakril\AppData\Local\Microsoft\WindowsApps\PythonSoftwareFoundation.Python.3.13_qbz5n2kfra8p0\python.exe
+Trying normal execute_python()
+    Exception during proc1.execute_python():
+    InjectionFailedError(&#39;Injection of &lt;c:\\program files\\windowsapps\\pythonsoftwarefoundation.python.3.13_3.13.496.0_x64__qbz5n2kfra8p0\\vcruntime140.dll&gt; failed&#39;)
+Trying mspython workaround:
+    Executing python code!
+Injecting: C:\Users\hakril\AppData\Local\Temp\pfw_dllcache\vcruntime140.dll
+Injecting: C:\Users\hakril\AppData\Local\Temp\pfw_dllcache\python313.dll
+    Executing more python code!
+    Executing an error python code!
+        Expected error during safe_execute_python
+        b&#39;Traceback (most recent call last):\n  File &quot;&lt;string&gt;&quot;, line 1, in &lt;module&gt;\nNameError: name \&#39;BAD_VARIABLE\&#39; is not defined\n&#39;
+   Sleeping a little
+   Killing target process !
+</pre></div>
+</div>
+</section>
 </section>
 <section id="token">
-<span id="token-sample"></span><h2><span class="section-number">18.2. </span>Token<a class="headerlink" href="#token" title="Link to this heading">¶</a></h2>
+<h2><span class="section-number">18.2. </span>Token<a class="headerlink" href="#token" title="Link to this heading">¶</a></h2>
 <div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="kn">import</span> <span class="nn">windows</span>
 <span class="kn">import</span> <span class="nn">windows.generated_def</span> <span class="k">as</span> <span class="nn">gdef</span>
 
@@ -4557,6 +4730,7 @@ BYE
 <li><a class="reference internal" href="#peb-exploration">18.1.3. <code class="xref py py-class docutils literal notranslate"><span class="pre">PEB</span></code> exploration</a></li>
 <li><a class="reference internal" href="#apisetmap">18.1.4. ApiSetMap</a></li>
 <li><a class="reference internal" href="#iat-hooking">18.1.5. IAT hooking</a></li>
+<li><a class="reference internal" href="#microsoft-store-python-injection">18.1.6. Microsoft Store Python Injection</a></li>
 </ul>
 </li>
 <li><a class="reference internal" href="#token">18.2. Token</a></li>

docs/build/html/utils.html

@@ -135,8 +135,12 @@ like <code class="docutils literal notranslate"><span class="pre">VirtualProtect
 
 <dl class="py function">
 <dt class="sig sig-object py" id="windows.utils.create_process">
-<span class="sig-prename descclassname"><span class="pre">windows.utils.</span></span><span class="sig-name descname"><span class="pre">create_process</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">path</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">args</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">None</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">dwCreationFlags</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">0</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">show_windows</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">True</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/utils/winutils.html#create_process"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.utils.create_process" title="Link to this definition">¶</a></dt>
-<dd><p>A convenient wrapper arround <code class="xref py py-func docutils literal notranslate"><span class="pre">windows.winproxy.CreateProcessW()</span></code></p>
+<span class="sig-prename descclassname"><span class="pre">windows.utils.</span></span><span class="sig-name descname"><span class="pre">create_process</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">path</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">args</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">None</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">dwCreationFlags</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">0</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">show_windows</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">True</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">machine</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">None</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/utils/winutils.html#create_process"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.utils.create_process" title="Link to this definition">¶</a></dt>
+<dd><p>A convenient wrapper arround <code class="xref py py-func docutils literal notranslate"><span class="pre">windows.winproxy.CreateProcessW()</span></code>
+..note:</p>
+<blockquote>
+<div><p>The machine param only works starting at vista and should be used on arm64 computer</p>
+</div></blockquote>
 </dd></dl>
 
 <dl class="py function">

docs/build/html/windows.html

@@ -298,8 +298,28 @@ Custom dict built on GetEnvironmentStringsW() on py2</p>
 <dd><p>The name of the system version,  values are:</p>
 <blockquote>
 <div><ul class="simple">
+<li><p>Windows Server 2025</p></li>
+<li><p>Windows 11 Version 24H2</p></li>
+<li><p>Windows 11 Version 23H2</p></li>
+<li><p>Windows 11 Version 22H2</p></li>
+<li><p>Windows 11 Version 21H2</p></li>
+<li><p>Windows 10 Version 22H2</p></li>
+<li><p>Windows 10 Version 21H2</p></li>
+<li><p>Windows Server 2022</p></li>
+<li><p>Windows 10 Version 21H1</p></li>
+<li><p>Windows 10 Version 20H2</p></li>
+<li><p>Windows 10 Version 2004</p></li>
+<li><p>Windows 10 Version 1909</p></li>
+<li><p>Windows 10 Version 1903</p></li>
+<li><p>Windows Server 2019</p></li>
+<li><p>Windows 10 Version 1809</p></li>
+<li><p>Windows 10 Version 1803</p></li>
+<li><p>Windows 10 Version 1709</p></li>
+<li><p>Windows 10 Version 1703</p></li>
+<li><p>Windows 10 Version 1607</p></li>
+<li><p>Windows 10 Version 1511</p></li>
+<li><p>Windows 10 Version 1507</p></li>
 <li><p>Windows Server 2016</p></li>
-<li><p>Windows 10</p></li>
 <li><p>Windows Server 2012 R2</p></li>
 <li><p>Windows 8.1</p></li>
 <li><p>Windows Server 2012</p></li>
@@ -309,17 +329,18 @@ Custom dict built on GetEnvironmentStringsW() on py2</p>
 <li><p>Windows Server 2008</p></li>
 <li><p>Windows Vista</p></li>
 <li><p>Windows XP Professional x64 Edition</p></li>
-<li><p>TODO: version (5.2) + is_workstation + bitness == 32 (don’t even know if possible..)</p></li>
+<li><p>Unknown: version (5.2) + is_workstation + bitness == 32 (don’t even know if possible..)</p></li>
 <li><p>Windows Server 2003 R2</p></li>
 <li><p>Windows Server 2003</p></li>
 <li><p>Windows XP</p></li>
 <li><p>Windows 2000</p></li>
-<li><p>“Unknow Windows &lt;version={0} | is_workstation={1}&gt;”.format(version, is_workstation)</p></li>
+<li><p>“Unknown Windows 10+ &lt;versionstr={0} | is_workstation={1}&gt;”.format(self.versionstr, is_workstation)</p></li>
+<li><p>“Unknown Windows &lt;version={0} | is_workstation={1}&gt;”.format(version, is_workstation)</p></li>
 </ul>
 </div></blockquote>
 <dl class="field-list simple">
 <dt class="field-odd">Type<span class="colon">:</span></dt>
-<dd class="field-odd"><p><code class="xref py py-class docutils literal notranslate"><span class="pre">str</span></code></p>
+<dd class="field-odd"><p><code class="xref py py-class docutils literal notranslate"><span class="pre">unicode</span></code></p>
 </dd>
 </dl>
 </dd></dl>

docs/build/html/winfuncs_generated.html

@@ -857,6 +857,16 @@
 <span class="sig-prename descclassname"><span class="pre">windows.generated_def.winfuncs.</span></span><span class="sig-name descname"><span class="pre">CertCloseStore</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">hCertStore</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">dwFlags</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.generated_def.winfuncs.CertCloseStore" title="Link to this definition">¶</a></dt>
 <dd></dd></dl>
 
+<dl class="py function">
+<dt class="sig sig-object py" id="windows.generated_def.winfuncs.CryptSignAndEncodeCertificate">
+<span class="sig-prename descclassname"><span class="pre">windows.generated_def.winfuncs.</span></span><span class="sig-name descname"><span class="pre">CryptSignAndEncodeCertificate</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">hBCryptKey</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">dwKeySpec</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">dwCertEncodingType</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">lpszStructType</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">pvStructInfo</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">pSignatureAlgorithm</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">pvHashAuxInfo</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">pbEncoded</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">pcbEncoded</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.generated_def.winfuncs.CryptSignAndEncodeCertificate" title="Link to this definition">¶</a></dt>
+<dd></dd></dl>
+
+<dl class="py function">
+<dt class="sig sig-object py" id="windows.generated_def.winfuncs.CryptSignCertificate">
+<span class="sig-prename descclassname"><span class="pre">windows.generated_def.winfuncs.</span></span><span class="sig-name descname"><span class="pre">CryptSignCertificate</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">hBCryptKey</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">dwKeySpec</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">dwCertEncodingType</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">pbEncodedToBeSigned</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">cbEncodedToBeSigned</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">pSignatureAlgorithm</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">pvHashAuxInfo</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">pbSignature</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">pcbSignature</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.generated_def.winfuncs.CryptSignCertificate" title="Link to this definition">¶</a></dt>
+<dd></dd></dl>
+
 <dl class="py function">
 <dt class="sig sig-object py" id="windows.generated_def.winfuncs.OpenVirtualDisk">
 <span class="sig-prename descclassname"><span class="pre">windows.generated_def.winfuncs.</span></span><span class="sig-name descname"><span class="pre">OpenVirtualDisk</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">VirtualStorageType</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">Path</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">VirtualDiskAccessMask</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">Flags</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">Parameters</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">Handle</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.generated_def.winfuncs.OpenVirtualDisk" title="Link to this definition">¶</a></dt>
@@ -1522,6 +1532,16 @@
 <span class="sig-prename descclassname"><span class="pre">windows.generated_def.winfuncs.</span></span><span class="sig-name descname"><span class="pre">UnmapViewOfFile</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">lpBaseAddress</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.generated_def.winfuncs.UnmapViewOfFile" title="Link to this definition">¶</a></dt>
 <dd></dd></dl>
 
+<dl class="py function">
+<dt class="sig sig-object py" id="windows.generated_def.winfuncs.NCryptOpenKey">
+<span class="sig-prename descclassname"><span class="pre">windows.generated_def.winfuncs.</span></span><span class="sig-name descname"><span class="pre">NCryptOpenKey</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">hProvider</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">phKey</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">pszKeyName</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">dwLegacyKeySpec</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">dwFlags</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.generated_def.winfuncs.NCryptOpenKey" title="Link to this definition">¶</a></dt>
+<dd></dd></dl>
+
+<dl class="py function">
+<dt class="sig sig-object py" id="windows.generated_def.winfuncs.NCryptOpenStorageProvider">
+<span class="sig-prename descclassname"><span class="pre">windows.generated_def.winfuncs.</span></span><span class="sig-name descname"><span class="pre">NCryptOpenStorageProvider</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">phProvider</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">pszProviderName</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">dwFlags</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.generated_def.winfuncs.NCryptOpenStorageProvider" title="Link to this definition">¶</a></dt>
+<dd></dd></dl>
+
 <dl class="py function">
 <dt class="sig sig-object py" id="windows.generated_def.winfuncs.NetQueryDisplayInformation">
 <span class="sig-prename descclassname"><span class="pre">windows.generated_def.winfuncs.</span></span><span class="sig-name descname"><span class="pre">NetQueryDisplayInformation</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">ServerName</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">Level</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">Index</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">EntriesRequested</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">PreferredMaximumLength</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">ReturnedEntryCount</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">SortedBuffer</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.generated_def.winfuncs.NetQueryDisplayInformation" title="Link to this definition">¶</a></dt>
@@ -1782,6 +1802,21 @@
 <span class="sig-prename descclassname"><span class="pre">windows.generated_def.winfuncs.</span></span><span class="sig-name descname"><span class="pre">FreeLibrary</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">hLibModule</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.generated_def.winfuncs.FreeLibrary" title="Link to this definition">¶</a></dt>
 <dd></dd></dl>
 
+<dl class="py function">
+<dt class="sig sig-object py" id="windows.generated_def.winfuncs.GetProcessInformation">
+<span class="sig-prename descclassname"><span class="pre">windows.generated_def.winfuncs.</span></span><span class="sig-name descname"><span class="pre">GetProcessInformation</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">hProcess</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">ProcessInformationClass</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">ProcessInformation</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">ProcessInformationSize</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.generated_def.winfuncs.GetProcessInformation" title="Link to this definition">¶</a></dt>
+<dd></dd></dl>
+
+<dl class="py function">
+<dt class="sig sig-object py" id="windows.generated_def.winfuncs.SetProcessInformation">
+<span class="sig-prename descclassname"><span class="pre">windows.generated_def.winfuncs.</span></span><span class="sig-name descname"><span class="pre">SetProcessInformation</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">hProcess</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">ProcessInformationClass</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">ProcessInformation</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">ProcessInformationSize</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.generated_def.winfuncs.SetProcessInformation" title="Link to this definition">¶</a></dt>
+<dd></dd></dl>
+
+<dl class="py function">
+<dt class="sig sig-object py" id="windows.generated_def.winfuncs.RtlGetCurrentPeb">
+<span class="sig-prename descclassname"><span class="pre">windows.generated_def.winfuncs.</span></span><span class="sig-name descname"><span class="pre">RtlGetCurrentPeb</span></span><span class="sig-paren">(</span><span class="sig-paren">)</span><a class="headerlink" href="#windows.generated_def.winfuncs.RtlGetCurrentPeb" title="Link to this definition">¶</a></dt>
+<dd></dd></dl>
+
 <dl class="py function">
 <dt class="sig sig-object py" id="windows.generated_def.winfuncs.RegQueryValueExA">
 <span class="sig-prename descclassname"><span class="pre">windows.generated_def.winfuncs.</span></span><span class="sig-name descname"><span class="pre">RegQueryValueExA</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">hKey</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">lpValueName</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">lpReserved</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">lpType</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">lpData</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">lpcbData</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.generated_def.winfuncs.RegQueryValueExA" title="Link to this definition">¶</a></dt>
@@ -3072,6 +3107,96 @@
 <span class="sig-prename descclassname"><span class="pre">windows.generated_def.winfuncs.</span></span><span class="sig-name descname"><span class="pre">LookupAccountNameW</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">lpSystemName</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">lpAccountName</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">Sid</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">cbSid</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">ReferencedDomainName</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">cchReferencedDomainName</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">peUse</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.generated_def.winfuncs.LookupAccountNameW" title="Link to this definition">¶</a></dt>
 <dd></dd></dl>
 
+<dl class="py function">
+<dt class="sig sig-object py" id="windows.generated_def.winfuncs.GetNativeSystemInfo">
+<span class="sig-prename descclassname"><span class="pre">windows.generated_def.winfuncs.</span></span><span class="sig-name descname"><span class="pre">GetNativeSystemInfo</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">lpSystemInfo</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.generated_def.winfuncs.GetNativeSystemInfo" title="Link to this definition">¶</a></dt>
+<dd></dd></dl>
+
+<dl class="py function">
+<dt class="sig sig-object py" id="windows.generated_def.winfuncs.GetSystemInfo">
+<span class="sig-prename descclassname"><span class="pre">windows.generated_def.winfuncs.</span></span><span class="sig-name descname"><span class="pre">GetSystemInfo</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">lpSystemInfo</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.generated_def.winfuncs.GetSystemInfo" title="Link to this definition">¶</a></dt>
+<dd></dd></dl>
+
+<dl class="py function">
+<dt class="sig sig-object py" id="windows.generated_def.winfuncs.IsWow64Process">
+<span class="sig-prename descclassname"><span class="pre">windows.generated_def.winfuncs.</span></span><span class="sig-name descname"><span class="pre">IsWow64Process</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">hProcess</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">Wow64Process</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.generated_def.winfuncs.IsWow64Process" title="Link to this definition">¶</a></dt>
+<dd></dd></dl>
+
+<dl class="py function">
+<dt class="sig sig-object py" id="windows.generated_def.winfuncs.IsWow64Process2">
+<span class="sig-prename descclassname"><span class="pre">windows.generated_def.winfuncs.</span></span><span class="sig-name descname"><span class="pre">IsWow64Process2</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">hProcess</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">pProcessMachine</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">pNativeMachine</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.generated_def.winfuncs.IsWow64Process2" title="Link to this definition">¶</a></dt>
+<dd></dd></dl>
+
+<dl class="py function">
+<dt class="sig sig-object py" id="windows.generated_def.winfuncs.IsWow64GuestMachineSupported">
+<span class="sig-prename descclassname"><span class="pre">windows.generated_def.winfuncs.</span></span><span class="sig-name descname"><span class="pre">IsWow64GuestMachineSupported</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">WowGuestMachine</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">MachineIsSupported</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.generated_def.winfuncs.IsWow64GuestMachineSupported" title="Link to this definition">¶</a></dt>
+<dd></dd></dl>
+
+<dl class="py function">
+<dt class="sig sig-object py" id="windows.generated_def.winfuncs.GetSystemWow64DirectoryA">
+<span class="sig-prename descclassname"><span class="pre">windows.generated_def.winfuncs.</span></span><span class="sig-name descname"><span class="pre">GetSystemWow64DirectoryA</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">lpBuffer</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">uSize</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.generated_def.winfuncs.GetSystemWow64DirectoryA" title="Link to this definition">¶</a></dt>
+<dd></dd></dl>
+
+<dl class="py function">
+<dt class="sig sig-object py" id="windows.generated_def.winfuncs.GetSystemWow64DirectoryW">
+<span class="sig-prename descclassname"><span class="pre">windows.generated_def.winfuncs.</span></span><span class="sig-name descname"><span class="pre">GetSystemWow64DirectoryW</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">lpBuffer</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">uSize</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.generated_def.winfuncs.GetSystemWow64DirectoryW" title="Link to this definition">¶</a></dt>
+<dd></dd></dl>
+
+<dl class="py function">
+<dt class="sig sig-object py" id="windows.generated_def.winfuncs.GetSystemWow64Directory2A">
+<span class="sig-prename descclassname"><span class="pre">windows.generated_def.winfuncs.</span></span><span class="sig-name descname"><span class="pre">GetSystemWow64Directory2A</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">lpBuffer</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">uSize</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">ImageFileMachineType</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.generated_def.winfuncs.GetSystemWow64Directory2A" title="Link to this definition">¶</a></dt>
+<dd></dd></dl>
+
+<dl class="py function">
+<dt class="sig sig-object py" id="windows.generated_def.winfuncs.GetSystemWow64Directory2W">
+<span class="sig-prename descclassname"><span class="pre">windows.generated_def.winfuncs.</span></span><span class="sig-name descname"><span class="pre">GetSystemWow64Directory2W</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">lpBuffer</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">uSize</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">ImageFileMachineType</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.generated_def.winfuncs.GetSystemWow64Directory2W" title="Link to this definition">¶</a></dt>
+<dd></dd></dl>
+
+<dl class="py function">
+<dt class="sig sig-object py" id="windows.generated_def.winfuncs.Wow64DisableWow64FsRedirection">
+<span class="sig-prename descclassname"><span class="pre">windows.generated_def.winfuncs.</span></span><span class="sig-name descname"><span class="pre">Wow64DisableWow64FsRedirection</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">OldValue</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.generated_def.winfuncs.Wow64DisableWow64FsRedirection" title="Link to this definition">¶</a></dt>
+<dd></dd></dl>
+
+<dl class="py function">
+<dt class="sig sig-object py" id="windows.generated_def.winfuncs.Wow64EnableWow64FsRedirection">
+<span class="sig-prename descclassname"><span class="pre">windows.generated_def.winfuncs.</span></span><span class="sig-name descname"><span class="pre">Wow64EnableWow64FsRedirection</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">Wow64FsEnableRedirection</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.generated_def.winfuncs.Wow64EnableWow64FsRedirection" title="Link to this definition">¶</a></dt>
+<dd></dd></dl>
+
+<dl class="py function">
+<dt class="sig sig-object py" id="windows.generated_def.winfuncs.Wow64RevertWow64FsRedirection">
+<span class="sig-prename descclassname"><span class="pre">windows.generated_def.winfuncs.</span></span><span class="sig-name descname"><span class="pre">Wow64RevertWow64FsRedirection</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">OlValue</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.generated_def.winfuncs.Wow64RevertWow64FsRedirection" title="Link to this definition">¶</a></dt>
+<dd></dd></dl>
+
+<dl class="py function">
+<dt class="sig sig-object py" id="windows.generated_def.winfuncs.Wow64GetThreadContext">
+<span class="sig-prename descclassname"><span class="pre">windows.generated_def.winfuncs.</span></span><span class="sig-name descname"><span class="pre">Wow64GetThreadContext</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">hThread</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">lpContext</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.generated_def.winfuncs.Wow64GetThreadContext" title="Link to this definition">¶</a></dt>
+<dd></dd></dl>
+
+<dl class="py function">
+<dt class="sig sig-object py" id="windows.generated_def.winfuncs.Wow64SetThreadContext">
+<span class="sig-prename descclassname"><span class="pre">windows.generated_def.winfuncs.</span></span><span class="sig-name descname"><span class="pre">Wow64SetThreadContext</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">hThread</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">lpContext</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.generated_def.winfuncs.Wow64SetThreadContext" title="Link to this definition">¶</a></dt>
+<dd></dd></dl>
+
+<dl class="py function">
+<dt class="sig sig-object py" id="windows.generated_def.winfuncs.Wow64SetThreadDefaultGuestMachine">
+<span class="sig-prename descclassname"><span class="pre">windows.generated_def.winfuncs.</span></span><span class="sig-name descname"><span class="pre">Wow64SetThreadDefaultGuestMachine</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">Machine</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.generated_def.winfuncs.Wow64SetThreadDefaultGuestMachine" title="Link to this definition">¶</a></dt>
+<dd></dd></dl>
+
+<dl class="py function">
+<dt class="sig sig-object py" id="windows.generated_def.winfuncs.Wow64SuspendThread">
+<span class="sig-prename descclassname"><span class="pre">windows.generated_def.winfuncs.</span></span><span class="sig-name descname"><span class="pre">Wow64SuspendThread</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">hThread</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.generated_def.winfuncs.Wow64SuspendThread" title="Link to this definition">¶</a></dt>
+<dd></dd></dl>
+
+<dl class="py function">
+<dt class="sig sig-object py" id="windows.generated_def.winfuncs.NtWow64ReadVirtualMemory64">
+<span class="sig-prename descclassname"><span class="pre">windows.generated_def.winfuncs.</span></span><span class="sig-name descname"><span class="pre">NtWow64ReadVirtualMemory64</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">hProcess</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">lpBaseAddress</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">lpBuffer</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">nSize</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">lpNumberOfBytesRead</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.generated_def.winfuncs.NtWow64ReadVirtualMemory64" title="Link to this definition">¶</a></dt>
+<dd></dd></dl>
+
+<dl class="py function">
+<dt class="sig sig-object py" id="windows.generated_def.winfuncs.NtWow64WriteVirtualMemory64">
+<span class="sig-prename descclassname"><span class="pre">windows.generated_def.winfuncs.</span></span><span class="sig-name descname"><span class="pre">NtWow64WriteVirtualMemory64</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">hProcess</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">lpBaseAddress</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">lpBuffer</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">nSize</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">lpNumberOfBytesWritten</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.generated_def.winfuncs.NtWow64WriteVirtualMemory64" title="Link to this definition">¶</a></dt>
+<dd></dd></dl>
+
 <dl class="py function">
 <dt class="sig sig-object py" id="windows.generated_def.winfuncs.FileTimeToSystemTime">
 <span class="sig-prename descclassname"><span class="pre">windows.generated_def.winfuncs.</span></span><span class="sig-name descname"><span class="pre">FileTimeToSystemTime</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">lpFileTime</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">lpSystemTime</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.generated_def.winfuncs.FileTimeToSystemTime" title="Link to this definition">¶</a></dt>
@@ -3412,6 +3537,11 @@
 <span class="sig-prename descclassname"><span class="pre">windows.generated_def.winfuncs.</span></span><span class="sig-name descname"><span class="pre">CreateRemoteThread</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">hProcess</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">lpThreadAttributes</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">dwStackSize</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">lpStartAddress</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">lpParameter</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">dwCreationFlags</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">lpThreadId</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.generated_def.winfuncs.CreateRemoteThread" title="Link to this definition">¶</a></dt>
 <dd></dd></dl>
 
+<dl class="py function">
+<dt class="sig sig-object py" id="windows.generated_def.winfuncs.CreateRemoteThreadEx">
+<span class="sig-prename descclassname"><span class="pre">windows.generated_def.winfuncs.</span></span><span class="sig-name descname"><span class="pre">CreateRemoteThreadEx</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">hProcess</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">lpThreadAttributes</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">dwStackSize</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">lpStartAddress</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">lpParameter</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">dwCreationFlags</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">lpAttributeList</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">lpThreadId</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.generated_def.winfuncs.CreateRemoteThreadEx" title="Link to this definition">¶</a></dt>
+<dd></dd></dl>
+
 <dl class="py function">
 <dt class="sig sig-object py" id="windows.generated_def.winfuncs.CreateProcessA">
 <span class="sig-prename descclassname"><span class="pre">windows.generated_def.winfuncs.</span></span><span class="sig-name descname"><span class="pre">CreateProcessA</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">lpApplicationName</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">lpCommandLine</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">lpProcessAttributes</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">lpThreadAttributes</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">bInheritHandles</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">dwCreationFlags</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">lpEnvironment</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">lpCurrentDirectory</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">lpStartupInfo</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">lpProcessInformation</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.generated_def.winfuncs.CreateProcessA" title="Link to this definition">¶</a></dt>
@@ -3462,21 +3592,11 @@
 <span class="sig-prename descclassname"><span class="pre">windows.generated_def.winfuncs.</span></span><span class="sig-name descname"><span class="pre">ReadProcessMemory</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">hProcess</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">lpBaseAddress</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">lpBuffer</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">nSize</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">lpNumberOfBytesRead</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.generated_def.winfuncs.ReadProcessMemory" title="Link to this definition">¶</a></dt>
 <dd></dd></dl>
 
-<dl class="py function">
-<dt class="sig sig-object py" id="windows.generated_def.winfuncs.NtWow64ReadVirtualMemory64">
-<span class="sig-prename descclassname"><span class="pre">windows.generated_def.winfuncs.</span></span><span class="sig-name descname"><span class="pre">NtWow64ReadVirtualMemory64</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">hProcess</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">lpBaseAddress</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">lpBuffer</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">nSize</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">lpNumberOfBytesRead</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.generated_def.winfuncs.NtWow64ReadVirtualMemory64" title="Link to this definition">¶</a></dt>
-<dd></dd></dl>
-
 <dl class="py function">
 <dt class="sig sig-object py" id="windows.generated_def.winfuncs.WriteProcessMemory">
 <span class="sig-prename descclassname"><span class="pre">windows.generated_def.winfuncs.</span></span><span class="sig-name descname"><span class="pre">WriteProcessMemory</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">hProcess</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">lpBaseAddress</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">lpBuffer</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">nSize</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">lpNumberOfBytesWritten</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.generated_def.winfuncs.WriteProcessMemory" title="Link to this definition">¶</a></dt>
 <dd></dd></dl>
 
-<dl class="py function">
-<dt class="sig sig-object py" id="windows.generated_def.winfuncs.NtWow64WriteVirtualMemory64">
-<span class="sig-prename descclassname"><span class="pre">windows.generated_def.winfuncs.</span></span><span class="sig-name descname"><span class="pre">NtWow64WriteVirtualMemory64</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">hProcess</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">lpBaseAddress</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">lpBuffer</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">nSize</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">lpNumberOfBytesWritten</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.generated_def.winfuncs.NtWow64WriteVirtualMemory64" title="Link to this definition">¶</a></dt>
-<dd></dd></dl>
-
 <dl class="py function">
 <dt class="sig sig-object py" id="windows.generated_def.winfuncs.GetCurrentProcess">
 <span class="sig-prename descclassname"><span class="pre">windows.generated_def.winfuncs.</span></span><span class="sig-name descname"><span class="pre">GetCurrentProcess</span></span><span class="sig-paren">(</span><span class="sig-paren">)</span><a class="headerlink" href="#windows.generated_def.winfuncs.GetCurrentProcess" title="Link to this definition">¶</a></dt>
@@ -3707,26 +3827,6 @@
 <span class="sig-prename descclassname"><span class="pre">windows.generated_def.winfuncs.</span></span><span class="sig-name descname"><span class="pre">DeviceIoControl</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">hDevice</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">dwIoControlCode</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">lpInBuffer</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">nInBufferSize</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">lpOutBuffer</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">nOutBufferSize</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">lpBytesReturned</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">lpOverlapped</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.generated_def.winfuncs.DeviceIoControl" title="Link to this definition">¶</a></dt>
 <dd></dd></dl>
 
-<dl class="py function">
-<dt class="sig sig-object py" id="windows.generated_def.winfuncs.Wow64DisableWow64FsRedirection">
-<span class="sig-prename descclassname"><span class="pre">windows.generated_def.winfuncs.</span></span><span class="sig-name descname"><span class="pre">Wow64DisableWow64FsRedirection</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">OldValue</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.generated_def.winfuncs.Wow64DisableWow64FsRedirection" title="Link to this definition">¶</a></dt>
-<dd></dd></dl>
-
-<dl class="py function">
-<dt class="sig sig-object py" id="windows.generated_def.winfuncs.Wow64RevertWow64FsRedirection">
-<span class="sig-prename descclassname"><span class="pre">windows.generated_def.winfuncs.</span></span><span class="sig-name descname"><span class="pre">Wow64RevertWow64FsRedirection</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">OldValue</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.generated_def.winfuncs.Wow64RevertWow64FsRedirection" title="Link to this definition">¶</a></dt>
-<dd></dd></dl>
-
-<dl class="py function">
-<dt class="sig sig-object py" id="windows.generated_def.winfuncs.Wow64EnableWow64FsRedirection">
-<span class="sig-prename descclassname"><span class="pre">windows.generated_def.winfuncs.</span></span><span class="sig-name descname"><span class="pre">Wow64EnableWow64FsRedirection</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">Wow64FsEnableRedirection</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.generated_def.winfuncs.Wow64EnableWow64FsRedirection" title="Link to this definition">¶</a></dt>
-<dd></dd></dl>
-
-<dl class="py function">
-<dt class="sig sig-object py" id="windows.generated_def.winfuncs.Wow64GetThreadContext">
-<span class="sig-prename descclassname"><span class="pre">windows.generated_def.winfuncs.</span></span><span class="sig-name descname"><span class="pre">Wow64GetThreadContext</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">hThread</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">lpContext</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.generated_def.winfuncs.Wow64GetThreadContext" title="Link to this definition">¶</a></dt>
-<dd></dd></dl>
-
 <dl class="py function">
 <dt class="sig sig-object py" id="windows.generated_def.winfuncs.SetConsoleCtrlHandler">
 <span class="sig-prename descclassname"><span class="pre">windows.generated_def.winfuncs.</span></span><span class="sig-name descname"><span class="pre">SetConsoleCtrlHandler</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">HandlerRoutine</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">Add</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.generated_def.winfuncs.SetConsoleCtrlHandler" title="Link to this definition">¶</a></dt>
@@ -3862,11 +3962,6 @@
 <span class="sig-prename descclassname"><span class="pre">windows.generated_def.winfuncs.</span></span><span class="sig-name descname"><span class="pre">GetProcessId</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">Process</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.generated_def.winfuncs.GetProcessId" title="Link to this definition">¶</a></dt>
 <dd></dd></dl>
 
-<dl class="py function">
-<dt class="sig sig-object py" id="windows.generated_def.winfuncs.Wow64SetThreadContext">
-<span class="sig-prename descclassname"><span class="pre">windows.generated_def.winfuncs.</span></span><span class="sig-name descname"><span class="pre">Wow64SetThreadContext</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">hThread</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">lpContext</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.generated_def.winfuncs.Wow64SetThreadContext" title="Link to this definition">¶</a></dt>
-<dd></dd></dl>
-
 <dl class="py function">
 <dt class="sig sig-object py" id="windows.generated_def.winfuncs.GetMappedFileNameW">
 <span class="sig-prename descclassname"><span class="pre">windows.generated_def.winfuncs.</span></span><span class="sig-name descname"><span class="pre">GetMappedFileNameW</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">hProcess</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">lpv</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">lpFilename</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">nSize</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.generated_def.winfuncs.GetMappedFileNameW" title="Link to this definition">¶</a></dt>
@@ -4477,6 +4572,8 @@
 <li><a class="reference internal" href="#windows.generated_def.winfuncs.CryptEnumOIDFunction"><code class="docutils literal notranslate"><span class="pre">CryptEnumOIDFunction()</span></code></a></li>
 <li><a class="reference internal" href="#windows.generated_def.winfuncs.CryptGetOIDFunctionValue"><code class="docutils literal notranslate"><span class="pre">CryptGetOIDFunctionValue()</span></code></a></li>
 <li><a class="reference internal" href="#windows.generated_def.winfuncs.CertCloseStore"><code class="docutils literal notranslate"><span class="pre">CertCloseStore()</span></code></a></li>
+<li><a class="reference internal" href="#windows.generated_def.winfuncs.CryptSignAndEncodeCertificate"><code class="docutils literal notranslate"><span class="pre">CryptSignAndEncodeCertificate()</span></code></a></li>
+<li><a class="reference internal" href="#windows.generated_def.winfuncs.CryptSignCertificate"><code class="docutils literal notranslate"><span class="pre">CryptSignCertificate()</span></code></a></li>
 <li><a class="reference internal" href="#windows.generated_def.winfuncs.OpenVirtualDisk"><code class="docutils literal notranslate"><span class="pre">OpenVirtualDisk()</span></code></a></li>
 <li><a class="reference internal" href="#windows.generated_def.winfuncs.AttachVirtualDisk"><code class="docutils literal notranslate"><span class="pre">AttachVirtualDisk()</span></code></a></li>
 <li><a class="reference internal" href="#windows.generated_def.winfuncs.CryptProtectData"><code class="docutils literal notranslate"><span class="pre">CryptProtectData()</span></code></a></li>
@@ -4610,6 +4707,8 @@
 <li><a class="reference internal" href="#windows.generated_def.winfuncs.OpenFileMappingW"><code class="docutils literal notranslate"><span class="pre">OpenFileMappingW()</span></code></a></li>
 <li><a class="reference internal" href="#windows.generated_def.winfuncs.OpenFileMappingA"><code class="docutils literal notranslate"><span class="pre">OpenFileMappingA()</span></code></a></li>
 <li><a class="reference internal" href="#windows.generated_def.winfuncs.UnmapViewOfFile"><code class="docutils literal notranslate"><span class="pre">UnmapViewOfFile()</span></code></a></li>
+<li><a class="reference internal" href="#windows.generated_def.winfuncs.NCryptOpenKey"><code class="docutils literal notranslate"><span class="pre">NCryptOpenKey()</span></code></a></li>
+<li><a class="reference internal" href="#windows.generated_def.winfuncs.NCryptOpenStorageProvider"><code class="docutils literal notranslate"><span class="pre">NCryptOpenStorageProvider()</span></code></a></li>
 <li><a class="reference internal" href="#windows.generated_def.winfuncs.NetQueryDisplayInformation"><code class="docutils literal notranslate"><span class="pre">NetQueryDisplayInformation()</span></code></a></li>
 <li><a class="reference internal" href="#windows.generated_def.winfuncs.NetUserEnum"><code class="docutils literal notranslate"><span class="pre">NetUserEnum()</span></code></a></li>
 <li><a class="reference internal" href="#windows.generated_def.winfuncs.NetGroupEnum"><code class="docutils literal notranslate"><span class="pre">NetGroupEnum()</span></code></a></li>
@@ -4662,6 +4761,9 @@
 <li><a class="reference internal" href="#windows.generated_def.winfuncs.LoadLibraryExA"><code class="docutils literal notranslate"><span class="pre">LoadLibraryExA()</span></code></a></li>
 <li><a class="reference internal" href="#windows.generated_def.winfuncs.LoadLibraryExW"><code class="docutils literal notranslate"><span class="pre">LoadLibraryExW()</span></code></a></li>
 <li><a class="reference internal" href="#windows.generated_def.winfuncs.FreeLibrary"><code class="docutils literal notranslate"><span class="pre">FreeLibrary()</span></code></a></li>
+<li><a class="reference internal" href="#windows.generated_def.winfuncs.GetProcessInformation"><code class="docutils literal notranslate"><span class="pre">GetProcessInformation()</span></code></a></li>
+<li><a class="reference internal" href="#windows.generated_def.winfuncs.SetProcessInformation"><code class="docutils literal notranslate"><span class="pre">SetProcessInformation()</span></code></a></li>
+<li><a class="reference internal" href="#windows.generated_def.winfuncs.RtlGetCurrentPeb"><code class="docutils literal notranslate"><span class="pre">RtlGetCurrentPeb()</span></code></a></li>
 <li><a class="reference internal" href="#windows.generated_def.winfuncs.RegQueryValueExA"><code class="docutils literal notranslate"><span class="pre">RegQueryValueExA()</span></code></a></li>
 <li><a class="reference internal" href="#windows.generated_def.winfuncs.RegQueryValueExW"><code class="docutils literal notranslate"><span class="pre">RegQueryValueExW()</span></code></a></li>
 <li><a class="reference internal" href="#windows.generated_def.winfuncs.RegOpenKeyExA"><code class="docutils literal notranslate"><span class="pre">RegOpenKeyExA()</span></code></a></li>
@@ -4920,6 +5022,24 @@
 <li><a class="reference internal" href="#windows.generated_def.winfuncs.LookupAccountSidW"><code class="docutils literal notranslate"><span class="pre">LookupAccountSidW()</span></code></a></li>
 <li><a class="reference internal" href="#windows.generated_def.winfuncs.LookupAccountNameA"><code class="docutils literal notranslate"><span class="pre">LookupAccountNameA()</span></code></a></li>
 <li><a class="reference internal" href="#windows.generated_def.winfuncs.LookupAccountNameW"><code class="docutils literal notranslate"><span class="pre">LookupAccountNameW()</span></code></a></li>
+<li><a class="reference internal" href="#windows.generated_def.winfuncs.GetNativeSystemInfo"><code class="docutils literal notranslate"><span class="pre">GetNativeSystemInfo()</span></code></a></li>
+<li><a class="reference internal" href="#windows.generated_def.winfuncs.GetSystemInfo"><code class="docutils literal notranslate"><span class="pre">GetSystemInfo()</span></code></a></li>
+<li><a class="reference internal" href="#windows.generated_def.winfuncs.IsWow64Process"><code class="docutils literal notranslate"><span class="pre">IsWow64Process()</span></code></a></li>
+<li><a class="reference internal" href="#windows.generated_def.winfuncs.IsWow64Process2"><code class="docutils literal notranslate"><span class="pre">IsWow64Process2()</span></code></a></li>
+<li><a class="reference internal" href="#windows.generated_def.winfuncs.IsWow64GuestMachineSupported"><code class="docutils literal notranslate"><span class="pre">IsWow64GuestMachineSupported()</span></code></a></li>
+<li><a class="reference internal" href="#windows.generated_def.winfuncs.GetSystemWow64DirectoryA"><code class="docutils literal notranslate"><span class="pre">GetSystemWow64DirectoryA()</span></code></a></li>
+<li><a class="reference internal" href="#windows.generated_def.winfuncs.GetSystemWow64DirectoryW"><code class="docutils literal notranslate"><span class="pre">GetSystemWow64DirectoryW()</span></code></a></li>
+<li><a class="reference internal" href="#windows.generated_def.winfuncs.GetSystemWow64Directory2A"><code class="docutils literal notranslate"><span class="pre">GetSystemWow64Directory2A()</span></code></a></li>
+<li><a class="reference internal" href="#windows.generated_def.winfuncs.GetSystemWow64Directory2W"><code class="docutils literal notranslate"><span class="pre">GetSystemWow64Directory2W()</span></code></a></li>
+<li><a class="reference internal" href="#windows.generated_def.winfuncs.Wow64DisableWow64FsRedirection"><code class="docutils literal notranslate"><span class="pre">Wow64DisableWow64FsRedirection()</span></code></a></li>
+<li><a class="reference internal" href="#windows.generated_def.winfuncs.Wow64EnableWow64FsRedirection"><code class="docutils literal notranslate"><span class="pre">Wow64EnableWow64FsRedirection()</span></code></a></li>
+<li><a class="reference internal" href="#windows.generated_def.winfuncs.Wow64RevertWow64FsRedirection"><code class="docutils literal notranslate"><span class="pre">Wow64RevertWow64FsRedirection()</span></code></a></li>
+<li><a class="reference internal" href="#windows.generated_def.winfuncs.Wow64GetThreadContext"><code class="docutils literal notranslate"><span class="pre">Wow64GetThreadContext()</span></code></a></li>
+<li><a class="reference internal" href="#windows.generated_def.winfuncs.Wow64SetThreadContext"><code class="docutils literal notranslate"><span class="pre">Wow64SetThreadContext()</span></code></a></li>
+<li><a class="reference internal" href="#windows.generated_def.winfuncs.Wow64SetThreadDefaultGuestMachine"><code class="docutils literal notranslate"><span class="pre">Wow64SetThreadDefaultGuestMachine()</span></code></a></li>
+<li><a class="reference internal" href="#windows.generated_def.winfuncs.Wow64SuspendThread"><code class="docutils literal notranslate"><span class="pre">Wow64SuspendThread()</span></code></a></li>
+<li><a class="reference internal" href="#windows.generated_def.winfuncs.NtWow64ReadVirtualMemory64"><code class="docutils literal notranslate"><span class="pre">NtWow64ReadVirtualMemory64()</span></code></a></li>
+<li><a class="reference internal" href="#windows.generated_def.winfuncs.NtWow64WriteVirtualMemory64"><code class="docutils literal notranslate"><span class="pre">NtWow64WriteVirtualMemory64()</span></code></a></li>
 <li><a class="reference internal" href="#windows.generated_def.winfuncs.FileTimeToSystemTime"><code class="docutils literal notranslate"><span class="pre">FileTimeToSystemTime()</span></code></a></li>
 <li><a class="reference internal" href="#windows.generated_def.winfuncs.SystemTimeToFileTime"><code class="docutils literal notranslate"><span class="pre">SystemTimeToFileTime()</span></code></a></li>
 <li><a class="reference internal" href="#windows.generated_def.winfuncs.GetSystemTime"><code class="docutils literal notranslate"><span class="pre">GetSystemTime()</span></code></a></li>
@@ -4988,6 +5108,7 @@
 <li><a class="reference internal" href="#windows.generated_def.winfuncs.GetModuleFileNameW"><code class="docutils literal notranslate"><span class="pre">GetModuleFileNameW()</span></code></a></li>
 <li><a class="reference internal" href="#windows.generated_def.winfuncs.CreateThread"><code class="docutils literal notranslate"><span class="pre">CreateThread()</span></code></a></li>
 <li><a class="reference internal" href="#windows.generated_def.winfuncs.CreateRemoteThread"><code class="docutils literal notranslate"><span class="pre">CreateRemoteThread()</span></code></a></li>
+<li><a class="reference internal" href="#windows.generated_def.winfuncs.CreateRemoteThreadEx"><code class="docutils literal notranslate"><span class="pre">CreateRemoteThreadEx()</span></code></a></li>
 <li><a class="reference internal" href="#windows.generated_def.winfuncs.CreateProcessA"><code class="docutils literal notranslate"><span class="pre">CreateProcessA()</span></code></a></li>
 <li><a class="reference internal" href="#windows.generated_def.winfuncs.CreateProcessW"><code class="docutils literal notranslate"><span class="pre">CreateProcessW()</span></code></a></li>
 <li><a class="reference internal" href="#windows.generated_def.winfuncs.CreateProcessAsUserA"><code class="docutils literal notranslate"><span class="pre">CreateProcessAsUserA()</span></code></a></li>
@@ -4998,9 +5119,7 @@
 <li><a class="reference internal" href="#windows.generated_def.winfuncs.OpenProcess"><code class="docutils literal notranslate"><span class="pre">OpenProcess()</span></code></a></li>
 <li><a class="reference internal" href="#windows.generated_def.winfuncs.CloseHandle"><code class="docutils literal notranslate"><span class="pre">CloseHandle()</span></code></a></li>
 <li><a class="reference internal" href="#windows.generated_def.winfuncs.ReadProcessMemory"><code class="docutils literal notranslate"><span class="pre">ReadProcessMemory()</span></code></a></li>
-<li><a class="reference internal" href="#windows.generated_def.winfuncs.NtWow64ReadVirtualMemory64"><code class="docutils literal notranslate"><span class="pre">NtWow64ReadVirtualMemory64()</span></code></a></li>
 <li><a class="reference internal" href="#windows.generated_def.winfuncs.WriteProcessMemory"><code class="docutils literal notranslate"><span class="pre">WriteProcessMemory()</span></code></a></li>
-<li><a class="reference internal" href="#windows.generated_def.winfuncs.NtWow64WriteVirtualMemory64"><code class="docutils literal notranslate"><span class="pre">NtWow64WriteVirtualMemory64()</span></code></a></li>
 <li><a class="reference internal" href="#windows.generated_def.winfuncs.GetCurrentProcess"><code class="docutils literal notranslate"><span class="pre">GetCurrentProcess()</span></code></a></li>
 <li><a class="reference internal" href="#windows.generated_def.winfuncs.CreateFileA"><code class="docutils literal notranslate"><span class="pre">CreateFileA()</span></code></a></li>
 <li><a class="reference internal" href="#windows.generated_def.winfuncs.CreateFileW"><code class="docutils literal notranslate"><span class="pre">CreateFileW()</span></code></a></li>
@@ -5047,10 +5166,6 @@
 <li><a class="reference internal" href="#windows.generated_def.winfuncs.WaitForSingleObject"><code class="docutils literal notranslate"><span class="pre">WaitForSingleObject()</span></code></a></li>
 <li><a class="reference internal" href="#windows.generated_def.winfuncs.GetThreadId"><code class="docutils literal notranslate"><span class="pre">GetThreadId()</span></code></a></li>
 <li><a class="reference internal" href="#windows.generated_def.winfuncs.DeviceIoControl"><code class="docutils literal notranslate"><span class="pre">DeviceIoControl()</span></code></a></li>
-<li><a class="reference internal" href="#windows.generated_def.winfuncs.Wow64DisableWow64FsRedirection"><code class="docutils literal notranslate"><span class="pre">Wow64DisableWow64FsRedirection()</span></code></a></li>
-<li><a class="reference internal" href="#windows.generated_def.winfuncs.Wow64RevertWow64FsRedirection"><code class="docutils literal notranslate"><span class="pre">Wow64RevertWow64FsRedirection()</span></code></a></li>
-<li><a class="reference internal" href="#windows.generated_def.winfuncs.Wow64EnableWow64FsRedirection"><code class="docutils literal notranslate"><span class="pre">Wow64EnableWow64FsRedirection()</span></code></a></li>
-<li><a class="reference internal" href="#windows.generated_def.winfuncs.Wow64GetThreadContext"><code class="docutils literal notranslate"><span class="pre">Wow64GetThreadContext()</span></code></a></li>
 <li><a class="reference internal" href="#windows.generated_def.winfuncs.SetConsoleCtrlHandler"><code class="docutils literal notranslate"><span class="pre">SetConsoleCtrlHandler()</span></code></a></li>
 <li><a class="reference internal" href="#windows.generated_def.winfuncs.GlobalAlloc"><code class="docutils literal notranslate"><span class="pre">GlobalAlloc()</span></code></a></li>
 <li><a class="reference internal" href="#windows.generated_def.winfuncs.GlobalFree"><code class="docutils literal notranslate"><span class="pre">GlobalFree()</span></code></a></li>
@@ -5078,7 +5193,6 @@
 <li><a class="reference internal" href="#windows.generated_def.winfuncs.DebugSetProcessKillOnExit"><code class="docutils literal notranslate"><span class="pre">DebugSetProcessKillOnExit()</span></code></a></li>
 <li><a class="reference internal" href="#windows.generated_def.winfuncs.DebugBreakProcess"><code class="docutils literal notranslate"><span class="pre">DebugBreakProcess()</span></code></a></li>
 <li><a class="reference internal" href="#windows.generated_def.winfuncs.GetProcessId"><code class="docutils literal notranslate"><span class="pre">GetProcessId()</span></code></a></li>
-<li><a class="reference internal" href="#windows.generated_def.winfuncs.Wow64SetThreadContext"><code class="docutils literal notranslate"><span class="pre">Wow64SetThreadContext()</span></code></a></li>
 <li><a class="reference internal" href="#windows.generated_def.winfuncs.GetMappedFileNameW"><code class="docutils literal notranslate"><span class="pre">GetMappedFileNameW()</span></code></a></li>
 <li><a class="reference internal" href="#windows.generated_def.winfuncs.GetMappedFileNameA"><code class="docutils literal notranslate"><span class="pre">GetMappedFileNameA()</span></code></a></li>
 <li><a class="reference internal" href="#windows.generated_def.winfuncs.RtlInitString"><code class="docutils literal notranslate"><span class="pre">RtlInitString()</span></code></a></li>

docs/build/html/wmi.html

@@ -60,7 +60,7 @@
 <dd><p>The main WMI class exposed, used to list and access differents WMI namespace, can be used as a dict to access
 <a class="reference internal" href="#windows.winobject.wmi.WmiNamespace" title="windows.winobject.wmi.WmiNamespace"><code class="xref py py-class docutils literal notranslate"><span class="pre">WmiNamespace</span></code></a> by name</p>
 <dl>
-<dt>Example:</dt><dd><div class="doctest highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">&gt;&gt;&gt; </span><span class="n">windows</span><span class="o">.</span><span class="n">system</span><span class="o">.</span><span class="n">wmi</span><span class="p">[</span><span class="s2">&quot;root\SecurityCenter2&quot;</span><span class="p">]</span>
+<dt>Example:</dt><dd><div class="doctest highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">&gt;&gt;&gt; </span><span class="n">windows</span><span class="o">.</span><span class="n">system</span><span class="o">.</span><span class="n">wmi</span><span class="p">[</span><span class="sa">r</span><span class="s2">&quot;root\SecurityCenter2&quot;</span><span class="p">]</span>
 <span class="go">&lt;WmiNamespace &quot;root\SecurityCenter2&quot;&gt;</span>
 </pre></div>
 </div>

docs/source/windef_generated.rst

@@ -1145,6 +1145,89 @@ WinDef
 .. autodata:: NMPWAIT_WAIT_FOREVER
 .. autodata:: NMPWAIT_NOWAIT
 .. autodata:: NMPWAIT_USE_DEFAULT_WAIT
+.. autodata:: ProcThreadAttributeParentProcess
+.. autodata:: ProcThreadAttributeExtendedFlags
+.. autodata:: ProcThreadAttributeHandleList
+.. autodata:: ProcThreadAttributeGroupAffinity
+.. autodata:: ProcThreadAttributePreferredNode
+.. autodata:: ProcThreadAttributeIdealProcessor
+.. autodata:: ProcThreadAttributeUmsThread
+.. autodata:: ProcThreadAttributeMitigationPolicy
+.. autodata:: ProcThreadAttributePackageFullName
+.. autodata:: ProcThreadAttributeSecurityCapabilities
+.. autodata:: ProcThreadAttributeConsoleReference
+.. autodata:: ProcThreadAttributeProtectionLevel
+.. autodata:: ProcThreadAttributeOsMaxVersionTested
+.. autodata:: ProcThreadAttributeJobList
+.. autodata:: ProcThreadAttributeChildProcessPolicy
+.. autodata:: ProcThreadAttributeAllApplicationPackagesPolicy
+.. autodata:: ProcThreadAttributeWin32kFilter
+.. autodata:: ProcThreadAttributeSafeOpenPromptOriginClaim
+.. autodata:: ProcThreadAttributeDesktopAppPolicy
+.. autodata:: ProcThreadAttributeBnoIsolation
+.. autodata:: ProcThreadAttributePseudoConsole
+.. autodata:: ProcThreadAttributeIsolationManifest
+.. autodata:: ProcThreadAttributeMitigationAuditPolicy
+.. autodata:: ProcThreadAttributeMachineType
+.. autodata:: ProcThreadAttributeComponentFilter
+.. autodata:: ProcThreadAttributeEnableOptionalXStateFeatures
+.. autodata:: ProcThreadAttributeCreateStore
+.. autodata:: ProcThreadAttributeTrustedApp
+.. autodata:: ProcThreadAttributeSveVectorLength
+.. autodata:: PROC_THREAD_ATTRIBUTE_NUMBER
+.. autodata:: PROC_THREAD_ATTRIBUTE_THREAD
+.. autodata:: PROC_THREAD_ATTRIBUTE_INPUT
+.. autodata:: PROC_THREAD_ATTRIBUTE_ADDITIVE
+.. autodata:: PROC_THREAD_ATTRIBUTE_PARENT_PROCESS
+.. autodata:: PROC_THREAD_ATTRIBUTE_HANDLE_LIST
+.. autodata:: PROC_THREAD_ATTRIBUTE_GROUP_AFFINITY
+.. autodata:: PROC_THREAD_ATTRIBUTE_PREFERRED_NODE
+.. autodata:: PROC_THREAD_ATTRIBUTE_IDEAL_PROCESSOR
+.. autodata:: PROC_THREAD_ATTRIBUTE_UMS_THREAD
+.. autodata:: PROC_THREAD_ATTRIBUTE_MITIGATION_POLICY
+.. autodata:: PROC_THREAD_ATTRIBUTE_SECURITY_CAPABILITIES
+.. autodata:: PROC_THREAD_ATTRIBUTE_PROTECTION_LEVEL
+.. autodata:: PROC_THREAD_ATTRIBUTE_PSEUDOCONSOLE
+.. autodata:: PROC_THREAD_ATTRIBUTE_MACHINE_TYPE
+.. autodata:: PROC_THREAD_ATTRIBUTE_ENABLE_OPTIONAL_XSTATE_FEATURES
+.. autodata:: PROC_THREAD_ATTRIBUTE_SVE_VECTOR_LENGTH
+.. autodata:: PROCESSOR_INTEL_386
+.. autodata:: PROCESSOR_INTEL_486
+.. autodata:: PROCESSOR_INTEL_PENTIUM
+.. autodata:: PROCESSOR_INTEL_IA64
+.. autodata:: PROCESSOR_MIPS_R4000
+.. autodata:: PROCESSOR_ALPHA_21064
+.. autodata:: PROCESSOR_PPC_601
+.. autodata:: PROCESSOR_PPC_603
+.. autodata:: PROCESSOR_PPC_604
+.. autodata:: PROCESSOR_PPC_620
+.. autodata:: PROCESSOR_HITACHI_SH3
+.. autodata:: PROCESSOR_HITACHI_SH3E
+.. autodata:: PROCESSOR_HITACHI_SH4
+.. autodata:: PROCESSOR_MOTOROLA_821
+.. autodata:: PROCESSOR_SHx_SH3
+.. autodata:: PROCESSOR_SHx_SH4
+.. autodata:: PROCESSOR_STRONGARM
+.. autodata:: PROCESSOR_ARM720
+.. autodata:: PROCESSOR_ARM820
+.. autodata:: PROCESSOR_ARM920
+.. autodata:: PROCESSOR_ARM_7TDMI
+.. autodata:: PROCESSOR_OPTIL
+.. autodata:: PROCESSOR_ARCHITECTURE_INTEL
+.. autodata:: PROCESSOR_ARCHITECTURE_MIPS
+.. autodata:: PROCESSOR_ARCHITECTURE_ALPHA
+.. autodata:: PROCESSOR_ARCHITECTURE_PPC
+.. autodata:: PROCESSOR_ARCHITECTURE_SHX
+.. autodata:: PROCESSOR_ARCHITECTURE_ARM
+.. autodata:: PROCESSOR_ARCHITECTURE_IA64
+.. autodata:: PROCESSOR_ARCHITECTURE_ALPHA64
+.. autodata:: PROCESSOR_ARCHITECTURE_MSIL
+.. autodata:: PROCESSOR_ARCHITECTURE_AMD64
+.. autodata:: PROCESSOR_ARCHITECTURE_IA32_ON_WIN64
+.. autodata:: PROCESSOR_ARCHITECTURE_NEUTRAL
+.. autodata:: PROCESSOR_ARCHITECTURE_ARM64
+.. autodata:: PROCESSOR_ARCHITECTURE_ARM32_ON_WIN64
+.. autodata:: PROCESSOR_ARCHITECTURE_UNKNOWN
 .. autodata:: HKEY_CLASSES_ROOT
 .. autodata:: HKEY_CURRENT_USER
 .. autodata:: HKEY_LOCAL_MACHINE
@@ -1766,6 +1849,45 @@ WinDef
 .. autodata:: SPC_FINANCIAL_CRITERIA_OBJID
 .. autodata:: SPC_LINK_OBJID
 .. autodata:: SPC_SIGINFO_OBJID
+.. autodata:: CONTEXT_I386
+.. autodata:: CONTEXT_AMD64
+.. autodata:: CONTEXT_ARM
+.. autodata:: CONTEXT_ARM64
+.. autodata:: CONTEXT_i386
+.. autodata:: CONTEXT_i486
+.. autodata:: WOW64_CONTEXT_i386
+.. autodata:: WOW64_CONTEXT_i486
+.. autodata:: CONTEXT_CONTROL
+.. autodata:: CONTEXT_INTEGER
+.. autodata:: CONTEXT_SEGMENTS
+.. autodata:: CONTEXT_FLOATING_POINT
+.. autodata:: CONTEXT_DEBUG_REGISTERS
+.. autodata:: CONTEXT_EXTENDED_REGISTERS
+.. autodata:: CONTEXT_FULL
+.. autodata:: CONTEXT_ALL
+.. autodata:: CONTEXT_XSTATE
+.. autodata:: WOW64_CONTEXT_CONTROL
+.. autodata:: WOW64_CONTEXT_INTEGER
+.. autodata:: WOW64_CONTEXT_SEGMENTS
+.. autodata:: WOW64_CONTEXT_FLOATING_POINT
+.. autodata:: WOW64_CONTEXT_DEBUG_REGISTERS
+.. autodata:: WOW64_CONTEXT_EXTENDED_REGISTERS
+.. autodata:: WOW64_CONTEXT_FULL
+.. autodata:: WOW64_CONTEXT_ALL
+.. autodata:: WOW64_CONTEXT_XSTATE
+.. autodata:: WOW64_CONTEXT_EXCEPTION_ACTIVE
+.. autodata:: WOW64_CONTEXT_SERVICE_ACTIVE
+.. autodata:: WOW64_CONTEXT_EXCEPTION_REQUEST
+.. autodata:: WOW64_CONTEXT_EXCEPTION_REPORTING
+.. autodata:: CONTEXT_ARM64_CONTROL
+.. autodata:: CONTEXT_ARM64_INTEGER
+.. autodata:: CONTEXT_ARM64_FLOATING_POINT
+.. autodata:: CONTEXT_ARM64_DEBUG_REGISTERS
+.. autodata:: CONTEXT_ARM64_X18
+.. autodata:: CONTEXT_UNWOUND_TO_CALL
+.. autodata:: CONTEXT_RET_TO_GUEST
+.. autodata:: ARM64_MAX_BREAKPOINTS
+.. autodata:: ARM64_MAX_WATCHPOINTS
 .. autodata:: FILE_VER_GET_LOCALISED
 .. autodata:: FILE_VER_GET_NEUTRAL
 .. autodata:: FILE_VER_GET_PREFETCHED
@@ -1877,19 +1999,6 @@ WinDef
 .. autodata:: TH32CS_SNAPMODULE32
 .. autodata:: TH32CS_SNAPALL
 .. autodata:: TH32CS_INHERIT
-.. autodata:: CONTEXT_I386
-.. autodata:: CONTEXT_AMD64
-.. autodata:: CONTEXT_ARM
-.. autodata:: CONTEXT_ARM64
-.. autodata:: CONTEXT_CONTROL
-.. autodata:: CONTEXT_INTEGER
-.. autodata:: CONTEXT_SEGMENTS
-.. autodata:: CONTEXT_FLOATING_POINT
-.. autodata:: CONTEXT_DEBUG_REGISTERS
-.. autodata:: CONTEXT_EXTENDED_REGISTERS
-.. autodata:: CONTEXT_FULL
-.. autodata:: CONTEXT_ALL
-.. autodata:: CONTEXT_XSTATE
 .. autodata:: PAGE_NOACCESS
 .. autodata:: PAGE_READONLY
 .. autodata:: PAGE_READWRITE
@@ -2922,6 +3031,7 @@ WinDef
 .. autodata:: IMAGE_FILE_MACHINE_M32R
 .. autodata:: IMAGE_FILE_MACHINE_CEE
 .. autodata:: IMAGE_FILE_MACHINE_ARM64
+.. autodata:: IMAGE_FILE_MACHINE_TARGET_HOST
 .. autodata:: CERT_QUERY_OBJECT_FILE
 .. autodata:: CERT_QUERY_OBJECT_BLOB
 .. autodata:: CERT_QUERY_CONTENT_CERT
@@ -3234,6 +3344,37 @@ WinDef
 .. autodata:: CRYPT_SGCKEY
 .. autodata:: CRYPT_ARCHIVABLE
 .. autodata:: CRYPT_FORCE_KEY_PROTECTION_HIGH
+.. autodata:: CERT_RDN_ANY_TYPE
+.. autodata:: CERT_RDN_ENCODED_BLOB
+.. autodata:: CERT_RDN_OCTET_STRING
+.. autodata:: CERT_RDN_NUMERIC_STRING
+.. autodata:: CERT_RDN_PRINTABLE_STRING
+.. autodata:: CERT_RDN_TELETEX_STRING
+.. autodata:: CERT_RDN_T61_STRING
+.. autodata:: CERT_RDN_VIDEOTEX_STRING
+.. autodata:: CERT_RDN_IA5_STRING
+.. autodata:: CERT_RDN_GRAPHIC_STRING
+.. autodata:: CERT_RDN_VISIBLE_STRING
+.. autodata:: CERT_RDN_ISO646_STRING
+.. autodata:: CERT_RDN_GENERAL_STRING
+.. autodata:: CERT_RDN_UNIVERSAL_STRING
+.. autodata:: CERT_RDN_INT4_STRING
+.. autodata:: CERT_RDN_BMP_STRING
+.. autodata:: CERT_RDN_UNICODE_STRING
+.. autodata:: CERT_RDN_UTF8_STRING
+.. autodata:: CERT_RDN_TYPE_MASK
+.. autodata:: CERT_RDN_FLAGS_MASK
+.. autodata:: CERT_RDN_ENABLE_T61_UNICODE_FLAG
+.. autodata:: CERT_RDN_ENABLE_UTF8_UNICODE_FLAG
+.. autodata:: CERT_RDN_FORCE_UTF8_UNICODE_FLAG
+.. autodata:: CERT_RDN_DISABLE_CHECK_TYPE_FLAG
+.. autodata:: CERT_RDN_DISABLE_IE4_UTF8_FLAG
+.. autodata:: CRYPT_DECODE_NOCOPY_FLAG
+.. autodata:: CRYPT_DECODE_TO_BE_SIGNED_FLAG
+.. autodata:: CRYPT_DECODE_SHARE_OID_STRING_FLAG
+.. autodata:: CRYPT_DECODE_NO_SIGNATURE_BYTE_REVERSAL_FLAG
+.. autodata:: CRYPT_DECODE_ALLOC_FLAG
+.. autodata:: CRYPT_UNICODE_NAME_DECODE_DISABLE_IE4_UTF8_FLAG
 .. autodata:: CRYPT_ENCODE_DECODE_NONE
 .. autodata:: X509_CERT
 .. autodata:: X509_CERT_TO_BE_SIGNED
@@ -3372,6 +3513,10 @@ WinDef
 .. autodata:: CMSG_CTRL_VERIFY_SIGNATURE_EX
 .. autodata:: CMSG_CTRL_ADD_CMS_SIGNER_INFO
 .. autodata:: CMSG_CTRL_ENABLE_STRONG_SIGNATURE
+.. autodata:: CERT_SET_KEY_PROV_HANDLE_PROP_ID
+.. autodata:: CERT_SET_KEY_CONTEXT_PROP_ID
+.. autodata:: CERT_NCRYPT_KEY_SPEC
+.. autodata:: CERT_REQUEST_V1
 .. autodata:: WSADESCRIPTION_LEN
 .. autodata:: WSASYS_STATUS_LEN
 .. autodata:: WSAPROTOCOL_LEN

docs/source/winfuncs_generated.rst

@@ -326,6 +326,10 @@ Functions
 
 .. function:: CertCloseStore(hCertStore, dwFlags)
 
+.. function:: CryptSignAndEncodeCertificate(hBCryptKey, dwKeySpec, dwCertEncodingType, lpszStructType, pvStructInfo, pSignatureAlgorithm, pvHashAuxInfo, pbEncoded, pcbEncoded)
+
+.. function:: CryptSignCertificate(hBCryptKey, dwKeySpec, dwCertEncodingType, pbEncodedToBeSigned, cbEncodedToBeSigned, pSignatureAlgorithm, pvHashAuxInfo, pbSignature, pcbSignature)
+
 .. function:: OpenVirtualDisk(VirtualStorageType, Path, VirtualDiskAccessMask, Flags, Parameters, Handle)
 
 .. function:: AttachVirtualDisk(VirtualDiskHandle, SecurityDescriptor, Flags, ProviderSpecificFlags, Parameters, Overlapped)
@@ -592,6 +596,10 @@ Functions
 
 .. function:: UnmapViewOfFile(lpBaseAddress)
 
+.. function:: NCryptOpenKey(hProvider, phKey, pszKeyName, dwLegacyKeySpec, dwFlags)
+
+.. function:: NCryptOpenStorageProvider(phProvider, pszProviderName, dwFlags)
+
 .. function:: NetQueryDisplayInformation(ServerName, Level, Index, EntriesRequested, PreferredMaximumLength, ReturnedEntryCount, SortedBuffer)
 
 .. function:: NetUserEnum(servername, level, filter, bufptr, prefmaxlen, entriesread, totalentries, resume_handle)
@@ -696,6 +704,10 @@ Functions
 
 .. function:: FreeLibrary(hLibModule)
 
+.. function:: GetProcessInformation(hProcess, ProcessInformationClass, ProcessInformation, ProcessInformationSize)
+
+.. function:: SetProcessInformation(hProcess, ProcessInformationClass, ProcessInformation, ProcessInformationSize)
+
 .. function:: RtlGetCurrentPeb()
 
 .. function:: RegQueryValueExA(hKey, lpValueName, lpReserved, lpType, lpData, lpcbData)
@@ -1214,6 +1226,42 @@ Functions
 
 .. function:: LookupAccountNameW(lpSystemName, lpAccountName, Sid, cbSid, ReferencedDomainName, cchReferencedDomainName, peUse)
 
+.. function:: GetNativeSystemInfo(lpSystemInfo)
+
+.. function:: GetSystemInfo(lpSystemInfo)
+
+.. function:: IsWow64Process(hProcess, Wow64Process)
+
+.. function:: IsWow64Process2(hProcess, pProcessMachine, pNativeMachine)
+
+.. function:: IsWow64GuestMachineSupported(WowGuestMachine, MachineIsSupported)
+
+.. function:: GetSystemWow64DirectoryA(lpBuffer, uSize)
+
+.. function:: GetSystemWow64DirectoryW(lpBuffer, uSize)
+
+.. function:: GetSystemWow64Directory2A(lpBuffer, uSize, ImageFileMachineType)
+
+.. function:: GetSystemWow64Directory2W(lpBuffer, uSize, ImageFileMachineType)
+
+.. function:: Wow64DisableWow64FsRedirection(OldValue)
+
+.. function:: Wow64EnableWow64FsRedirection(Wow64FsEnableRedirection)
+
+.. function:: Wow64RevertWow64FsRedirection(OlValue)
+
+.. function:: Wow64GetThreadContext(hThread, lpContext)
+
+.. function:: Wow64SetThreadContext(hThread, lpContext)
+
+.. function:: Wow64SetThreadDefaultGuestMachine(Machine)
+
+.. function:: Wow64SuspendThread(hThread)
+
+.. function:: NtWow64ReadVirtualMemory64(hProcess, lpBaseAddress, lpBuffer, nSize, lpNumberOfBytesRead)
+
+.. function:: NtWow64WriteVirtualMemory64(hProcess, lpBaseAddress, lpBuffer, nSize, lpNumberOfBytesWritten)
+
 .. function:: FileTimeToSystemTime(lpFileTime, lpSystemTime)
 
 .. function:: SystemTimeToFileTime(lpSystemTime, lpFileTime)
@@ -1350,6 +1398,8 @@ Functions
 
 .. function:: CreateRemoteThread(hProcess, lpThreadAttributes, dwStackSize, lpStartAddress, lpParameter, dwCreationFlags, lpThreadId)
 
+.. function:: CreateRemoteThreadEx(hProcess, lpThreadAttributes, dwStackSize, lpStartAddress, lpParameter, dwCreationFlags, lpAttributeList, lpThreadId)
+
 .. function:: CreateProcessA(lpApplicationName, lpCommandLine, lpProcessAttributes, lpThreadAttributes, bInheritHandles, dwCreationFlags, lpEnvironment, lpCurrentDirectory, lpStartupInfo, lpProcessInformation)
 
 .. function:: CreateProcessW(lpApplicationName, lpCommandLine, lpProcessAttributes, lpThreadAttributes, bInheritHandles, dwCreationFlags, lpEnvironment, lpCurrentDirectory, lpStartupInfo, lpProcessInformation)
@@ -1370,12 +1420,8 @@ Functions
 
 .. function:: ReadProcessMemory(hProcess, lpBaseAddress, lpBuffer, nSize, lpNumberOfBytesRead)
 
-.. function:: NtWow64ReadVirtualMemory64(hProcess, lpBaseAddress, lpBuffer, nSize, lpNumberOfBytesRead)
-
 .. function:: WriteProcessMemory(hProcess, lpBaseAddress, lpBuffer, nSize, lpNumberOfBytesWritten)
 
-.. function:: NtWow64WriteVirtualMemory64(hProcess, lpBaseAddress, lpBuffer, nSize, lpNumberOfBytesWritten)
-
 .. function:: GetCurrentProcess()
 
 .. function:: CreateFileA(lpFileName, dwDesiredAccess, dwShareMode, lpSecurityAttributes, dwCreationDisposition, dwFlagsAndAttributes, hTemplateFile)
@@ -1468,14 +1514,6 @@ Functions
 
 .. function:: DeviceIoControl(hDevice, dwIoControlCode, lpInBuffer, nInBufferSize, lpOutBuffer, nOutBufferSize, lpBytesReturned, lpOverlapped)
 
-.. function:: Wow64DisableWow64FsRedirection(OldValue)
-
-.. function:: Wow64RevertWow64FsRedirection(OldValue)
-
-.. function:: Wow64EnableWow64FsRedirection(Wow64FsEnableRedirection)
-
-.. function:: Wow64GetThreadContext(hThread, lpContext)
-
 .. function:: SetConsoleCtrlHandler(HandlerRoutine, Add)
 
 .. function:: GlobalAlloc(uFlags, dwBytes)
@@ -1530,8 +1568,6 @@ Functions
 
 .. function:: GetProcessId(Process)
 
-.. function:: Wow64SetThreadContext(hThread, lpContext)
-
 .. function:: GetMappedFileNameW(hProcess, lpv, lpFilename, nSize)
 
 .. function:: GetMappedFileNameA(hProcess, lpv, lpFilename, nSize)

samples/find_value.py

@@ -18,6 +18,11 @@ def search_name_in_enum(target):
     for name, enum in meta.enums_walker():
         if match(target, name):
             print(name, enum)
+        if not issubclass(enum, gdef.EnumType):
+                continue
+        for enumvalue in enum.values:
+            if match(target, enumvalue.name):
+                print("Enum <{0!r}>".format(enumvalue))
 
 def search_name_in_struct(target):
     for name, struct in meta.structs_walker():
@@ -78,6 +83,13 @@ def search_value(target):
         if target == windef:
             print(repr(windef))
 
+    for name, enum in meta.enums_walker():
+        if not issubclass(enum, gdef.EnumType):
+                continue
+        for enumvalue in enum.values:
+            if target == enumvalue:
+                print("Enum <{0!r}>".format(enumvalue))
+
 parser = argparse.ArgumentParser(prog=__file__)
 parser.add_argument('target', help='The name or value to research in PythonForWindows generated definition')
 res = parser.parse_args()

tests/conftest.py

@@ -30,8 +30,11 @@ else:
                 assert p.bitness == 64
                 return p
     else:
+        # Force creation of AMD64 process on arm system
+        # TODO: also pop an ARM64 process when code works better with it
+        machine = gdef.IMAGE_FILE_MACHINE_AMD64 if windows.system.architecture == gdef.PROCESSOR_ARCHITECTURE_ARM64 else None
         def pop_proc_64(dwCreationFlags=DEFAULT_CREATION_FLAGS):
-            p = windows.utils.create_process(r"C:\Windows\system32\{0}".format(test_binary_name).encode("ascii"), dwCreationFlags=dwCreationFlags, show_windows=True)
+            p = windows.utils.create_process(r"C:\Windows\system32\{0}".format(test_binary_name).encode("ascii"), dwCreationFlags=dwCreationFlags, show_windows=True, machine=machine)
             assert p.bitness == 64
             return p
 
@@ -44,6 +47,9 @@ def generate_pop_and_exit_fixtures(proc_popers, ids=[], dwCreationFlags=DEFAULT_
     def pop_and_exit_process(request):
         proc_poper = request.param
         proc = proc_poper(dwCreationFlags=dwCreationFlags)
+        # Apply manually the xfail marker for a test on x86_on_arm64 for pe64 target (cross-heaven gate)
+        if windows.current_process._is_x86_on_arm64 and proc.bitness == 64:
+            request.applymarker("xfail") # Cross Heaven gate
         time.sleep(0.2) # Give time to the process to load :)
         print("Created {0} ({1}bits) for test".format(proc, proc.bitness))
         yield weakref.proxy(proc)  # provide the fixture value
@@ -103,16 +109,14 @@ class HandleDebugger(object):
         print(self.handles_types(self.get_new_handle()))
 
 
-current_process_hdebugger = HandleDebugger(windows.current_process.pid)
-current_process_hdebugger.refresh_handles()
 
 class NoLeakAssert(AssertionError):
     pass
 
 
-
 @pytest.fixture()
 def check_for_handle_leak(request):
+    current_process_hdebugger = HandleDebugger(windows.current_process.pid)
     x = current_process_hdebugger.refresh_handles()
     yield None
     leaked_handles = current_process_hdebugger.get_new_handle(x)
@@ -161,11 +165,9 @@ def pytest_configure(config):
 @pytest.hookimpl(hookwrapper=True, trylast=True)
 def pytest_runtest_makereport(item, call):
     outcome = yield
-    # print("Make report {0} | {1}".format(item, call))
     if call.when == "teardown" and call.excinfo and type(call.excinfo.value) == NoLeakAssert:
         x = outcome.get_result()
         x.outcome = "failed"
-        # import pdb;pdb.set_trace()
         x.LEAK = call.excinfo.value.args[0]
 
 

tests/pfwtest.py

@@ -21,14 +21,36 @@ windows_64bit_only = pytest.mark.skipif(not is_windows_64_bits, reason="Test for
 
 process_32bit_only = pytest.mark.skipif(not is_process_32_bits, reason="Test for 32bits process only")
 process_64bit_only = pytest.mark.skipif(not is_process_64_bits, reason="Test for 64bits process only")
-process_syswow_only = pytest.mark.skipif(not is_process_syswow, reason="Test for syswow process only")
+process_syswow_only = pytest.mark.skipif((not is_process_syswow) or windows.current_process._is_x86_on_arm64, reason="Test for syswow process only (ARM64 computer not supported)")
 require_admin = pytest.mark.skipif(not is_admin, reason="Test must be launched as admin")
 
+def process_architecture_only(target_archi):
+    return pytest.mark.skipif(windows.current_process.architecture != target_archi,
+                                reason="Test for {0} architecture process only".format(target_archi))
+
+def system_architecture_only(target_archi):
+        return pytest.mark.skipif(windows.system.architecture != target_archi,
+                                reason="Test for {0} architecture system only".format(target_archi))
+
+@pytest.fixture(scope="function")
+def check_cross_heaven_gate_arm64_xfail(request):
+    """Mark test crossing the heaven gate as xfail on x86 to arm64"""
+    if windows.current_process._is_x86_on_arm64:
+        request.applymarker("xfail")
+
+def cross_heaven_gates(tstfunc):
+    tstfunc = pytest.mark.usefixtures("check_cross_heaven_gate_arm64_xfail")(tstfunc)
+    tstfunc = pytest.mark.cross_heaven_gate(tstfunc)
+    return tstfunc
 
 check_for_gc_garbage = pytest.mark.usefixtures("check_for_gc_garbage")
 check_for_handle_leak = pytest.mark.usefixtures("check_for_handle_leak")
 
-test_binary_name = "winver.exe"
+# msiexec.exe is new best choice:
+# - a real process (looking at calc.exe)
+# - GUI and wait for a click to close when no param
+# - Is ARM64CE on arm -> can be exec as AMD64 or ARM64 with `machine`` param
+test_binary_name = "msiexec.exe"
 DEFAULT_CREATION_FLAGS = gdef.CREATE_NEW_CONSOLE
 
 
@@ -57,8 +79,22 @@ def check_injected_python_installed(request):
         pytest.skip("Python {0}b not installed -> skipping test with python injection into {0}b process".format(proc.bitness))
     return None
 
+@pytest.fixture
+def check_dll_injection_target_architecture(request):
+    # Find the process parameter
+    procparams = [argname for argname in request.fixturenames if argname.startswith("proc")]
+    if len(procparams) != 1:
+        raise ValueError("Could not find the fixture name of the injected python")
+    procparam = procparams[0]
+    proc = request.getfixturevalue(procparam)
+    # xfail ARM64 injection as its not implemented
+    if proc.architecture == gdef.IMAGE_FILE_MACHINE_ARM64:
+        request.applymarker("xfail")
 
-python_injection =  pytest.mark.usefixtures("check_injected_python_installed")
+
+
+dll_injection =  pytest.mark.usefixtures("check_dll_injection_target_architecture", "check_cross_heaven_gate_arm64_xfail")
+python_injection =  pytest.mark.usefixtures("check_dll_injection_target_architecture", "check_injected_python_installed", "check_cross_heaven_gate_arm64_xfail")
 
 
 ## P2 VS PY3

tests/test_cpuid.py

@@ -1,6 +1,11 @@
+import pytest
+
 import windows
+import windows.generated_def as gdef
 import windows.native_exec.cpuid
 
 def test_native_exec_cpuid():
+    if windows.current_process.architecture == gdef.IMAGE_FILE_MACHINE_ARM64:
+        pytest.skip("CPUID not testable on ARM64")
     assert windows.native_exec.cpuid.do_cpuid(0)
     assert windows.native_exec.cpuid.get_proc_family_model()

tests/test_evtlog.py

@@ -65,7 +65,7 @@ def test_new_event():
     pre_events = chan.events
     p = windows.utils.create_process(POWERSHELL_PATH, POWERSHELL_ARG, show_windows=False)
     p.wait()
-    import time; time.sleep(1) # It seems to take some time to log the event
+    import time; time.sleep(5) # It seems to take some time to log the event
     post_events = chan.events
     assert len(post_events) > len(pre_events)
     nb_new_events = len(post_events) - len(pre_events)

tests/test_generated_def.py

@@ -156,6 +156,9 @@ def test_HRESULT_FACILITY_macro():
     # RPC_E_INVALID_HEADER(0x80010111)
     assert gdef.HRESULT_FACILITY(gdef.RPC_E_INVALID_HEADER) == gdef.FACILITY_RPC == 1
 
+def test_ProcThreadAttributeValue_results():
+    assert gdef.PROC_THREAD_ATTRIBUTE_PARENT_PROCESS == 0x20000
+    assert gdef.PROC_THREAD_ATTRIBUTE_MACHINE_TYPE   == 0x20019
 
 # typedef struct _DnsRecordFlags
 # {

tests/test_handle.py

@@ -1,13 +1,16 @@
 import windows
 import windows.pipe
 
+from .pfwtest import *
+
+@cross_heaven_gates # windows.system.handles
 def test_handle_process_id():
     handle_with_process = [h for h in windows.system.handles if h.dwProcessId]
     handle = handle_with_process[-1]
     proc = handle.process
     assert proc.pid == handle.dwProcessId == handle.pid
 
-
+@cross_heaven_gates # windows.current_process.handles
 def test_local_handle_type():
     t = windows.current_process.threads[0]
     th = t.handle
@@ -19,8 +22,8 @@ def test_local_handle_type():
 PIPE_NAME = "PFW_Test_handle_Pipe"
 TEST_FILE_FOR_HANDLE = r"C:\Windows\explorer.exe"
 
+@python_injection
 def test_remote_handle_type_and_name(proc32_64):
-    # tmpfile
     proc32_64.execute_python("import windows; import windows.pipe")
     # A filename that a normal process should not have a handle on (to be sur)
     proc32_64.execute_python(r"""f = open(r"{filename}")""".format(filename=TEST_FILE_FOR_HANDLE))

tests/test_injection.py

@@ -10,7 +10,7 @@ import windows
 import windows.generated_def as gdef
 
 from .conftest import pop_proc_32, pop_proc_64
-from .pfwtest import DEFAULT_CREATION_FLAGS
+from .pfwtest import *
 
 @pytest.fixture(params=
     [(pop_proc_32, DEFAULT_CREATION_FLAGS),
@@ -34,17 +34,20 @@ def proc_3264_runsus(request):
     del proc
 
 # Its really the same test as test_process.test_load_library but with suspended process as well
+@dll_injection
 def test_dll_injection(proc_3264_runsus):
     assert (not proc_3264_runsus.peb.Ldr) or ("wintrust.dll" not in [mod.name for mod in proc_3264_runsus.peb.modules])
     modaddr = windows.injection.load_dll_in_remote_process(proc_3264_runsus, "wintrust.dll")
     wintrustmod = [mod for mod in proc_3264_runsus.peb.modules if mod.name == "wintrust.dll"][0]
     assert wintrustmod.baseaddr == modaddr
 
+@dll_injection
 def test_dll_injection_error_reporting(proc_3264_runsus):
     with pytest.raises(windows.injection.InjectionFailedError) as excinfo:
         windows.injection.load_dll_in_remote_process(proc_3264_runsus, "NO_A_DLL.dll")
     assert excinfo.value.__cause__.winerror == gdef.ERROR_MOD_NOT_FOUND
 
+@dll_injection
 def test_dll_injection_access_denied(proc_3264_runsus, tmpdir):
         """Emulate injection of MsStore python, were its DLL are not executable by any other append
         See: https://github.com/hakril/PythonForWindows/issues/72

tests/test_native_utils.py

@@ -8,21 +8,23 @@ from windows.pycompat import basestring, int_types
 
 from .pfwtest import *
 
+
+
 @check_for_gc_garbage
 class TestNativeUtils(object):
-    @process_64bit_only
+    @process_architecture_only(gdef.IMAGE_FILE_MACHINE_AMD64)
     def test_strlenw64(self):
         strlenw64 = windows.native_exec.create_function(nativeutils.StrlenW64.get_code(), [gdef.UINT, gdef.LPCWSTR])
         assert strlenw64("YOLO") == 4
         assert strlenw64("") == 0
 
-    @process_64bit_only
+    @process_architecture_only(gdef.IMAGE_FILE_MACHINE_AMD64)
     def test_strlena64(self):
         strlena64 = windows.native_exec.create_function(nativeutils.StrlenA64.get_code(), [gdef.UINT, gdef.LPCSTR])
         assert strlena64(b"YOLO") == 4
         assert strlena64(b"") == 0
 
-    @process_64bit_only
+    @process_architecture_only(gdef.IMAGE_FILE_MACHINE_AMD64)
     def test_getprocaddr64(self):
         getprocaddr64 = windows.native_exec.create_function(nativeutils.GetProcAddress64.get_code(), [gdef.ULONG64, gdef.LPCWSTR, gdef.LPCSTR])
         k32 = [mod for mod in windows.current_process.peb.modules if mod.name == "kernel32.dll"][0]
@@ -37,19 +39,19 @@ class TestNativeUtils(object):
         assert getprocaddr64("YOLO.DLL", b"whatever") == 0xfffffffffffffffe
         assert getprocaddr64("KERNEL32.DLL", b"YOLOAPI") == 0xffffffffffffffff
 
-    @process_32bit_only
+    @process_architecture_only(gdef.IMAGE_FILE_MACHINE_I386)
     def test_strlenw32(self):
         strlenw32 = windows.native_exec.create_function(nativeutils.StrlenW32.get_code(), [gdef.UINT, gdef.LPCWSTR])
         assert strlenw32("YOLO") == 4
         assert strlenw32("") == 0
 
-    @process_32bit_only
+    @process_architecture_only(gdef.IMAGE_FILE_MACHINE_I386)
     def test_strlena32(self):
         strlena32 = windows.native_exec.create_function(nativeutils.StrlenA32.get_code(), [gdef.UINT, gdef.LPCSTR])
         assert strlena32(b"YOLO") == 4
         assert strlena32(b"") == 0
 
-    @process_32bit_only
+    @process_architecture_only(gdef.IMAGE_FILE_MACHINE_I386)
     def test_getprocaddr32(self):
         getprocaddr32 = windows.native_exec.create_function(nativeutils.GetProcAddress32.get_code(), [gdef.UINT, gdef.LPCWSTR, gdef.LPCSTR])
         k32 = [mod for mod in windows.current_process.peb.modules if mod.name == "kernel32.dll"][0]

tests/test_parse_pe.py

@@ -9,15 +9,26 @@ from .pfwtest import *
 
 @pytest.fixture(params=[None, pop_proc_32, pop_proc_64], ids=["local-pe", "remote-pe32", "remote-pe64"])
 def pe(request):
-    # Pe will be kernelbase.dll
+    # Pe will be kernelbase.dll or kernel32.dll
+    # Cannot hardcode peb.modules[2] as it may be xtajitX.dll on arm64
     if request.param is None:
-        yield windows.current_process.peb.modules[2].pe
+        yield [mod for mod in windows.current_process.peb.modules if mod.name.lower().startswith("kernel")][0].pe
         return
 
     pop_proc = request.param
     proc = pop_proc()
-    time.sleep(0.01)
-    yield proc.peb.modules[2].pe
+
+    for i in range(10):
+        try:
+            time.sleep(0.1)
+            # Pe will be kernelbase.dll or kernel32.dll
+            yield [mod for mod in windows.current_process.peb.modules if mod.name.lower().startswith("kernel")][0].pe
+            break
+        except ValueError:
+            if i == 9:
+                # Last change failed
+                raise
+            continue # PEB.Ldr not ready yet
     proc.exit(0)
 
 PE_DOTNET32_DLL_NAME = "test_pe_dotnet32.dll"
@@ -83,10 +94,7 @@ def test_pe_parsing_strange_optional_header_size(tmp_path, proc32):
     # Also check that section retrieval works (as its position is based on OptionalHeader Size)
     assert set(s.name for s in mod.pe.sections) == {".text", ".data", ".l1"}
 
-
-
-
-#  Make a test from current_process parsing ?
+@dll_injection
 def test_pe_parsing_dotnet32_process_64(proc64, pe_dotnet32):
     # .NET pe32 loadable in 64bit process -> rewrite of the OptionalHeader
     mod = proc64.load_library(pe_dotnet32)
@@ -103,6 +111,7 @@ def test_pe_parsing_dotnet32_process_64(proc64, pe_dotnet32):
     assert mod.pe.sections
     assert ".text" in  set(s.name for s in mod.pe.sections)
 
+@dll_injection
 def test_pe_parsing_dotnet32_current_process_64(proc64, pe_dotnet32):
     # .NET pe32 loadable in 64bit process -> rewrite of the OptionalHeader
     # So we injecte python code in a the remote proc64 to test the parsing from itself
@@ -118,6 +127,27 @@ def test_pe_parsing_dotnet32_current_process_64(proc64, pe_dotnet32):
         assert imported_dlls == ['mscoree.dll']
         assert ".text" in  sections_names
 
+# PE header of Syschpe32\ntdll.dll with a 8 chars sections .hexpthk that broke the parseur
+# This PE as 8 bytes sections name + VirtualSize non aligned on 0x100 so there is a non-null non-ascii byte after the name
+PE_SECTION_8CHARS = b"""
+eJzzjZrAwMzAwMACxP//MzDsYIAABwbC4AMRagYbCHBlYPBhZEYRu8HAxMjNyMnAwMQAwSAgAMUK
+II4DhA2UY4VKw2hwQLFAmBBTFSBqQYQAwig4MECyg4ogAGiuMRZxvQgIuMDIAPcDAxuqGgUGhgS9
+SAjQhgqA1XGgqnNgYDigFwUBYHmYX7gwzHtAmW9GwSgYBfQAnU8b3zAAy4aMr/+BQNTGwIGht0aF
+IwMkF54BKg0yGBQcGAL+izoApTrfHJ4wvMAAB/+AA4/UnJx8hfL8opwUhbSi/FyFRIWAypKM/Dy3
+/KLwzLyU/PJihZLU4hIFUMU5CoYd0DBAsJuAbBsD7OpA7YsEIM4B4goD3GIMDO6pJcElKR6JeSk5
+qSB+eFFmSapbJpgTlJqYAmUyAFOXa0VqMkN2alFeao6xkV5KTg6NPDkKcAIAM7/CEw=="""
+
+def test_pe_parsing_section_8_chars(proc32, tmp_path):
+    pe_path = (tmp_path / "pe_parsing_8chars_section.exe")
+    pe_data = pe_data = zlib.decompress(b64decode(PE_SECTION_8CHARS))
+
+    with pe_path.open("wb") as f:
+        f.write(pe_data)
+
+    mod = proc32.load_library(str(pe_path))
+    # check that section retrieval works
+    assert set(s.name for s in mod.pe.sections) == {u".XXXXXXX", u".YYYYYYY", u".ZZZZZZZ"}
+
 # A "Portable Executable 32 .NET Assembly" DLL
 # Result of compiling a simple hello-world
 # Can be loaded into a 64b process to witness 32 -> 64b PE conversion at load time

tests/test_pipe.py

@@ -33,6 +33,8 @@ with windows.pipe.create("{pipe}") as np:
 
 @python_injection
 def test_pipe_echo_server(proc32_64):
+    # Verify that injection / load of Pfw in remote works with a first safe stub
+    proc32_64.execute_python("import windows")
     t = proc32_64.execute_python_unsafe(rcode_test_echo_pipe.format(pipe=PIPE_NAME))
     time.sleep(0.5)
     assert not t.is_exit
@@ -45,6 +47,8 @@ def test_pipe_echo_server(proc32_64):
 
 @python_injection
 def test_pipe_recv_object(proc32_64):
+    # Verify that injection / load of Pfw in remote works with a first safe stub
+    proc32_64.execute_python("import windows")
     # not the good way to do the exchange (race possible)
     # Just for the sake of the test
     proc32_64.execute_python_unsafe(rcode_test_ipc_pipe.format(pipe=PIPE_NAME))

tests/test_process.py

@@ -170,6 +170,40 @@ class TestProcessWithCheckGarbage(object):
                 current_proc.read_memory(waddr, 0x20) # Check that Reading dumbly fails
             assert current_proc.read_wstring(waddr) ==  test_string
 
+    def test_virtual_alloc_current_process(self):
+        current_proc = windows.current_process
+        addr1 = current_proc.virtual_alloc(0x1000, prot=gdef.PAGE_EXECUTE_READWRITE)
+        meminfo = current_proc.query_memory(addr1)
+        assert meminfo.AllocationBase == addr1
+        assert meminfo.AllocationProtect == gdef.PAGE_EXECUTE_READWRITE
+        assert meminfo.Type == gdef.MEM_PRIVATE
+        assert meminfo.State == gdef.MEM_COMMIT
+        assert meminfo.Protect == gdef.PAGE_EXECUTE_READWRITE
+        del meminfo
+
+        addr2 = current_proc.virtual_alloc(0x1000, prot=gdef.PAGE_READONLY, type=gdef.MEM_RESERVE)
+        meminfo = current_proc.query_memory(addr2)
+        assert meminfo.AllocationBase == addr2
+        assert meminfo.AllocationProtect == gdef.PAGE_READONLY
+        assert meminfo.Type == gdef.MEM_PRIVATE
+        assert meminfo.State == gdef.MEM_RESERVE
+
+    def test_virtual_alloc(self, proc32_64):
+        addr1 = proc32_64.virtual_alloc(0x1000, prot=gdef.PAGE_EXECUTE_READWRITE)
+        meminfo = proc32_64.query_memory(addr1)
+        assert meminfo.AllocationBase == addr1
+        assert meminfo.AllocationProtect == gdef.PAGE_EXECUTE_READWRITE
+        assert meminfo.Type == gdef.MEM_PRIVATE
+        assert meminfo.State == gdef.MEM_COMMIT
+        assert meminfo.Protect == gdef.PAGE_EXECUTE_READWRITE
+
+        addr2 = proc32_64.virtual_alloc(0x1000, prot=gdef.PAGE_READONLY, type=gdef.MEM_RESERVE)
+        meminfo = proc32_64.query_memory(addr2)
+        assert meminfo.AllocationBase == addr2
+        assert meminfo.AllocationProtect == gdef.PAGE_READONLY
+        assert meminfo.Type == gdef.MEM_PRIVATE
+        assert meminfo.State == gdef.MEM_RESERVE
+
     def test_query_memory(self, proc32_64):
         addr = proc32_64.virtual_alloc(0x2000, prot=gdef.PAGE_EXECUTE_READWRITE)
         proc32_64.virtual_protect(addr, 0x2000, gdef.PAGE_READONLY)
@@ -195,6 +229,7 @@ class TestProcessWithCheckGarbage(object):
 
     @windows_64bit_only
     def test_execute_to_64(self, proc64):
+        assert proc64.architecture == gdef.IMAGE_FILE_MACHINE_AMD64, "TODO: better machine fixture for ARM64"
         with proc64.allocated_memory(0x1000) as addr:
             shellcode = x64.MultipleInstr()
             shellcode += x64.Mov('RAX', 0x4242424243434343)
@@ -213,6 +248,7 @@ class TestProcessWithCheckGarbage(object):
             dword = proc32_64.read_dword(addr)
             assert dword == 0x42424242
 
+    @python_injection
     def test_execute_python_good_version(self, proc32_64):
         PIPE_NAME = "PFW_TEST_Pipe"
         rcode = r"""import sys; import windows; import windows.pipe; windows.pipe.send_object("{pipe}", list(sys.version_info))"""
@@ -292,6 +328,7 @@ class TestProcessWithCheckGarbage(object):
         # Check the RemotePythonError contains the remote exception text
         assert b"ValueError: EXCEPTION_MESSAGE" in ar.value.args[0]
 
+    @python_injection
     def test_execute_python_create_console(self, proc32_64):
         res = proc32_64.execute_python("import windows; windows.utils.create_console()")
 
@@ -351,6 +388,7 @@ class TestProcessWithCheckGarbage(object):
 
     @windows_64bit_only
     def test_set_thread_context_64(self, proc64):
+        assert proc64.architecture == gdef.IMAGE_FILE_MACHINE_AMD64, "TODO: better machine fixture for ARM64"
         code =  x64.MultipleInstr()
         code += x64.Label(":LOOP")
         code += x64.Jmp(":LOOP")
@@ -368,17 +406,19 @@ class TestProcessWithCheckGarbage(object):
         time.sleep(0.1)
         assert t.exit_code == 0x11223344
 
-
+    @dll_injection
     def test_load_library(self, proc32_64):
         DLL = "wintrust.dll"
         proc32_64.load_library(DLL)
         assert DLL in [m.name for m in proc32_64.peb.modules]
 
+    @dll_injection
     def test_load_library_suspended(self, proc32_64_suspended):
         DLL = "wintrust.dll"
         proc32_64_suspended.load_library(DLL)
         assert DLL in [m.name for m in proc32_64_suspended.peb.modules]
 
+    @dll_injection
     def test_load_library_unicode_name(self, proc32_64, tmpdir):
         mybitness = windows.current_process.bitness
         UNICODE_FILENAME = u'\u4e2d\u56fd\u94f6\u884c\u7f51\u94f6\u52a9\u624b.dll'
@@ -481,10 +521,12 @@ class TestProcessWithCheckGarbage(object):
         # Check type of teb.peb is the correct subclass (with modules & co)
         assert teb.peb.modules
 
+    @cross_heaven_gates
     def test_thread_teb_base(self, proc32_64):
         t = proc32_64.threads[0]
         assert t.teb_base != 0
 
+    @cross_heaven_gates
     def test_teb(self, proc32_64):
         teb = proc32_64.threads[0].teb
         if proc32_64.bitness == 32:
@@ -497,6 +539,7 @@ class TestProcessWithCheckGarbage(object):
         assert teb.peb.modules
 
     @windows_64bit_only
+    @cross_heaven_gates
     def test_thread_teb_syswow_base(self, proc32):
         t = proc32.threads[0]
         assert t.teb_base != 0
@@ -504,6 +547,7 @@ class TestProcessWithCheckGarbage(object):
         assert t.teb_base == t.teb_syswow_base + 0x2000
 
     @windows_64bit_only
+    @cross_heaven_gates
     def test_thread_teb_syswow(self, proc32):
         teb_syswow = proc32.threads[0].teb_syswow
         assert type(teb_syswow) == windows.winobject.process.RemoteTEB64

tests/test_rpc.py

@@ -114,3 +114,85 @@ def test_rpc_uac_call():
     assert proc.pid == pid
     proc.exit(0)
 
+
+class DbgRpcClient(windows.rpc.RPCClient):
+    def __init__(self, *args, **kwargs):
+        super(DbgRpcClient, self).__init__(*args, **kwargs)
+        self.last_response_was_view = False
+
+    def _get_response_effective_data(self, response):
+        self.last_response_was_view = response.view_is_valid
+        return super(DbgRpcClient, self)._get_response_effective_data(response)
+
+
+FIREWALL_RPC_IID = "2fb92682-6599-42dc-ae13-bd2ca89bd11c"
+
+Proc0_RPC_FWOpenPolicyStore = 0
+Proc9_RPC_FWEnumFirewallRules = 9
+
+def test_rpc_response_as_view():
+    """Check that parsing response as view in RPC Client works. Testing after a bug in 32b RPCCLient"""
+    # We test what by using a RPC endpoint that returns a lot of info : forcing a response in a view
+    # In this case we use the Firewall RPC and we list all Firerules.
+    # We use a custom RPCClient subclasse to track if last response was a view
+    client = windows.rpc.find_alpc_endpoint_and_connect(FIREWALL_RPC_IID, sid=gdef.WinLocalSid)
+    client.__class__ = DbgRpcClient
+    iid = client.bind(FIREWALL_RPC_IID)
+
+    # https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-fasp/230d1ae7-b42e-4d9c-b997-b1463aaa0ded
+    # !\x02\x02\x00\x01\x00\x00\x00\x00\x00\x00\x00
+    # Binaryversion : 0x022f
+    # FW_STORE_TYPE_LOCAL
+    # FW_POLICY_ACCESS_RIGHT_READ
+    # Flags = 0
+    resp1 = client.call(iid, Proc0_RPC_FWOpenPolicyStore, params=b"!\x02\x02\x00\x01\x00\x00\x00\x00\x00\x00\x00")
+    rawpolstore = resp1[:20]
+    assert not client.last_response_was_view
+
+    # Proc9_RPC_FWEnumFirewallRules
+    # \x00\x00\x03\x00\xff\xff\xff\x7f\x07\x00
+    # https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-fasp/36cddff4-c427-4863-a58d-3d913a12b221
+    # FW_PROFILE_TYPE_ALL : 0x7FFFFFFF
+    # FW_RULE_STATUS_CLASS_OK +  FW_RULE_STATUS_PARTIALLY_IGNORED = 0x00010000 + 0x00020000
+    # Flags = 7 ?
+    resp2 = client.call(iid, Proc9_RPC_FWEnumFirewallRules, params=rawpolstore + b"\x00\x00\x03\x00\xff\xff\xff\x7f\x07\x00")
+    assert client.last_response_was_view
+
+# This cannot work as is: as juste calling NtAlpcDeleteSectionView does not works.
+# We need to disconnect from the port or (guess) reuse the message (based on ID ?) so that the serv known we are done with the message and can suppress it.
+# More alpc client/serer test need to be done
+
+# def test_rpc_response_as_view_is_unmapped():
+#     """Test that when a RCP client response as a view, it is unmapped and does not take place in memory ater the call
+#     It's not private memory, but it take some place in the AS : which can be problematic in 32b python"""
+#     # The logic we use : make a LOT of call to an API known to send response as a view. And monitor the evolution of WorkingSetSize
+#     client = windows.rpc.find_alpc_endpoint_and_connect(FIREWALL_RPC_IID, sid=gdef.WinLocalSid)
+#     client.__class__ = DbgRpcClient
+#     iid = client.bind(FIREWALL_RPC_IID)
+#
+#     # https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-fasp/230d1ae7-b42e-4d9c-b997-b1463aaa0ded
+#     # !\x02\x02\x00\x01\x00\x00\x00\x00\x00\x00\x00
+#     # Binaryversion : 0x022f
+#     # FW_STORE_TYPE_LOCAL
+#     # FW_POLICY_ACCESS_RIGHT_READ
+#     # Flags = 0
+#     resp1 = client.call(iid, Proc0_RPC_FWOpenPolicyStore, params=b"!\x02\x02\x00\x01\x00\x00\x00\x00\x00\x00\x00")
+#     rawpolstore = resp1[:20]
+#     assert not client.last_response_was_view
+#     initial_ws_size = windows.current_process.memory_info.WorkingSetSize
+#     ws_sizes = []
+#
+#     for i in range(100):
+#         # Proc9_RPC_FWEnumFirewallRules
+#         # \x00\x00\x03\x00\xff\xff\xff\x7f\x07\x00
+#         # https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-fasp/36cddff4-c427-4863-a58d-3d913a12b221
+#         # FW_PROFILE_TYPE_ALL : 0x7FFFFFFF
+#         # FW_RULE_STATUS_CLASS_OK +  FW_RULE_STATUS_PARTIALLY_IGNORED = 0x00010000 + 0x00020000
+#         # Flags = 7 ?
+#         resp2 = client.call(iid, Proc9_RPC_FWEnumFirewallRules, params=rawpolstore + b"\x00\x00\x03\x00\xff\xff\xff\x7f\x07\x00")
+#         assert client.last_response_was_view
+#         ws_sizes.append(windows.current_process.memory_info.WorkingSetSize - initial_ws_size)
+#         print("WorkingSetSize: {0}".format(windows.current_process.memory_info.WorkingSetSize))
+#     assert max(ws_sizes) - min(ws_sizes) < (1024 ** 2) # We should not vary more than 1 MO ?
+#     # Check if not all ws_size is not 4k bigger that the last one
+#     assert not all((ws_sizes[i+1] - ws_sizes[i] > 0x1000) for i in range(len(ws_sizes) - 1))

tests/test_simple_arm64.py

@@ -0,0 +1,211 @@
+try:
+    import capstone
+except ImportError as e:
+    capstone = None
+import pytest
+
+import windows.native_exec.simple_arm64 as arm64
+from windows.native_exec.simple_arm64 import *
+
+from windows.pycompat import int_types
+
+if capstone:
+    disassembleur = capstone.Cs(capstone.CS_ARCH_ARM64, capstone.CS_MODE_ARM)
+    disassembleur.detail = True
+
+@pytest.fixture
+def need_capstone():
+    if capstone is None:
+        raise pytest.skip("Capstone is not installed")
+    return True
+
+pytestmark = pytest.mark.usefixtures("need_capstone")
+
+
+def disas(x):
+    return list(disassembleur.disasm(x, 0))
+
+
+class CheckInstr(object):
+    def __init__(self, instr_to_test, expected_result=None, immediat_accepted=None, must_fail=None, debug=False):
+        self.instr_to_test = instr_to_test
+        self.immediat_accepted = immediat_accepted
+        self.expected_result = expected_result
+        self.must_fail = must_fail
+        self.debug = debug
+        self.callargs = None
+
+
+    def __call__(self, *args):
+        assert args is not None
+        self.callargs = args
+        return self
+
+    def __repr__(self):
+        if self.must_fail:
+            return "MustFail:{0}{1}".format(self.instr_to_test.__name__, self.callargs)
+        return "{0}{1}".format(self.instr_to_test.__name__, self.callargs)
+
+    def dotest(self):
+        assert self.callargs is not None
+        args = self.callargs
+        try:
+            if self.debug:
+                import pdb;pdb.set_trace()
+                pdb.DONE = True
+            arm64.DEBUG = self.debug
+            res = bytes(self.instr_to_test(*args).get_code())
+            if self.debug:
+                print(repr(res))
+        except ValueError as e:
+            if self.must_fail == True:
+                return True
+            else:
+                raise
+        else:
+            if self.must_fail:
+                raise ValueError("Instruction did not failed as expected")
+        capres_list = disas(res)
+        if not capres_list:
+            raise AssertionError("Trying to disas an instruction resulted no disassembled instr")
+        if len(capres_list) != 1:
+            raise AssertionError("Trying to disas an instruction resulted in multiple disassembled instrs: {0}".format(capres_list))
+        capres = capres_list[0]
+        print("{0} {1}".format(capres.mnemonic, capres.op_str))
+        if self.expected_result is not None:
+            if "{0} {1}".format(capres.mnemonic, capres.op_str).strip() == self.expected_result:
+                return True
+            else:
+                raise AssertionError("Expected result <{0}> got <{1}>".format(self.expected_result, "{0} {1}".format(capres.mnemonic, capres.op_str)))
+        if len(res) != len(capres.bytes):
+            print("<{0}> vs <{1}>".format(repr(res), repr(capres.bytes)))
+            raise AssertionError("Not all bytes have been used by the disassembler")
+        self.compare_mnemo(capres)
+        self.compare_args(args, capres)
+        return True
+
+    def compare_mnemo(self, capres):
+        expected = self.instr_to_test.__name__.lower()
+        if expected != capres.mnemonic:
+            raise AssertionError("Expected menmo {0} got {1}".format(expected, str(capres.mnemonic)))
+        return True
+
+    def compare_args(self, args, capres):
+        capres_op = list(capres.operands)
+        # We may have != number of operand as shift are:
+        #    - arguments for simple_arm64
+        #    - atribute of immediat for capstone
+        if not len(capres_op) <= len(args):
+            raise AssertionError("Expected at most {0} operands got {1}".format(len(args), len(capres_op)))
+
+        opargit = iter(args) # allow manually using next() to get next simple_arm64 arg for shift compare
+        # capres_op must be first in zip (as its smaller) or last next(opargit) will be consommed by zip
+        for cap_op, op_args in zip(capres_op, opargit):
+            if isinstance(op_args, str):  # Register
+                if cap_op.type != capstone.arm64.ARM64_OP_REG:
+                    raise AssertionError("Expected args {0} operands got {1}".format(op_args, capres_op))
+                if op_args.lower() != capres.reg_name(cap_op.reg).lower():
+                    raise AssertionError("Expected register <{0}> got {1}".format(op_args.lower(), capres.reg_name(cap_op.reg).lower()))
+            elif isinstance(op_args, int_types):
+                if (op_args != cap_op.imm) and not (self.immediat_accepted and self.immediat_accepted == cap_op.imm):
+                    raise AssertionError("Expected Immediat <{0}> got {1}".format(op_args, cap_op.imm))
+                cap_shift = cap_op.shift
+                if not (cap_shift.type == cap_shift.value == 0):
+                    self.compare_shift(next(opargit), cap_shift)
+            else:
+                raise ValueError("Unknow argument {0} of type {1}".format(op_args, type(op_args)))
+
+        # Check that no argument were unused in args
+        # As args + shift should perfectly match the capres_op
+        sentinel = object()
+        nextarg = next(opargit, sentinel)
+        if nextarg != sentinel:
+            # Ignore a leading LSL #0 shift, as it should be authorized but not displayed by disassembler
+            shift = Shift.parse(nextarg)
+            if not (shift.type == "LSL" and shift.value == 0):
+                raise ValueError("Non consomated argument: {0} (probable non-encoded shift)".format(nextarg))
+
+    if capstone:
+        SHIFT_TYPE_TO_CAPSTONE = {
+            "LSL": capstone.arm64.ARM64_SFT_LSL,
+            "LSR": capstone.arm64.ARM64_SFT_LSR,
+            "ASR": capstone.arm64.ARM64_SFT_ASR,
+            "ROR": capstone.arm64.ARM64_SFT_ROR,
+            # "MSL": apstone.arm64.ARM64_SFT_MSL # Not yet used in PFW
+        }
+
+    def compare_shift(self, shiftstr, cap_shift):
+        shift = Shift.parse(shiftstr)
+        if not self.SHIFT_TYPE_TO_CAPSTONE[shift.type] == cap_shift.type:
+            raise ValueError("Shift type mismatch: expected {0} got {1}".format(shift.type, cap_shift.type))
+        if not shift.value == cap_shift.value:
+            raise ValueError("Shift value mismatch: expected {0} got {1}".format(shift.value, cap_shift.value))
+        return True
+
+
+def test_shift_parsing():
+    assert Shift.parse("LSL #0")
+    assert Shift.parse("LSL #12")
+    assert Shift.parse("LSL #1")
+    assert Shift.parse("LSR #1")
+
+    assert Shift.parse("ROR #0").type == "ROR"
+    assert Shift.parse("LSL #0").type == "LSL"
+    assert Shift.parse("LSL #0").value == 0
+    assert Shift.parse("LSL #1").type == "LSL"
+    assert Shift.parse("LSL #1").value == 1
+
+    assert not Shift.parse("LSX #1")
+    assert not Shift.parse("LSX ##1")
+    assert not Shift.parse("LSX #")
+
+@pytest.mark.parametrize("checkinstr", [
+    CheckInstr(Add)('W0', 'W0', 0),
+    CheckInstr(Add)('W1', 'W0', 0),
+    CheckInstr(Add)('W30', 'W12', 0),
+    CheckInstr(Add)('W0', 'W0', 1),
+    CheckInstr(Add)('X0', 'X0', 0),
+    CheckInstr(Add)('X30', 'X12', 0),
+    CheckInstr(Add)('X0', 'X0', 1),
+    CheckInstr(Add)('X11', 'X12', 0x123),
+    CheckInstr(Add)('X11', 'X12', 0x123, "LSL #0"),
+    CheckInstr(Add)('X11', 'X12', 0x123, "LSL #12"),
+    CheckInstr(Add, must_fail=True)('X11', 'W12', 0x123), # Bitness mismatch
+    CheckInstr(Add, must_fail=True)('BADREG', 'X12', 0),
+    CheckInstr(Add, must_fail=True)('X11', 'X12', 0x123, "LSL #1234"),
+    CheckInstr(Add, must_fail=True)('X11', 'X12', 0x12345678),
+
+    CheckInstr(Movz)('X0', 0),
+    CheckInstr(Movz)('X0', 0, "LSL #32"),
+    CheckInstr(Movz)('X18', 0, "LSL #48"),
+    CheckInstr(Movz)('W18', 0, "LSL #16"),
+    CheckInstr(Movz, must_fail=True)('X0', 0, "LSL #12"), # Invalid LSL for MovWideImmediat
+    CheckInstr(Movz, must_fail=True)('W0', 0, "LSL #32"),
+    CheckInstr(Movz, must_fail=True)('X0', 0, "ROR #32"),
+
+
+    CheckInstr(Orr)('X0', 'X18', 'XZR'),
+    # Official encoding for this in ARM64 ref
+    CheckInstr(Orr, expected_result="mov x0, x18")('X0', 'XZR', 'X18'),
+    CheckInstr(Orr, must_fail=True)('X0', 'WZR', 'X18'), # Size mismatch
+    CheckInstr(Orr, must_fail=True)('W0', 'XZR', 'W18'), # Size mismatch
+
+    CheckInstr(Movk)('X0', 0x1234, "LSL #32"),
+    CheckInstr(Movk)('X18', 0x5678, "LSL #48"),
+
+    CheckInstr(Ret)("X0"),
+    CheckInstr(Ret, expected_result="ret")("X30"),
+    CheckInstr(Ret)(),
+
+    # Virtual instruction that dispatch to something else:
+    # Ex: "mov reg1, re2" -> "orr reg1, xzr, reg2"
+
+    CheckInstr(Mov)('X0', 'X18'),
+    CheckInstr(Mov)('W0', 'W18'),
+    CheckInstr(Mov, must_fail=True)('X0', 'W18'),
+    CheckInstr(Mov, must_fail=True)('X0', 'X18', 'X12'),
+
+
+], ids=CheckInstr.__repr__)
+def test_instruction_assembling(checkinstr):
+    assert checkinstr.dotest()

tests/test_system.py

@@ -51,6 +51,7 @@ class TestSystemWithCheckGarbage(object):
     def test_wmi(self):
         assert windows.system.wmi is not None
 
+    @cross_heaven_gates
     def test_handles(self):
         assert windows.system.handles
 
@@ -66,6 +67,7 @@ class TestSystemWithCheckGarbage(object):
     def test_task_object_manager(self):
         assert windows.system.object_manager
 
+    @cross_heaven_gates
     def test_system_modules_ntosk(self):
         # NtQuerySystemInformation(gdef.SystemModuleInformation) returns CHAR so not unicode
         # Another Nt API that returns unicode ?
@@ -83,6 +85,7 @@ class TestSystemWithCheckGarbageAndHandleLeak(object):
         assert windows.current_process.pid in [p.pid for p in procs]
         assert is_unicode(windows.system.processes[0].name)
 
+    @cross_heaven_gates
     def test_system_modules(self):
         assert windows.system.modules
 

tests/test_system_modules.py

@@ -1,6 +1,9 @@
 import windows
 import ctypes
 
+from .pfwtest import *
+
+@cross_heaven_gates
 def test_system_module_gc():
     # Test for issue 12 (Py3)
     # https://github.com/hakril/PythonForWindows/issues/12

tests/test_syswow.py

@@ -1,6 +1,8 @@
-import pytest
+import time
 import textwrap
 
+import pytest
+
 import windows
 import windows.generated_def as gdef
 import windows.native_exec.simple_x86 as x86
@@ -8,8 +10,28 @@ import windows.native_exec.simple_x64 as x64
 
 from .pfwtest import *
 
-pytestmark = pytest.mark.usefixtures('check_for_gc_garbage')
+# pytestmark = pytest.mark.usefixtures('check_for_gc_garbage')
 
+def test_print_syswow_state():
+    import platform
+    print("")
+    env = windows.system.environ
+    print("platform.machine()={0}".format(platform.machine()))
+    print("platform.architecture()={0}".format(platform.architecture()))
+    print("windows.system.bitness={0}".format(windows.system.bitness))
+    print("windows.system.architecture={0}".format(windows.system.architecture))
+    print("windows.current_process.bitness={0}".format(windows.current_process.bitness))
+    print("windows.current_process.architecture={0}".format(windows.current_process.architecture))
+    print("env['PROCESSOR_ARCHITECTURE']={0}".format(env['PROCESSOR_ARCHITECTURE']))
+    print("env.get('PROCESSOR_ARCHITEW6432')={0}".format(env.get('PROCESSOR_ARCHITEW6432')))
+
+    print("")
+    print("IsWow64Process2")
+    processMachine = gdef.USHORT()
+    nativeMachine = gdef.USHORT()
+    windows.winproxy.IsWow64Process2(windows.current_process.handle, processMachine, nativeMachine)
+    print("hex(processMachine.value)={0}".format(hex(processMachine.value)))
+    print("hex(nativeMachine.value)={0}".format(hex(nativeMachine.value)))
 
 
 @process_syswow_only
@@ -30,6 +52,7 @@ class TestSyswowCurrentProcess(object):
 @python_injection
 @windows_64bit_only
 class TestSyswowRemoteProcess(object):
+    @cross_heaven_gates
     def test_remote_pebsyswow(self, proc32):
         peb64 = proc32.peb_syswow
         modules_names = [m.name for m in peb64.modules]
@@ -39,6 +62,7 @@ class TestSyswowRemoteProcess(object):
         assert "Wow64LdrpInitialize" in wow64.pe.exports
 
 
+    @system_architecture_only(gdef.PROCESSOR_ARCHITECTURE_AMD64)
     def test_getset_syswow_context(self, proc32):
         addr = proc32.virtual_alloc(0x1000)
         remote_python_code = """
@@ -49,6 +73,8 @@ class TestSyswowRemoteProcess(object):
         windows.current_process.write_qword({0},  res)
         """.format(addr)
 
+        # Execute the import safely so that the test will not hang if import fails
+        proc32.execute_python("import windows")
         t = proc32.execute_python_unsafe(textwrap.dedent(remote_python_code))
         # Wait for python execution
         while proc32.read_qword(addr) != 0x8877665544332211:
@@ -85,7 +111,6 @@ def loop_query_ppid(proc, target_ppid):
                 assert proc.read_memory(i.BaseAddress, 0x1000)
             # assert False, "LOL"
     except Exception as e:
-        # import traceback; traceback.print(
         threads_error[windows.current_thread.tid] = e
         raise
     return True
@@ -99,6 +124,7 @@ def test_syswow_call_multithread():
     # Old version of PFW did not handled that thus generating invalid result / crash
     for tnb in range(10):
         new_proc = windows.test.pop_proc_64()
+        time.sleep(0.1)
         new_proc_pid = new_proc.ppid
         all_procs.append(new_proc)
         t = threading.Thread(target=loop_query_ppid, args=(new_proc, new_proc_pid))

tests/test_wmi.py

@@ -75,6 +75,7 @@ def test_get_object(name, cls):
 # Todo: test
 #   - put_instance
 
+@cross_heaven_gates # proc.peb.commandline.str == cmdline
 @pytest.mark.parametrize("cmdline", [r"winver.exe test_string_pfw"])
 def test_exec_method_Win32_Process_create(cmdline):
     namespace = windows.system.wmi["root\\cimv2"]

windows/crypto/certificate.py

@@ -152,6 +152,14 @@ class CertificateStore(gdef.HCERTSTORE):
         res = winproxy.CertOpenStore(gdef.CERT_STORE_PROV_SYSTEM_A, DEFAULT_ENCODING, None, gdef.CERT_SYSTEM_STORE_LOCAL_MACHINE | gdef.CERT_STORE_READONLY_FLAG, store_name)
         return ctypes.cast(res, cls)
 
+    @classmethod
+    def from_user_store(cls, store_name, user=True):
+        """Create a new :class:`CertificateStore` from system store ``store_name``
+        (see `System Store Locations <https://msdn.microsoft.com/en-us/library/windows/desktop/aa388136(v=vs.85).aspx>`_)
+        """
+        res = winproxy.CertOpenStore(gdef.CERT_STORE_PROV_SYSTEM_A, DEFAULT_ENCODING, None, gdef.CERT_SYSTEM_STORE_CURRENT_USER | gdef.CERT_STORE_READONLY_FLAG, store_name)
+        return ctypes.cast(res, cls)
+
     @classmethod
     def new_in_memory(cls):
         """Create a new temporary :class:`CertificateStore` in memory"""

windows/generated_def/__init__.py

@@ -67,5 +67,57 @@ from .winfuncs import *
 from .windef import *
 from .interfaces import *
 
+# Define custom Flag mappers for define list that should be enums
 
+PROCESSOR_ARCHITECTURE_MAPPER = FlagMapper(
+    PROCESSOR_ARCHITECTURE_INTEL,
+    PROCESSOR_ARCHITECTURE_MIPS,
+    PROCESSOR_ARCHITECTURE_ALPHA,
+    PROCESSOR_ARCHITECTURE_PPC,
+    PROCESSOR_ARCHITECTURE_SHX,
+    PROCESSOR_ARCHITECTURE_ARM,
+    PROCESSOR_ARCHITECTURE_IA64,
+    PROCESSOR_ARCHITECTURE_ALPHA64,
+    PROCESSOR_ARCHITECTURE_MSIL,
+    PROCESSOR_ARCHITECTURE_AMD64,
+    PROCESSOR_ARCHITECTURE_IA32_ON_WIN64,
+    PROCESSOR_ARCHITECTURE_NEUTRAL,
+    PROCESSOR_ARCHITECTURE_ARM64,
+    PROCESSOR_ARCHITECTURE_ARM32_ON_WIN64,
+    PROCESSOR_ARCHITECTURE_UNKNOWN,
+    IMAGE_FILE_MACHINE_TARGET_HOST
+)
+
+IMAGE_FILE_MACHINE_MAPPER = FlagMapper(
+    IMAGE_FILE_MACHINE_UNKNOWN,
+    IMAGE_FILE_MACHINE_I386,
+    IMAGE_FILE_MACHINE_R3000,
+    IMAGE_FILE_MACHINE_R4000,
+    IMAGE_FILE_MACHINE_R10000,
+    IMAGE_FILE_MACHINE_WCEMIPSV2,
+    IMAGE_FILE_MACHINE_ALPHA,
+    IMAGE_FILE_MACHINE_SH3,
+    IMAGE_FILE_MACHINE_SH3DSP,
+    IMAGE_FILE_MACHINE_SH3E,
+    IMAGE_FILE_MACHINE_SH4,
+    IMAGE_FILE_MACHINE_SH5,
+    IMAGE_FILE_MACHINE_ARM,
+    IMAGE_FILE_MACHINE_THUMB,
+    IMAGE_FILE_MACHINE_ARMNT,
+    IMAGE_FILE_MACHINE_AM33,
+    IMAGE_FILE_MACHINE_POWERPC,
+    IMAGE_FILE_MACHINE_POWERPCFP,
+    IMAGE_FILE_MACHINE_IA64,
+    IMAGE_FILE_MACHINE_MIPS16,
+    IMAGE_FILE_MACHINE_ALPHA64,
+    IMAGE_FILE_MACHINE_MIPSFPU,
+    IMAGE_FILE_MACHINE_MIPSFPU16,
+    IMAGE_FILE_MACHINE_TRICORE,
+    IMAGE_FILE_MACHINE_CEF,
+    IMAGE_FILE_MACHINE_EBC,
+    IMAGE_FILE_MACHINE_AMD64,
+    IMAGE_FILE_MACHINE_M32R,
+    IMAGE_FILE_MACHINE_CEE,
+    IMAGE_FILE_MACHINE_ARM64
+)
 

windows/generated_def/meta.py

@@ -191,6 +191,8 @@ windef = {'ABOVE_NORMAL_PRIORITY_CLASS',
 'API_SET_SCHEMA_VERSION_V3',
 'API_SET_SCHEMA_VERSION_V4',
 'APPLICATION_ERROR_MASK',
+'ARM64_MAX_BREAKPOINTS',
+'ARM64_MAX_WATCHPOINTS',
 'ASYNC_MODE_COMPATIBILITY',
 'ASYNC_MODE_DEFAULT',
 'ATM_ADDR_SIZE',
@@ -389,6 +391,7 @@ windef = {'ABOVE_NORMAL_PRIORITY_CLASS',
 'CERT_NAME_SIMPLE_DISPLAY_TYPE',
 'CERT_NAME_UPN_TYPE',
 'CERT_NAME_URL_TYPE',
+'CERT_NCRYPT_KEY_SPEC',
 'CERT_NEXT_UPDATE_LOCATION_PROP_ID',
 'CERT_OCSP_RESPONSE_PROP_ID',
 'CERT_OID_NAME_STR',
@@ -433,8 +436,36 @@ windef = {'ABOVE_NORMAL_PRIORITY_CLASS',
 'CERT_QUERY_FORMAT_FLAG_BINARY',
 'CERT_QUERY_OBJECT_BLOB',
 'CERT_QUERY_OBJECT_FILE',
+'CERT_RDN_ANY_TYPE',
+'CERT_RDN_BMP_STRING',
+'CERT_RDN_DISABLE_CHECK_TYPE_FLAG',
+'CERT_RDN_DISABLE_IE4_UTF8_FLAG',
+'CERT_RDN_ENABLE_T61_UNICODE_FLAG',
+'CERT_RDN_ENABLE_UTF8_UNICODE_FLAG',
+'CERT_RDN_ENCODED_BLOB',
+'CERT_RDN_FLAGS_MASK',
+'CERT_RDN_FORCE_UTF8_UNICODE_FLAG',
+'CERT_RDN_GENERAL_STRING',
+'CERT_RDN_GRAPHIC_STRING',
+'CERT_RDN_IA5_STRING',
+'CERT_RDN_INT4_STRING',
+'CERT_RDN_ISO646_STRING',
+'CERT_RDN_NUMERIC_STRING',
+'CERT_RDN_OCTET_STRING',
+'CERT_RDN_PRINTABLE_STRING',
+'CERT_RDN_T61_STRING',
+'CERT_RDN_TELETEX_STRING',
+'CERT_RDN_TYPE_MASK',
+'CERT_RDN_UNICODE_STRING',
+'CERT_RDN_UNIVERSAL_STRING',
+'CERT_RDN_UTF8_STRING',
+'CERT_RDN_VIDEOTEX_STRING',
+'CERT_RDN_VISIBLE_STRING',
 'CERT_RENEWAL_PROP_ID',
 'CERT_REQUEST_ORIGINATOR_PROP_ID',
+'CERT_REQUEST_V1',
+'CERT_SET_KEY_CONTEXT_PROP_ID',
+'CERT_SET_KEY_PROV_HANDLE_PROP_ID',
 'CERT_SHA1_HASH_PROP_ID',
 'CERT_SIGNATURE_HASH_PROP_ID',
 'CERT_SIMPLE_NAME_STR',
@@ -661,6 +692,11 @@ windef = {'ABOVE_NORMAL_PRIORITY_CLASS',
 'CONTEXT_AMD64',
 'CONTEXT_ARM',
 'CONTEXT_ARM64',
+'CONTEXT_ARM64_CONTROL',
+'CONTEXT_ARM64_DEBUG_REGISTERS',
+'CONTEXT_ARM64_FLOATING_POINT',
+'CONTEXT_ARM64_INTEGER',
+'CONTEXT_ARM64_X18',
 'CONTEXT_CONTROL',
 'CONTEXT_DEBUG_REGISTERS',
 'CONTEXT_EXTENDED_REGISTERS',
@@ -668,8 +704,12 @@ windef = {'ABOVE_NORMAL_PRIORITY_CLASS',
 'CONTEXT_FULL',
 'CONTEXT_I386',
 'CONTEXT_INTEGER',
+'CONTEXT_RET_TO_GUEST',
 'CONTEXT_SEGMENTS',
+'CONTEXT_UNWOUND_TO_CALL',
 'CONTEXT_XSTATE',
+'CONTEXT_i386',
+'CONTEXT_i486',
 'CONTROL_C_EXIT',
 'CREATE_ALWAYS',
 'CREATE_BREAKAWAY_FROM_JOB',
@@ -720,6 +760,11 @@ windef = {'ABOVE_NORMAL_PRIORITY_CLASS',
 'CRYPT_CREATE_IV',
 'CRYPT_CREATE_SALT',
 'CRYPT_DATA_KEY',
+'CRYPT_DECODE_ALLOC_FLAG',
+'CRYPT_DECODE_NOCOPY_FLAG',
+'CRYPT_DECODE_NO_SIGNATURE_BYTE_REVERSAL_FLAG',
+'CRYPT_DECODE_SHARE_OID_STRING_FLAG',
+'CRYPT_DECODE_TO_BE_SIGNED_FLAG',
 'CRYPT_DEFAULT_CONTAINER_OPTIONAL',
 'CRYPT_DELETEKEYSET',
 'CRYPT_ENCODE_DECODE_NONE',
@@ -743,6 +788,7 @@ windef = {'ABOVE_NORMAL_PRIORITY_CLASS',
 'CRYPT_SF',
 'CRYPT_SGCKEY',
 'CRYPT_SILENT',
+'CRYPT_UNICODE_NAME_DECODE_DISABLE_IE4_UTF8_FLAG',
 'CRYPT_UPDATE_KEY',
 'CRYPT_USER_KEYSET',
 'CRYPT_USER_PROTECTED',
@@ -1722,6 +1768,7 @@ windef = {'ABOVE_NORMAL_PRIORITY_CLASS',
 'IMAGE_FILE_MACHINE_SH3E',
 'IMAGE_FILE_MACHINE_SH4',
 'IMAGE_FILE_MACHINE_SH5',
+'IMAGE_FILE_MACHINE_TARGET_HOST',
 'IMAGE_FILE_MACHINE_THUMB',
 'IMAGE_FILE_MACHINE_TRICORE',
 'IMAGE_FILE_MACHINE_UNKNOWN',
@@ -2421,7 +2468,44 @@ windef = {'ABOVE_NORMAL_PRIORITY_CLASS',
 'PRIORITY_BIT',
 'PRIORITY_EQUAL_FIRST',
 'PRIORITY_EQUAL_LAST',
+'PROCESSOR_ALPHA_21064',
+'PROCESSOR_ARCHITECTURE_ALPHA',
+'PROCESSOR_ARCHITECTURE_ALPHA64',
+'PROCESSOR_ARCHITECTURE_AMD64',
+'PROCESSOR_ARCHITECTURE_ARM',
+'PROCESSOR_ARCHITECTURE_ARM32_ON_WIN64',
+'PROCESSOR_ARCHITECTURE_ARM64',
+'PROCESSOR_ARCHITECTURE_IA32_ON_WIN64',
+'PROCESSOR_ARCHITECTURE_IA64',
+'PROCESSOR_ARCHITECTURE_INTEL',
+'PROCESSOR_ARCHITECTURE_MIPS',
+'PROCESSOR_ARCHITECTURE_MSIL',
+'PROCESSOR_ARCHITECTURE_NEUTRAL',
+'PROCESSOR_ARCHITECTURE_PPC',
+'PROCESSOR_ARCHITECTURE_SHX',
+'PROCESSOR_ARCHITECTURE_UNKNOWN',
+'PROCESSOR_ARM720',
+'PROCESSOR_ARM820',
+'PROCESSOR_ARM920',
+'PROCESSOR_ARM_7TDMI',
 'PROCESSOR_FEATURE_MAX',
+'PROCESSOR_HITACHI_SH3',
+'PROCESSOR_HITACHI_SH3E',
+'PROCESSOR_HITACHI_SH4',
+'PROCESSOR_INTEL_386',
+'PROCESSOR_INTEL_486',
+'PROCESSOR_INTEL_IA64',
+'PROCESSOR_INTEL_PENTIUM',
+'PROCESSOR_MIPS_R4000',
+'PROCESSOR_MOTOROLA_821',
+'PROCESSOR_OPTIL',
+'PROCESSOR_PPC_601',
+'PROCESSOR_PPC_603',
+'PROCESSOR_PPC_604',
+'PROCESSOR_PPC_620',
+'PROCESSOR_SHx_SH3',
+'PROCESSOR_SHx_SH4',
+'PROCESSOR_STRONGARM',
 'PROCESS_ALL_ACCESS',
 'PROCESS_CREATE_PROCESS',
 'PROCESS_CREATE_THREAD',
@@ -2443,6 +2527,23 @@ windef = {'ABOVE_NORMAL_PRIORITY_CLASS',
 'PROCESS_VM_OPERATION',
 'PROCESS_VM_READ',
 'PROCESS_VM_WRITE',
+'PROC_THREAD_ATTRIBUTE_ADDITIVE',
+'PROC_THREAD_ATTRIBUTE_ENABLE_OPTIONAL_XSTATE_FEATURES',
+'PROC_THREAD_ATTRIBUTE_GROUP_AFFINITY',
+'PROC_THREAD_ATTRIBUTE_HANDLE_LIST',
+'PROC_THREAD_ATTRIBUTE_IDEAL_PROCESSOR',
+'PROC_THREAD_ATTRIBUTE_INPUT',
+'PROC_THREAD_ATTRIBUTE_MACHINE_TYPE',
+'PROC_THREAD_ATTRIBUTE_MITIGATION_POLICY',
+'PROC_THREAD_ATTRIBUTE_NUMBER',
+'PROC_THREAD_ATTRIBUTE_PARENT_PROCESS',
+'PROC_THREAD_ATTRIBUTE_PREFERRED_NODE',
+'PROC_THREAD_ATTRIBUTE_PROTECTION_LEVEL',
+'PROC_THREAD_ATTRIBUTE_PSEUDOCONSOLE',
+'PROC_THREAD_ATTRIBUTE_SECURITY_CAPABILITIES',
+'PROC_THREAD_ATTRIBUTE_SVE_VECTOR_LENGTH',
+'PROC_THREAD_ATTRIBUTE_THREAD',
+'PROC_THREAD_ATTRIBUTE_UMS_THREAD',
 'PRODUCT_BUSINESS',
 'PRODUCT_BUSINESS_N',
 'PRODUCT_CLUSTER_SERVER',
@@ -2552,6 +2653,35 @@ windef = {'ABOVE_NORMAL_PRIORITY_CLASS',
 'PROV_RSA_SIG',
 'PROV_SPYRUS_LYNKS',
 'PROV_SSL',
+'ProcThreadAttributeAllApplicationPackagesPolicy',
+'ProcThreadAttributeBnoIsolation',
+'ProcThreadAttributeChildProcessPolicy',
+'ProcThreadAttributeComponentFilter',
+'ProcThreadAttributeConsoleReference',
+'ProcThreadAttributeCreateStore',
+'ProcThreadAttributeDesktopAppPolicy',
+'ProcThreadAttributeEnableOptionalXStateFeatures',
+'ProcThreadAttributeExtendedFlags',
+'ProcThreadAttributeGroupAffinity',
+'ProcThreadAttributeHandleList',
+'ProcThreadAttributeIdealProcessor',
+'ProcThreadAttributeIsolationManifest',
+'ProcThreadAttributeJobList',
+'ProcThreadAttributeMachineType',
+'ProcThreadAttributeMitigationAuditPolicy',
+'ProcThreadAttributeMitigationPolicy',
+'ProcThreadAttributeOsMaxVersionTested',
+'ProcThreadAttributePackageFullName',
+'ProcThreadAttributeParentProcess',
+'ProcThreadAttributePreferredNode',
+'ProcThreadAttributeProtectionLevel',
+'ProcThreadAttributePseudoConsole',
+'ProcThreadAttributeSafeOpenPromptOriginClaim',
+'ProcThreadAttributeSecurityCapabilities',
+'ProcThreadAttributeSveVectorLength',
+'ProcThreadAttributeTrustedApp',
+'ProcThreadAttributeUmsThread',
+'ProcThreadAttributeWin32kFilter',
 'READ_CONTROL',
 'REALTIME_PRIORITY_CLASS',
 'REG_BINARY',
@@ -3197,6 +3327,21 @@ windef = {'ABOVE_NORMAL_PRIORITY_CLASS',
 'WIN_CERT_TYPE_RESERVED_1',
 'WIN_CERT_TYPE_TS_STACK_SIGNED',
 'WIN_CERT_TYPE_X509',
+'WOW64_CONTEXT_ALL',
+'WOW64_CONTEXT_CONTROL',
+'WOW64_CONTEXT_DEBUG_REGISTERS',
+'WOW64_CONTEXT_EXCEPTION_ACTIVE',
+'WOW64_CONTEXT_EXCEPTION_REPORTING',
+'WOW64_CONTEXT_EXCEPTION_REQUEST',
+'WOW64_CONTEXT_EXTENDED_REGISTERS',
+'WOW64_CONTEXT_FLOATING_POINT',
+'WOW64_CONTEXT_FULL',
+'WOW64_CONTEXT_INTEGER',
+'WOW64_CONTEXT_SEGMENTS',
+'WOW64_CONTEXT_SERVICE_ACTIVE',
+'WOW64_CONTEXT_XSTATE',
+'WOW64_CONTEXT_i386',
+'WOW64_CONTEXT_i486',
 'WOW64_MAXIMUM_SUPPORTED_EXTENSION',
 'WOW64_SIZE_OF_80387_REGISTERS',
 'WRITE_DAC',
@@ -12173,6 +12318,8 @@ structs = {'ACCESS_ALLOWED_ACE',
 'API_SET_VALUE_ARRAY_V4',
 'API_SET_VALUE_ENTRY',
 'API_SET_VALUE_ENTRY_V2',
+'ARM64_NT_CONTEXT',
+'ARM64_NT_NEON128',
 'ARRAYDESC',
 'ATTACH_VIRTUAL_DISK_PARAMETERS',
 'BG_AUTH_CREDENTIALS',
@@ -12221,6 +12368,7 @@ structs = {'ACCESS_ALLOWED_ACE',
 'CERT_NAME_BLOB',
 'CERT_PUBLIC_KEY_INFO',
 'CERT_RDN_VALUE_BLOB',
+'CERT_REQUEST_INFO',
 'CERT_REVOCATION_CRL_INFO',
 'CERT_REVOCATION_INFO',
 'CERT_SIMPLE_CHAIN',
@@ -12641,6 +12789,7 @@ structs = {'ACCESS_ALLOWED_ACE',
 'LPSTARTUPINFOEXW',
 'LPSTARTUPINFOW',
 'LPSYSTEMTIME',
+'LPSYSTEM_INFO',
 'LPTHREADENTRY32',
 'LPTIME_ZONE_INFORMATION',
 'LPTLIBATTR',
@@ -12802,6 +12951,8 @@ structs = {'ACCESS_ALLOWED_ACE',
 'PAPI_SET_VALUE_ENTRY_V2',
 'PARAMDESC',
 'PARAMDESCEX',
+'PARM64_NT_CONTEXT',
+'PARM64_NT_NEON128',
 'PATTACH_VIRTUAL_DISK_PARAMETERS',
 'PBITMAP',
 'PBITMAPCOREHEADER',
@@ -12839,6 +12990,7 @@ structs = {'ACCESS_ALLOWED_ACE',
 'PCERT_NAME_BLOB',
 'PCERT_PUBLIC_KEY_INFO',
 'PCERT_RDN_VALUE_BLOB',
+'PCERT_REQUEST_INFO',
 'PCERT_REVOCATION_CRL_INFO',
 'PCERT_REVOCATION_INFO',
 'PCERT_SIMPLE_CHAIN',
@@ -13238,6 +13390,7 @@ structs = {'ACCESS_ALLOWED_ACE',
 'PROCESS_BASIC_INFORMATION',
 'PROCESS_INFORMATION',
 'PROCESS_INSTRUMENTATION_CALLBACK_INFORMATION',
+'PROCESS_MACHINE_INFORMATION',
 'PROCESS_MEMORY_COUNTERS',
 'PROCESS_MEMORY_COUNTERS_EX',
 'PROCESS_MITIGATION_ASLR_POLICY',
@@ -13459,6 +13612,7 @@ structs = {'ACCESS_ALLOWED_ACE',
 'SYSTEM_HANDLE64',
 'SYSTEM_HANDLE_INFORMATION',
 'SYSTEM_HANDLE_INFORMATION64',
+'SYSTEM_INFO',
 'SYSTEM_MANDATORY_LABEL_ACE',
 'SYSTEM_MODULE32',
 'SYSTEM_MODULE64',
@@ -13483,8 +13637,6 @@ structs = {'ACCESS_ALLOWED_ACE',
 'TMPUNION_CMSG_MAIL_LIST_RECIPIENT_ENCODE_INFO',
 'TMP_CERT_STRONG_SIGN_PARA_UNION_TYPE',
 'TMP_CMSG_RECIPIENT_ENCODE_INFO_UNION',
-'TMP_CONTEXT64_SUBUNION',
-'TMP_DUMMYSTRUCTNAME',
 'TMP_SPC_LINK_UNION',
 'TMP_TYPEDESC_UNION',
 'TMP_UNION_DEBUG_INFO',
@@ -13625,6 +13777,8 @@ structs = {'ACCESS_ALLOWED_ACE',
 '_API_SET_VALUE_ARRAY_V4',
 '_API_SET_VALUE_ENTRY',
 '_API_SET_VALUE_ENTRY_V2',
+'_ARM64_NT_CONTEXT',
+'_ARM64_NT_NEON128',
 '_ATTACH_VIRTUAL_DISK_PARAMETERS',
 '_BG_FILE_INFO',
 '_BG_FILE_PROGRESS',
@@ -13648,6 +13802,7 @@ structs = {'ACCESS_ALLOWED_ACE',
 '_CERT_ISSUER_SERIAL_NUMBER',
 '_CERT_KEY_CONTEXT',
 '_CERT_PUBLIC_KEY_INFO',
+'_CERT_REQUEST_INFO',
 '_CERT_REVOCATION_CRL_INFO',
 '_CERT_REVOCATION_INFO',
 '_CERT_SIMPLE_CHAIN',
@@ -13958,6 +14113,7 @@ structs = {'ACCESS_ALLOWED_ACE',
 '_PROCESS_BASIC_INFORMATION',
 '_PROCESS_INFORMATION',
 '_PROCESS_INSTRUMENTATION_CALLBACK_INFORMATION',
+'_PROCESS_MACHINE_INFORMATION',
 '_PROCESS_MEMORY_COUNTERS',
 '_PROCESS_MEMORY_COUNTERS_EX',
 '_PROCESS_MITIGATION_ASLR_POLICY',
@@ -14038,6 +14194,7 @@ structs = {'ACCESS_ALLOWED_ACE',
 '_SYSTEM_HANDLE64',
 '_SYSTEM_HANDLE_INFORMATION',
 '_SYSTEM_HANDLE_INFORMATION64',
+'_SYSTEM_INFO',
 '_SYSTEM_MANDATORY_LABEL_ACE',
 '_SYSTEM_MODULE32',
 '_SYSTEM_MODULE64',
@@ -14059,8 +14216,6 @@ structs = {'ACCESS_ALLOWED_ACE',
 '_TMPUNION_CMSG_KEY_AGREE_RECIPIENT_ENCODE_INFO',
 '_TMPUNION_CMSG_MAIL_LIST_RECIPIENT_ENCODE_INFO',
 '_TMP_CMSG_RECIPIENT_ENCODE_INFO_UNION',
-'_TMP_CONTEXT64_SUBUNION',
-'_TMP_DUMMYSTRUCTNAME',
 '_TMP_SPC_LINK_UNION',
 '_TMP_TYPEDESC_UNION',
 '_TMP_UNION_DEBUG_INFO',
@@ -14261,6 +14416,7 @@ enums = {'ACCESS_MODE',
 'KEY_INFORMATION_CLASS',
 'KEY_VALUE_INFORMATION_CLASS',
 'LocalServerType',
+'MACHINE_ATTRIBUTES',
 'MEMORY_INFORMATION_CLASS',
 'MEM_EXTENDED_PARAMETER_TYPE',
 'MIB_TCP_STATE',
@@ -14295,7 +14451,9 @@ enums = {'ACCESS_MODE',
 'PPROCESS_MITIGATION_POLICY',
 'PREAD_DIRECTORY_NOTIFY_INFORMATION_CLASS',
 'PROCESSINFOCLASS',
+'PROCESS_INFORMATION_CLASS',
 'PROCESS_MITIGATION_POLICY',
+'PROC_THREAD_ATTRIBUTE_NUM',
 'PSECURITY_IMPERSONATION_LEVEL',
 'PSID_NAME_USE',
 'PTHREAD_INFORMATION_CLASS',
@@ -14394,6 +14552,7 @@ enums = {'ACCESS_MODE',
 '_IO_PRIORITY_HINT',
 '_KEY_INFORMATION_CLASS',
 '_KEY_VALUE_INFORMATION_CLASS',
+'_MACHINE_ATTRIBUTES',
 '_MEMORY_INFORMATION_CLASS',
 '_MIB_TCP_STATE',
 '_MULTIPLE_TRUSTEE_OPERATION',
@@ -14404,7 +14563,9 @@ enums = {'ACCESS_MODE',
 '_POLICY_INFORMATION_CLASS',
 '_POLICY_LSA_SERVER_ROLE',
 '_PROCESSINFOCLASS',
+'_PROCESS_INFORMATION_CLASS',
 '_PROCESS_MITIGATION_POLICY',
+'_PROC_THREAD_ATTRIBUTE_NUM',
 '_READ_DIRECTORY_NOTIFY_INFORMATION_CLASS',
 '_RTL_PATH_TYPE',
 '_SC_ENUM_TYPE',
@@ -14585,6 +14746,7 @@ functions = {'AccessCheck',
 'CreateProcessAsUserW',
 'CreateProcessW',
 'CreateRemoteThread',
+'CreateRemoteThreadEx',
 'CreateServiceA',
 'CreateServiceW',
 'CreateStreamOnHGlobal',
@@ -14638,7 +14800,9 @@ functions = {'AccessCheck',
 'CryptProtectMemory',
 'CryptQueryObject',
 'CryptReleaseContext',
+'CryptSignAndEncodeCertificate',
 'CryptSignAndEncryptMessage',
+'CryptSignCertificate',
 'CryptSignHashA',
 'CryptSignHashW',
 'CryptSignMessage',
@@ -14803,6 +14967,7 @@ functions = {'AccessCheck',
 'GetModuleHandleW',
 'GetNamedSecurityInfoA',
 'GetNamedSecurityInfoW',
+'GetNativeSystemInfo',
 'GetNumberOfEventLogRecords',
 'GetOverlappedResult',
 'GetParent',
@@ -14813,6 +14978,7 @@ functions = {'AccessCheck',
 'GetProcessId',
 'GetProcessImageFileNameA',
 'GetProcessImageFileNameW',
+'GetProcessInformation',
 'GetProcessMemoryInfo',
 'GetProcessMitigationPolicy',
 'GetProcessTimes',
@@ -14839,10 +15005,15 @@ functions = {'AccessCheck',
 'GetSidSubAuthorityCount',
 'GetStdHandle',
 'GetStringConditionFromBinary',
+'GetSystemInfo',
 'GetSystemMetrics',
 'GetSystemTime',
 'GetSystemTimeAsFileTime',
 'GetSystemTimes',
+'GetSystemWow64Directory2A',
+'GetSystemWow64Directory2W',
+'GetSystemWow64DirectoryA',
+'GetSystemWow64DirectoryW',
 'GetThreadContext',
 'GetThreadId',
 'GetTickCount',
@@ -14901,6 +15072,9 @@ functions = {'AccessCheck',
 'IsDebuggerPresent',
 'IsOS',
 'IsValidSecurityDescriptor',
+'IsWow64GuestMachineSupported',
+'IsWow64Process',
+'IsWow64Process2',
 'LdrLoadDll',
 'LoadLibraryA',
 'LoadLibraryExA',
@@ -14934,6 +15108,8 @@ functions = {'AccessCheck',
 'MessageBoxA',
 'MessageBoxW',
 'MoveWindow',
+'NCryptOpenKey',
+'NCryptOpenStorageProvider',
 'NetApiBufferFree',
 'NetGroupEnum',
 'NetGroupGetInfo',
@@ -15150,6 +15326,7 @@ functions = {'AccessCheck',
 'SetNamedSecurityInfoA',
 'SetNamedSecurityInfoW',
 'SetPriorityClass',
+'SetProcessInformation',
 'SetProcessMitigationPolicy',
 'SetSecurityDescriptorDacl',
 'SetSecurityDescriptorOwner',
@@ -15304,6 +15481,8 @@ functions = {'AccessCheck',
 'Wow64GetThreadContext',
 'Wow64RevertWow64FsRedirection',
 'Wow64SetThreadContext',
+'Wow64SetThreadDefaultGuestMachine',
+'Wow64SuspendThread',
 'WriteFile',
 'WriteProcessMemory',
 'ZwDuplicateObject',

windows/generated_def/windef.py

@@ -24,6 +24,22 @@ def CTL_CODE(DeviceType, Function, Method, Access):
 
 def HRESULT_FACILITY(hr):
     return (((hr) >> 16) & 0x1fff)
+
+# https://github.com/microsoft/win32metadata/blob/6af96d8470751e13a4e3f579f84b7b8b3ca398e1/generation/WinSDK/RecompiledIdlHeaders/um/WinBase.h#L3562
+# Original MACRO:
+
+#define ProcThreadAttributeValue(Number, Thread, Input, Additive) \
+#      (((Number) & PROC_THREAD_ATTRIBUTE_NUMBER) | \
+#       ((Thread != FALSE) ? PROC_THREAD_ATTRIBUTE_THREAD : 0) | \
+#       ((Input != FALSE) ? PROC_THREAD_ATTRIBUTE_INPUT : 0) | \
+#       ((Additive != FALSE) ? PROC_THREAD_ATTRIBUTE_ADDITIVE : 0))
+
+def ProcThreadAttributeValue(Number, Thread, Input, Additive):
+    return ((Number & PROC_THREAD_ATTRIBUTE_NUMBER) |
+             (Thread and PROC_THREAD_ATTRIBUTE_THREAD) |
+             (Input and PROC_THREAD_ATTRIBUTE_INPUT) |
+             (Additive and PROC_THREAD_ATTRIBUTE_ADDITIVE))
+
 from .ntstatus import *
 from .winerror import *
 BG_JOB_ENUM_ALL_USERS = make_flag("BG_JOB_ENUM_ALL_USERS", 0x0001)
@@ -1169,6 +1185,89 @@ PIPE_UNLIMITED_INSTANCES = make_flag("PIPE_UNLIMITED_INSTANCES", 255)
 NMPWAIT_WAIT_FOREVER = make_flag("NMPWAIT_WAIT_FOREVER", 0xffffffff)
 NMPWAIT_NOWAIT = make_flag("NMPWAIT_NOWAIT", 0x00000001)
 NMPWAIT_USE_DEFAULT_WAIT = make_flag("NMPWAIT_USE_DEFAULT_WAIT", 0x00000000)
+ProcThreadAttributeParentProcess = make_flag("ProcThreadAttributeParentProcess", 0)
+ProcThreadAttributeExtendedFlags = make_flag("ProcThreadAttributeExtendedFlags", 1)
+ProcThreadAttributeHandleList = make_flag("ProcThreadAttributeHandleList", 2)
+ProcThreadAttributeGroupAffinity = make_flag("ProcThreadAttributeGroupAffinity", 3)
+ProcThreadAttributePreferredNode = make_flag("ProcThreadAttributePreferredNode", 4)
+ProcThreadAttributeIdealProcessor = make_flag("ProcThreadAttributeIdealProcessor", 5)
+ProcThreadAttributeUmsThread = make_flag("ProcThreadAttributeUmsThread", 6)
+ProcThreadAttributeMitigationPolicy = make_flag("ProcThreadAttributeMitigationPolicy", 7)
+ProcThreadAttributePackageFullName = make_flag("ProcThreadAttributePackageFullName", 8)
+ProcThreadAttributeSecurityCapabilities = make_flag("ProcThreadAttributeSecurityCapabilities", 9)
+ProcThreadAttributeConsoleReference = make_flag("ProcThreadAttributeConsoleReference", 10)
+ProcThreadAttributeProtectionLevel = make_flag("ProcThreadAttributeProtectionLevel", 11)
+ProcThreadAttributeOsMaxVersionTested = make_flag("ProcThreadAttributeOsMaxVersionTested", 12)
+ProcThreadAttributeJobList = make_flag("ProcThreadAttributeJobList", 13)
+ProcThreadAttributeChildProcessPolicy = make_flag("ProcThreadAttributeChildProcessPolicy", 14)
+ProcThreadAttributeAllApplicationPackagesPolicy = make_flag("ProcThreadAttributeAllApplicationPackagesPolicy", 15)
+ProcThreadAttributeWin32kFilter = make_flag("ProcThreadAttributeWin32kFilter", 16)
+ProcThreadAttributeSafeOpenPromptOriginClaim = make_flag("ProcThreadAttributeSafeOpenPromptOriginClaim", 17)
+ProcThreadAttributeDesktopAppPolicy = make_flag("ProcThreadAttributeDesktopAppPolicy", 18)
+ProcThreadAttributeBnoIsolation = make_flag("ProcThreadAttributeBnoIsolation", 19)
+ProcThreadAttributePseudoConsole = make_flag("ProcThreadAttributePseudoConsole", 22)
+ProcThreadAttributeIsolationManifest = make_flag("ProcThreadAttributeIsolationManifest", 23)
+ProcThreadAttributeMitigationAuditPolicy = make_flag("ProcThreadAttributeMitigationAuditPolicy", 24)
+ProcThreadAttributeMachineType = make_flag("ProcThreadAttributeMachineType", 25)
+ProcThreadAttributeComponentFilter = make_flag("ProcThreadAttributeComponentFilter", 26)
+ProcThreadAttributeEnableOptionalXStateFeatures = make_flag("ProcThreadAttributeEnableOptionalXStateFeatures", 27)
+ProcThreadAttributeCreateStore = make_flag("ProcThreadAttributeCreateStore", 28)
+ProcThreadAttributeTrustedApp = make_flag("ProcThreadAttributeTrustedApp", 29)
+ProcThreadAttributeSveVectorLength = make_flag("ProcThreadAttributeSveVectorLength", 30)
+PROC_THREAD_ATTRIBUTE_NUMBER = make_flag("PROC_THREAD_ATTRIBUTE_NUMBER", 0x0000FFFF)
+PROC_THREAD_ATTRIBUTE_THREAD = make_flag("PROC_THREAD_ATTRIBUTE_THREAD", 0x00010000)
+PROC_THREAD_ATTRIBUTE_INPUT = make_flag("PROC_THREAD_ATTRIBUTE_INPUT", 0x00020000)
+PROC_THREAD_ATTRIBUTE_ADDITIVE = make_flag("PROC_THREAD_ATTRIBUTE_ADDITIVE", 0x00040000)
+PROC_THREAD_ATTRIBUTE_PARENT_PROCESS = make_flag("PROC_THREAD_ATTRIBUTE_PARENT_PROCESS", ProcThreadAttributeValue ( ProcThreadAttributeParentProcess , False , True , False ))
+PROC_THREAD_ATTRIBUTE_HANDLE_LIST = make_flag("PROC_THREAD_ATTRIBUTE_HANDLE_LIST", ProcThreadAttributeValue ( ProcThreadAttributeHandleList , False , True , False ))
+PROC_THREAD_ATTRIBUTE_GROUP_AFFINITY = make_flag("PROC_THREAD_ATTRIBUTE_GROUP_AFFINITY", ProcThreadAttributeValue ( ProcThreadAttributeGroupAffinity , True , True , False ))
+PROC_THREAD_ATTRIBUTE_PREFERRED_NODE = make_flag("PROC_THREAD_ATTRIBUTE_PREFERRED_NODE", ProcThreadAttributeValue ( ProcThreadAttributePreferredNode , False , True , False ))
+PROC_THREAD_ATTRIBUTE_IDEAL_PROCESSOR = make_flag("PROC_THREAD_ATTRIBUTE_IDEAL_PROCESSOR", ProcThreadAttributeValue ( ProcThreadAttributeIdealProcessor , True , True , False ))
+PROC_THREAD_ATTRIBUTE_UMS_THREAD = make_flag("PROC_THREAD_ATTRIBUTE_UMS_THREAD", ProcThreadAttributeValue ( ProcThreadAttributeUmsThread , True , True , False ))
+PROC_THREAD_ATTRIBUTE_MITIGATION_POLICY = make_flag("PROC_THREAD_ATTRIBUTE_MITIGATION_POLICY", ProcThreadAttributeValue ( ProcThreadAttributeMitigationPolicy , False , True , False ))
+PROC_THREAD_ATTRIBUTE_SECURITY_CAPABILITIES = make_flag("PROC_THREAD_ATTRIBUTE_SECURITY_CAPABILITIES", ProcThreadAttributeValue ( ProcThreadAttributeSecurityCapabilities , False , True , False ))
+PROC_THREAD_ATTRIBUTE_PROTECTION_LEVEL = make_flag("PROC_THREAD_ATTRIBUTE_PROTECTION_LEVEL", ProcThreadAttributeValue ( ProcThreadAttributeProtectionLevel , False , True , False ))
+PROC_THREAD_ATTRIBUTE_PSEUDOCONSOLE = make_flag("PROC_THREAD_ATTRIBUTE_PSEUDOCONSOLE", ProcThreadAttributeValue ( ProcThreadAttributePseudoConsole , False , True , False ))
+PROC_THREAD_ATTRIBUTE_MACHINE_TYPE = make_flag("PROC_THREAD_ATTRIBUTE_MACHINE_TYPE", ProcThreadAttributeValue ( ProcThreadAttributeMachineType , False , True , False ))
+PROC_THREAD_ATTRIBUTE_ENABLE_OPTIONAL_XSTATE_FEATURES = make_flag("PROC_THREAD_ATTRIBUTE_ENABLE_OPTIONAL_XSTATE_FEATURES", ProcThreadAttributeValue ( ProcThreadAttributeEnableOptionalXStateFeatures , True , True , False ))
+PROC_THREAD_ATTRIBUTE_SVE_VECTOR_LENGTH = make_flag("PROC_THREAD_ATTRIBUTE_SVE_VECTOR_LENGTH", ProcThreadAttributeValue ( ProcThreadAttributeSveVectorLength , False , True , False ))
+PROCESSOR_INTEL_386 = make_flag("PROCESSOR_INTEL_386", 386)
+PROCESSOR_INTEL_486 = make_flag("PROCESSOR_INTEL_486", 486)
+PROCESSOR_INTEL_PENTIUM = make_flag("PROCESSOR_INTEL_PENTIUM", 586)
+PROCESSOR_INTEL_IA64 = make_flag("PROCESSOR_INTEL_IA64", 2200)
+PROCESSOR_MIPS_R4000 = make_flag("PROCESSOR_MIPS_R4000", 4000)
+PROCESSOR_ALPHA_21064 = make_flag("PROCESSOR_ALPHA_21064", 21064)
+PROCESSOR_PPC_601 = make_flag("PROCESSOR_PPC_601", 601)
+PROCESSOR_PPC_603 = make_flag("PROCESSOR_PPC_603", 603)
+PROCESSOR_PPC_604 = make_flag("PROCESSOR_PPC_604", 604)
+PROCESSOR_PPC_620 = make_flag("PROCESSOR_PPC_620", 620)
+PROCESSOR_HITACHI_SH3 = make_flag("PROCESSOR_HITACHI_SH3", 10003)
+PROCESSOR_HITACHI_SH3E = make_flag("PROCESSOR_HITACHI_SH3E", 10004)
+PROCESSOR_HITACHI_SH4 = make_flag("PROCESSOR_HITACHI_SH4", 10005)
+PROCESSOR_MOTOROLA_821 = make_flag("PROCESSOR_MOTOROLA_821", 821)
+PROCESSOR_SHx_SH3 = make_flag("PROCESSOR_SHx_SH3", 103)
+PROCESSOR_SHx_SH4 = make_flag("PROCESSOR_SHx_SH4", 104)
+PROCESSOR_STRONGARM = make_flag("PROCESSOR_STRONGARM", 2577)
+PROCESSOR_ARM720 = make_flag("PROCESSOR_ARM720", 1824)
+PROCESSOR_ARM820 = make_flag("PROCESSOR_ARM820", 2080)
+PROCESSOR_ARM920 = make_flag("PROCESSOR_ARM920", 2336)
+PROCESSOR_ARM_7TDMI = make_flag("PROCESSOR_ARM_7TDMI", 70001)
+PROCESSOR_OPTIL = make_flag("PROCESSOR_OPTIL", 0x494f)
+PROCESSOR_ARCHITECTURE_INTEL = make_flag("PROCESSOR_ARCHITECTURE_INTEL", 0)
+PROCESSOR_ARCHITECTURE_MIPS = make_flag("PROCESSOR_ARCHITECTURE_MIPS", 1)
+PROCESSOR_ARCHITECTURE_ALPHA = make_flag("PROCESSOR_ARCHITECTURE_ALPHA", 2)
+PROCESSOR_ARCHITECTURE_PPC = make_flag("PROCESSOR_ARCHITECTURE_PPC", 3)
+PROCESSOR_ARCHITECTURE_SHX = make_flag("PROCESSOR_ARCHITECTURE_SHX", 4)
+PROCESSOR_ARCHITECTURE_ARM = make_flag("PROCESSOR_ARCHITECTURE_ARM", 5)
+PROCESSOR_ARCHITECTURE_IA64 = make_flag("PROCESSOR_ARCHITECTURE_IA64", 6)
+PROCESSOR_ARCHITECTURE_ALPHA64 = make_flag("PROCESSOR_ARCHITECTURE_ALPHA64", 7)
+PROCESSOR_ARCHITECTURE_MSIL = make_flag("PROCESSOR_ARCHITECTURE_MSIL", 8)
+PROCESSOR_ARCHITECTURE_AMD64 = make_flag("PROCESSOR_ARCHITECTURE_AMD64", 9)
+PROCESSOR_ARCHITECTURE_IA32_ON_WIN64 = make_flag("PROCESSOR_ARCHITECTURE_IA32_ON_WIN64", 10)
+PROCESSOR_ARCHITECTURE_NEUTRAL = make_flag("PROCESSOR_ARCHITECTURE_NEUTRAL", 11)
+PROCESSOR_ARCHITECTURE_ARM64 = make_flag("PROCESSOR_ARCHITECTURE_ARM64", 12)
+PROCESSOR_ARCHITECTURE_ARM32_ON_WIN64 = make_flag("PROCESSOR_ARCHITECTURE_ARM32_ON_WIN64", 13)
+PROCESSOR_ARCHITECTURE_UNKNOWN = make_flag("PROCESSOR_ARCHITECTURE_UNKNOWN", 0xFFFF)
 HKEY_CLASSES_ROOT = make_flag("HKEY_CLASSES_ROOT", ( 0x80000000 ))
 HKEY_CURRENT_USER = make_flag("HKEY_CURRENT_USER", ( 0x80000001 ))
 HKEY_LOCAL_MACHINE = make_flag("HKEY_LOCAL_MACHINE", ( 0x80000002 ))
@@ -1790,6 +1889,45 @@ SPC_MINIMAL_CRITERIA_OBJID = make_flag("SPC_MINIMAL_CRITERIA_OBJID", "1.3.6.1.4.
 SPC_FINANCIAL_CRITERIA_OBJID = make_flag("SPC_FINANCIAL_CRITERIA_OBJID", "1.3.6.1.4.1.311.2.1.27")
 SPC_LINK_OBJID = make_flag("SPC_LINK_OBJID", "1.3.6.1.4.1.311.2.1.28")
 SPC_SIGINFO_OBJID = make_flag("SPC_SIGINFO_OBJID", "1.3.6.1.4.1.311.2.1.30")
+CONTEXT_I386 = make_flag("CONTEXT_I386", 0x00010000)
+CONTEXT_AMD64 = make_flag("CONTEXT_AMD64", 0x00100000)
+CONTEXT_ARM = make_flag("CONTEXT_ARM", 0x00200000)
+CONTEXT_ARM64 = make_flag("CONTEXT_ARM64", 0x00400000)
+CONTEXT_i386 = make_flag("CONTEXT_i386", 0x00010000)
+CONTEXT_i486 = make_flag("CONTEXT_i486", 0x00010000)
+WOW64_CONTEXT_i386 = make_flag("WOW64_CONTEXT_i386", 0x00010000)
+WOW64_CONTEXT_i486 = make_flag("WOW64_CONTEXT_i486", 0x00010000)
+CONTEXT_CONTROL = make_flag("CONTEXT_CONTROL", 0x00000001)
+CONTEXT_INTEGER = make_flag("CONTEXT_INTEGER", 0x00000002)
+CONTEXT_SEGMENTS = make_flag("CONTEXT_SEGMENTS", 0x00000004)
+CONTEXT_FLOATING_POINT = make_flag("CONTEXT_FLOATING_POINT", 0x00000008)
+CONTEXT_DEBUG_REGISTERS = make_flag("CONTEXT_DEBUG_REGISTERS", 0x00000010)
+CONTEXT_EXTENDED_REGISTERS = make_flag("CONTEXT_EXTENDED_REGISTERS", 0x00000020)
+CONTEXT_FULL = make_flag("CONTEXT_FULL", ( CONTEXT_CONTROL | CONTEXT_INTEGER | CONTEXT_SEGMENTS ))
+CONTEXT_ALL = make_flag("CONTEXT_ALL", ( CONTEXT_FULL | CONTEXT_FLOATING_POINT | CONTEXT_DEBUG_REGISTERS | CONTEXT_EXTENDED_REGISTERS ))
+CONTEXT_XSTATE = make_flag("CONTEXT_XSTATE", ( CONTEXT_I386 | 0x00000040 ))
+WOW64_CONTEXT_CONTROL = make_flag("WOW64_CONTEXT_CONTROL", ( WOW64_CONTEXT_i386 | 0x00000001 ))
+WOW64_CONTEXT_INTEGER = make_flag("WOW64_CONTEXT_INTEGER", ( WOW64_CONTEXT_i386 | 0x00000002 ))
+WOW64_CONTEXT_SEGMENTS = make_flag("WOW64_CONTEXT_SEGMENTS", ( WOW64_CONTEXT_i386 | 0x00000004 ))
+WOW64_CONTEXT_FLOATING_POINT = make_flag("WOW64_CONTEXT_FLOATING_POINT", ( WOW64_CONTEXT_i386 | 0x00000008 ))
+WOW64_CONTEXT_DEBUG_REGISTERS = make_flag("WOW64_CONTEXT_DEBUG_REGISTERS", ( WOW64_CONTEXT_i386 | 0x00000010 ))
+WOW64_CONTEXT_EXTENDED_REGISTERS = make_flag("WOW64_CONTEXT_EXTENDED_REGISTERS", ( WOW64_CONTEXT_i386 | 0x00000020 ))
+WOW64_CONTEXT_FULL = make_flag("WOW64_CONTEXT_FULL", ( WOW64_CONTEXT_CONTROL | WOW64_CONTEXT_INTEGER | WOW64_CONTEXT_SEGMENTS ))
+WOW64_CONTEXT_ALL = make_flag("WOW64_CONTEXT_ALL", ( WOW64_CONTEXT_CONTROL | WOW64_CONTEXT_INTEGER | WOW64_CONTEXT_SEGMENTS | WOW64_CONTEXT_FLOATING_POINT | WOW64_CONTEXT_DEBUG_REGISTERS | WOW64_CONTEXT_EXTENDED_REGISTERS ))
+WOW64_CONTEXT_XSTATE = make_flag("WOW64_CONTEXT_XSTATE", ( WOW64_CONTEXT_i386 | 0x00000040 ))
+WOW64_CONTEXT_EXCEPTION_ACTIVE = make_flag("WOW64_CONTEXT_EXCEPTION_ACTIVE", 0x08000000)
+WOW64_CONTEXT_SERVICE_ACTIVE = make_flag("WOW64_CONTEXT_SERVICE_ACTIVE", 0x10000000)
+WOW64_CONTEXT_EXCEPTION_REQUEST = make_flag("WOW64_CONTEXT_EXCEPTION_REQUEST", 0x40000000)
+WOW64_CONTEXT_EXCEPTION_REPORTING = make_flag("WOW64_CONTEXT_EXCEPTION_REPORTING", 0x80000000)
+CONTEXT_ARM64_CONTROL = make_flag("CONTEXT_ARM64_CONTROL", ( CONTEXT_ARM64 | 0x1 ))
+CONTEXT_ARM64_INTEGER = make_flag("CONTEXT_ARM64_INTEGER", ( CONTEXT_ARM64 | 0x2 ))
+CONTEXT_ARM64_FLOATING_POINT = make_flag("CONTEXT_ARM64_FLOATING_POINT", ( CONTEXT_ARM64 | 0x4 ))
+CONTEXT_ARM64_DEBUG_REGISTERS = make_flag("CONTEXT_ARM64_DEBUG_REGISTERS", ( CONTEXT_ARM64 | 0x8 ))
+CONTEXT_ARM64_X18 = make_flag("CONTEXT_ARM64_X18", ( CONTEXT_ARM64 | 0x10 ))
+CONTEXT_UNWOUND_TO_CALL = make_flag("CONTEXT_UNWOUND_TO_CALL", 0x20000000)
+CONTEXT_RET_TO_GUEST = make_flag("CONTEXT_RET_TO_GUEST", 0x04000000)
+ARM64_MAX_BREAKPOINTS = make_flag("ARM64_MAX_BREAKPOINTS", 8)
+ARM64_MAX_WATCHPOINTS = make_flag("ARM64_MAX_WATCHPOINTS", 2)
 FILE_VER_GET_LOCALISED = make_flag("FILE_VER_GET_LOCALISED", 0x01)
 FILE_VER_GET_NEUTRAL = make_flag("FILE_VER_GET_NEUTRAL", 0x02)
 FILE_VER_GET_PREFETCHED = make_flag("FILE_VER_GET_PREFETCHED", 0x04)
@@ -1901,19 +2039,6 @@ TH32CS_SNAPMODULE = make_flag("TH32CS_SNAPMODULE", 0x00000008)
 TH32CS_SNAPMODULE32 = make_flag("TH32CS_SNAPMODULE32", 0x00000010)
 TH32CS_SNAPALL = make_flag("TH32CS_SNAPALL", ( TH32CS_SNAPHEAPLIST | TH32CS_SNAPPROCESS | TH32CS_SNAPTHREAD | TH32CS_SNAPMODULE ))
 TH32CS_INHERIT = make_flag("TH32CS_INHERIT", 0x80000000)
-CONTEXT_I386 = make_flag("CONTEXT_I386", 0x00010000)
-CONTEXT_AMD64 = make_flag("CONTEXT_AMD64", 0x00100000)
-CONTEXT_ARM = make_flag("CONTEXT_ARM", 0x00200000)
-CONTEXT_ARM64 = make_flag("CONTEXT_ARM64", 0x00400000)
-CONTEXT_CONTROL = make_flag("CONTEXT_CONTROL", 0x00000001)
-CONTEXT_INTEGER = make_flag("CONTEXT_INTEGER", 0x00000002)
-CONTEXT_SEGMENTS = make_flag("CONTEXT_SEGMENTS", 0x00000004)
-CONTEXT_FLOATING_POINT = make_flag("CONTEXT_FLOATING_POINT", 0x00000008)
-CONTEXT_DEBUG_REGISTERS = make_flag("CONTEXT_DEBUG_REGISTERS", 0x00000010)
-CONTEXT_EXTENDED_REGISTERS = make_flag("CONTEXT_EXTENDED_REGISTERS", 0x00000020)
-CONTEXT_FULL = make_flag("CONTEXT_FULL", ( CONTEXT_CONTROL | CONTEXT_INTEGER | CONTEXT_SEGMENTS ))
-CONTEXT_ALL = make_flag("CONTEXT_ALL", ( CONTEXT_FULL | CONTEXT_FLOATING_POINT | CONTEXT_DEBUG_REGISTERS | CONTEXT_EXTENDED_REGISTERS ))
-CONTEXT_XSTATE = make_flag("CONTEXT_XSTATE", ( CONTEXT_I386 | 0x00000040 ))
 PAGE_NOACCESS = make_flag("PAGE_NOACCESS", 0x01)
 PAGE_READONLY = make_flag("PAGE_READONLY", 0x02)
 PAGE_READWRITE = make_flag("PAGE_READWRITE", 0x04)
@@ -2946,6 +3071,7 @@ IMAGE_FILE_MACHINE_AMD64 = make_flag("IMAGE_FILE_MACHINE_AMD64", 0x8664)
 IMAGE_FILE_MACHINE_M32R = make_flag("IMAGE_FILE_MACHINE_M32R", 0x9041)
 IMAGE_FILE_MACHINE_CEE = make_flag("IMAGE_FILE_MACHINE_CEE", 0xC0EE)
 IMAGE_FILE_MACHINE_ARM64 = make_flag("IMAGE_FILE_MACHINE_ARM64", 0xAA64)
+IMAGE_FILE_MACHINE_TARGET_HOST = make_flag("IMAGE_FILE_MACHINE_TARGET_HOST", 0x0001)
 CERT_QUERY_OBJECT_FILE = make_flag("CERT_QUERY_OBJECT_FILE", 0x00000001)
 CERT_QUERY_OBJECT_BLOB = make_flag("CERT_QUERY_OBJECT_BLOB", 0x00000002)
 CERT_QUERY_CONTENT_CERT = make_flag("CERT_QUERY_CONTENT_CERT", 1)
@@ -3258,6 +3384,37 @@ CRYPT_VOLATILE = make_flag("CRYPT_VOLATILE", 0x00001000)
 CRYPT_SGCKEY = make_flag("CRYPT_SGCKEY", 0x00002000)
 CRYPT_ARCHIVABLE = make_flag("CRYPT_ARCHIVABLE", 0x00004000)
 CRYPT_FORCE_KEY_PROTECTION_HIGH = make_flag("CRYPT_FORCE_KEY_PROTECTION_HIGH", 0x00008000)
+CERT_RDN_ANY_TYPE = make_flag("CERT_RDN_ANY_TYPE", 0)
+CERT_RDN_ENCODED_BLOB = make_flag("CERT_RDN_ENCODED_BLOB", 1)
+CERT_RDN_OCTET_STRING = make_flag("CERT_RDN_OCTET_STRING", 2)
+CERT_RDN_NUMERIC_STRING = make_flag("CERT_RDN_NUMERIC_STRING", 3)
+CERT_RDN_PRINTABLE_STRING = make_flag("CERT_RDN_PRINTABLE_STRING", 4)
+CERT_RDN_TELETEX_STRING = make_flag("CERT_RDN_TELETEX_STRING", 5)
+CERT_RDN_T61_STRING = make_flag("CERT_RDN_T61_STRING", 5)
+CERT_RDN_VIDEOTEX_STRING = make_flag("CERT_RDN_VIDEOTEX_STRING", 6)
+CERT_RDN_IA5_STRING = make_flag("CERT_RDN_IA5_STRING", 7)
+CERT_RDN_GRAPHIC_STRING = make_flag("CERT_RDN_GRAPHIC_STRING", 8)
+CERT_RDN_VISIBLE_STRING = make_flag("CERT_RDN_VISIBLE_STRING", 9)
+CERT_RDN_ISO646_STRING = make_flag("CERT_RDN_ISO646_STRING", 9)
+CERT_RDN_GENERAL_STRING = make_flag("CERT_RDN_GENERAL_STRING", 10)
+CERT_RDN_UNIVERSAL_STRING = make_flag("CERT_RDN_UNIVERSAL_STRING", 11)
+CERT_RDN_INT4_STRING = make_flag("CERT_RDN_INT4_STRING", 11)
+CERT_RDN_BMP_STRING = make_flag("CERT_RDN_BMP_STRING", 12)
+CERT_RDN_UNICODE_STRING = make_flag("CERT_RDN_UNICODE_STRING", 12)
+CERT_RDN_UTF8_STRING = make_flag("CERT_RDN_UTF8_STRING", 13)
+CERT_RDN_TYPE_MASK = make_flag("CERT_RDN_TYPE_MASK", 0xff)
+CERT_RDN_FLAGS_MASK = make_flag("CERT_RDN_FLAGS_MASK", 0xff000000)
+CERT_RDN_ENABLE_T61_UNICODE_FLAG = make_flag("CERT_RDN_ENABLE_T61_UNICODE_FLAG", 0x80000000)
+CERT_RDN_ENABLE_UTF8_UNICODE_FLAG = make_flag("CERT_RDN_ENABLE_UTF8_UNICODE_FLAG", 0x20000000)
+CERT_RDN_FORCE_UTF8_UNICODE_FLAG = make_flag("CERT_RDN_FORCE_UTF8_UNICODE_FLAG", 0x10000000)
+CERT_RDN_DISABLE_CHECK_TYPE_FLAG = make_flag("CERT_RDN_DISABLE_CHECK_TYPE_FLAG", 0x40000000)
+CERT_RDN_DISABLE_IE4_UTF8_FLAG = make_flag("CERT_RDN_DISABLE_IE4_UTF8_FLAG", 0x1000000)
+CRYPT_DECODE_NOCOPY_FLAG = make_flag("CRYPT_DECODE_NOCOPY_FLAG", 0x1)
+CRYPT_DECODE_TO_BE_SIGNED_FLAG = make_flag("CRYPT_DECODE_TO_BE_SIGNED_FLAG", 0x2)
+CRYPT_DECODE_SHARE_OID_STRING_FLAG = make_flag("CRYPT_DECODE_SHARE_OID_STRING_FLAG", 0x4)
+CRYPT_DECODE_NO_SIGNATURE_BYTE_REVERSAL_FLAG = make_flag("CRYPT_DECODE_NO_SIGNATURE_BYTE_REVERSAL_FLAG", 0x8)
+CRYPT_DECODE_ALLOC_FLAG = make_flag("CRYPT_DECODE_ALLOC_FLAG", 0x8000)
+CRYPT_UNICODE_NAME_DECODE_DISABLE_IE4_UTF8_FLAG = make_flag("CRYPT_UNICODE_NAME_DECODE_DISABLE_IE4_UTF8_FLAG", CERT_RDN_DISABLE_IE4_UTF8_FLAG)
 CRYPT_ENCODE_DECODE_NONE = make_flag("CRYPT_ENCODE_DECODE_NONE", 0)
 X509_CERT = make_flag("X509_CERT", ( 1 ))
 X509_CERT_TO_BE_SIGNED = make_flag("X509_CERT_TO_BE_SIGNED", ( 2 ))
@@ -3396,6 +3553,10 @@ CMSG_CTRL_MAIL_LIST_DECRYPT = make_flag("CMSG_CTRL_MAIL_LIST_DECRYPT", 18)
 CMSG_CTRL_VERIFY_SIGNATURE_EX = make_flag("CMSG_CTRL_VERIFY_SIGNATURE_EX", 19)
 CMSG_CTRL_ADD_CMS_SIGNER_INFO = make_flag("CMSG_CTRL_ADD_CMS_SIGNER_INFO", 20)
 CMSG_CTRL_ENABLE_STRONG_SIGNATURE = make_flag("CMSG_CTRL_ENABLE_STRONG_SIGNATURE", 21)
+CERT_SET_KEY_PROV_HANDLE_PROP_ID = make_flag("CERT_SET_KEY_PROV_HANDLE_PROP_ID", 0x00000001)
+CERT_SET_KEY_CONTEXT_PROP_ID = make_flag("CERT_SET_KEY_CONTEXT_PROP_ID", 0x00000001)
+CERT_NCRYPT_KEY_SPEC = make_flag("CERT_NCRYPT_KEY_SPEC", 0xFFFFFFFF)
+CERT_REQUEST_V1 = make_flag("CERT_REQUEST_V1", 0)
 WSADESCRIPTION_LEN = make_flag("WSADESCRIPTION_LEN", 256)
 WSASYS_STATUS_LEN = make_flag("WSASYS_STATUS_LEN", 128)
 WSAPROTOCOL_LEN = make_flag("WSAPROTOCOL_LEN", 255)

windows/generated_def/winfuncs.py

@@ -810,6 +810,16 @@ CryptGetOIDFunctionValueParams = ((1, 'dwEncodingType'), (1, 'pszFuncName'), (1,
 CertCloseStorePrototype = WINFUNCTYPE(BOOL, HCERTSTORE, DWORD)
 CertCloseStoreParams = ((1, 'hCertStore'), (1, 'dwFlags'))
 
+#def CryptSignAndEncodeCertificate(hBCryptKey, dwKeySpec, dwCertEncodingType, lpszStructType, pvStructInfo, pSignatureAlgorithm, pvHashAuxInfo, pbEncoded, pcbEncoded):
+#    return CryptSignAndEncodeCertificate.ctypes_function(hBCryptKey, dwKeySpec, dwCertEncodingType, lpszStructType, pvStructInfo, pSignatureAlgorithm, pvHashAuxInfo, pbEncoded, pcbEncoded)
+CryptSignAndEncodeCertificatePrototype = WINFUNCTYPE(BOOL, BCRYPT_KEY_HANDLE, DWORD, DWORD, LPCSTR, PVOID, PCRYPT_ALGORITHM_IDENTIFIER, PVOID, POINTER(BYTE), POINTER(DWORD))
+CryptSignAndEncodeCertificateParams = ((1, 'hBCryptKey'), (1, 'dwKeySpec'), (1, 'dwCertEncodingType'), (1, 'lpszStructType'), (1, 'pvStructInfo'), (1, 'pSignatureAlgorithm'), (1, 'pvHashAuxInfo'), (1, 'pbEncoded'), (1, 'pcbEncoded'))
+
+#def CryptSignCertificate(hBCryptKey, dwKeySpec, dwCertEncodingType, pbEncodedToBeSigned, cbEncodedToBeSigned, pSignatureAlgorithm, pvHashAuxInfo, pbSignature, pcbSignature):
+#    return CryptSignCertificate.ctypes_function(hBCryptKey, dwKeySpec, dwCertEncodingType, pbEncodedToBeSigned, cbEncodedToBeSigned, pSignatureAlgorithm, pvHashAuxInfo, pbSignature, pcbSignature)
+CryptSignCertificatePrototype = WINFUNCTYPE(BOOL, BCRYPT_KEY_HANDLE, DWORD, DWORD, POINTER(BYTE), DWORD, PCRYPT_ALGORITHM_IDENTIFIER, PVOID, POINTER(BYTE), POINTER(DWORD))
+CryptSignCertificateParams = ((1, 'hBCryptKey'), (1, 'dwKeySpec'), (1, 'dwCertEncodingType'), (1, 'pbEncodedToBeSigned'), (1, 'cbEncodedToBeSigned'), (1, 'pSignatureAlgorithm'), (1, 'pvHashAuxInfo'), (1, 'pbSignature'), (1, 'pcbSignature'))
+
 #def OpenVirtualDisk(VirtualStorageType, Path, VirtualDiskAccessMask, Flags, Parameters, Handle):
 #    return OpenVirtualDisk.ctypes_function(VirtualStorageType, Path, VirtualDiskAccessMask, Flags, Parameters, Handle)
 OpenVirtualDiskPrototype = WINFUNCTYPE(DWORD, PVIRTUAL_STORAGE_TYPE, PCWSTR, VIRTUAL_DISK_ACCESS_MASK, OPEN_VIRTUAL_DISK_FLAG, POPEN_VIRTUAL_DISK_PARAMETERS, PHANDLE)
@@ -1475,6 +1485,16 @@ OpenFileMappingAParams = ((1, 'dwDesiredAccess'), (1, 'bInheritHandle'), (1, 'lp
 UnmapViewOfFilePrototype = WINFUNCTYPE(BOOL, LPCVOID)
 UnmapViewOfFileParams = ((1, 'lpBaseAddress'),)
 
+#def NCryptOpenKey(hProvider, phKey, pszKeyName, dwLegacyKeySpec, dwFlags):
+#    return NCryptOpenKey.ctypes_function(hProvider, phKey, pszKeyName, dwLegacyKeySpec, dwFlags)
+NCryptOpenKeyPrototype = WINFUNCTYPE(SECURITY_STATUS, NCRYPT_PROV_HANDLE, POINTER(NCRYPT_KEY_HANDLE), LPCWSTR, DWORD, DWORD)
+NCryptOpenKeyParams = ((1, 'hProvider'), (1, 'phKey'), (1, 'pszKeyName'), (1, 'dwLegacyKeySpec'), (1, 'dwFlags'))
+
+#def NCryptOpenStorageProvider(phProvider, pszProviderName, dwFlags):
+#    return NCryptOpenStorageProvider.ctypes_function(phProvider, pszProviderName, dwFlags)
+NCryptOpenStorageProviderPrototype = WINFUNCTYPE(SECURITY_STATUS, POINTER(NCRYPT_PROV_HANDLE), LPCWSTR, DWORD)
+NCryptOpenStorageProviderParams = ((1, 'phProvider'), (1, 'pszProviderName'), (1, 'dwFlags'))
+
 #def NetQueryDisplayInformation(ServerName, Level, Index, EntriesRequested, PreferredMaximumLength, ReturnedEntryCount, SortedBuffer):
 #    return NetQueryDisplayInformation.ctypes_function(ServerName, Level, Index, EntriesRequested, PreferredMaximumLength, ReturnedEntryCount, SortedBuffer)
 NetQueryDisplayInformationPrototype = WINFUNCTYPE(NET_API_STATUS, LPCWSTR, DWORD, DWORD, DWORD, DWORD, LPDWORD, POINTER(PVOID))
@@ -1735,6 +1755,16 @@ LoadLibraryExWParams = ((1, 'lpLibFileName'), (1, 'hFile'), (1, 'dwFlags'))
 FreeLibraryPrototype = WINFUNCTYPE(BOOL, HMODULE)
 FreeLibraryParams = ((1, 'hLibModule'),)
 
+#def GetProcessInformation(hProcess, ProcessInformationClass, ProcessInformation, ProcessInformationSize):
+#    return GetProcessInformation.ctypes_function(hProcess, ProcessInformationClass, ProcessInformation, ProcessInformationSize)
+GetProcessInformationPrototype = WINFUNCTYPE(BOOL, HANDLE, PROCESS_INFORMATION_CLASS, LPVOID, DWORD)
+GetProcessInformationParams = ((1, 'hProcess'), (1, 'ProcessInformationClass'), (1, 'ProcessInformation'), (1, 'ProcessInformationSize'))
+
+#def SetProcessInformation(hProcess, ProcessInformationClass, ProcessInformation, ProcessInformationSize):
+#    return SetProcessInformation.ctypes_function(hProcess, ProcessInformationClass, ProcessInformation, ProcessInformationSize)
+SetProcessInformationPrototype = WINFUNCTYPE(BOOL, HANDLE, PROCESS_INFORMATION_CLASS, LPVOID, DWORD)
+SetProcessInformationParams = ((1, 'hProcess'), (1, 'ProcessInformationClass'), (1, 'ProcessInformation'), (1, 'ProcessInformationSize'))
+
 #def RtlGetCurrentPeb():
 #    return RtlGetCurrentPeb.ctypes_function()
 RtlGetCurrentPebPrototype = WINFUNCTYPE(PVOID)
@@ -3030,6 +3060,96 @@ LookupAccountNameAParams = ((1, 'lpSystemName'), (1, 'lpAccountName'), (1, 'Sid'
 LookupAccountNameWPrototype = WINFUNCTYPE(BOOL, LPCWSTR, LPCWSTR, PSID, LPDWORD, LPWSTR, LPDWORD, PSID_NAME_USE)
 LookupAccountNameWParams = ((1, 'lpSystemName'), (1, 'lpAccountName'), (1, 'Sid'), (1, 'cbSid'), (1, 'ReferencedDomainName'), (1, 'cchReferencedDomainName'), (1, 'peUse'))
 
+#def GetNativeSystemInfo(lpSystemInfo):
+#    return GetNativeSystemInfo.ctypes_function(lpSystemInfo)
+GetNativeSystemInfoPrototype = WINFUNCTYPE(PVOID, LPSYSTEM_INFO)
+GetNativeSystemInfoParams = ((1, 'lpSystemInfo'),)
+
+#def GetSystemInfo(lpSystemInfo):
+#    return GetSystemInfo.ctypes_function(lpSystemInfo)
+GetSystemInfoPrototype = WINFUNCTYPE(PVOID, LPSYSTEM_INFO)
+GetSystemInfoParams = ((1, 'lpSystemInfo'),)
+
+#def IsWow64Process(hProcess, Wow64Process):
+#    return IsWow64Process.ctypes_function(hProcess, Wow64Process)
+IsWow64ProcessPrototype = WINFUNCTYPE(BOOL, HANDLE, PBOOL)
+IsWow64ProcessParams = ((1, 'hProcess'), (1, 'Wow64Process'))
+
+#def IsWow64Process2(hProcess, pProcessMachine, pNativeMachine):
+#    return IsWow64Process2.ctypes_function(hProcess, pProcessMachine, pNativeMachine)
+IsWow64Process2Prototype = WINFUNCTYPE(BOOL, HANDLE, POINTER(USHORT), POINTER(USHORT))
+IsWow64Process2Params = ((1, 'hProcess'), (1, 'pProcessMachine'), (1, 'pNativeMachine'))
+
+#def IsWow64GuestMachineSupported(WowGuestMachine, MachineIsSupported):
+#    return IsWow64GuestMachineSupported.ctypes_function(WowGuestMachine, MachineIsSupported)
+IsWow64GuestMachineSupportedPrototype = WINFUNCTYPE(HRESULT, USHORT, POINTER(BOOL))
+IsWow64GuestMachineSupportedParams = ((1, 'WowGuestMachine'), (1, 'MachineIsSupported'))
+
+#def GetSystemWow64DirectoryA(lpBuffer, uSize):
+#    return GetSystemWow64DirectoryA.ctypes_function(lpBuffer, uSize)
+GetSystemWow64DirectoryAPrototype = WINFUNCTYPE(UINT, LPSTR, UINT)
+GetSystemWow64DirectoryAParams = ((1, 'lpBuffer'), (1, 'uSize'))
+
+#def GetSystemWow64DirectoryW(lpBuffer, uSize):
+#    return GetSystemWow64DirectoryW.ctypes_function(lpBuffer, uSize)
+GetSystemWow64DirectoryWPrototype = WINFUNCTYPE(UINT, LPWSTR, UINT)
+GetSystemWow64DirectoryWParams = ((1, 'lpBuffer'), (1, 'uSize'))
+
+#def GetSystemWow64Directory2A(lpBuffer, uSize, ImageFileMachineType):
+#    return GetSystemWow64Directory2A.ctypes_function(lpBuffer, uSize, ImageFileMachineType)
+GetSystemWow64Directory2APrototype = WINFUNCTYPE(UINT, LPSTR, UINT, WORD)
+GetSystemWow64Directory2AParams = ((1, 'lpBuffer'), (1, 'uSize'), (1, 'ImageFileMachineType'))
+
+#def GetSystemWow64Directory2W(lpBuffer, uSize, ImageFileMachineType):
+#    return GetSystemWow64Directory2W.ctypes_function(lpBuffer, uSize, ImageFileMachineType)
+GetSystemWow64Directory2WPrototype = WINFUNCTYPE(UINT, LPWSTR, UINT, WORD)
+GetSystemWow64Directory2WParams = ((1, 'lpBuffer'), (1, 'uSize'), (1, 'ImageFileMachineType'))
+
+#def Wow64DisableWow64FsRedirection(OldValue):
+#    return Wow64DisableWow64FsRedirection.ctypes_function(OldValue)
+Wow64DisableWow64FsRedirectionPrototype = WINFUNCTYPE(BOOL, POINTER(PVOID))
+Wow64DisableWow64FsRedirectionParams = ((1, 'OldValue'),)
+
+#def Wow64EnableWow64FsRedirection(Wow64FsEnableRedirection):
+#    return Wow64EnableWow64FsRedirection.ctypes_function(Wow64FsEnableRedirection)
+Wow64EnableWow64FsRedirectionPrototype = WINFUNCTYPE(BOOLEAN, BOOLEAN)
+Wow64EnableWow64FsRedirectionParams = ((1, 'Wow64FsEnableRedirection'),)
+
+#def Wow64RevertWow64FsRedirection(OlValue):
+#    return Wow64RevertWow64FsRedirection.ctypes_function(OlValue)
+Wow64RevertWow64FsRedirectionPrototype = WINFUNCTYPE(BOOL, PVOID)
+Wow64RevertWow64FsRedirectionParams = ((1, 'OlValue'),)
+
+#def Wow64GetThreadContext(hThread, lpContext):
+#    return Wow64GetThreadContext.ctypes_function(hThread, lpContext)
+Wow64GetThreadContextPrototype = WINFUNCTYPE(BOOL, HANDLE, PWOW64_CONTEXT)
+Wow64GetThreadContextParams = ((1, 'hThread'), (1, 'lpContext'))
+
+#def Wow64SetThreadContext(hThread, lpContext):
+#    return Wow64SetThreadContext.ctypes_function(hThread, lpContext)
+Wow64SetThreadContextPrototype = WINFUNCTYPE(BOOL, HANDLE, POINTER(WOW64_CONTEXT))
+Wow64SetThreadContextParams = ((1, 'hThread'), (1, 'lpContext'))
+
+#def Wow64SetThreadDefaultGuestMachine(Machine):
+#    return Wow64SetThreadDefaultGuestMachine.ctypes_function(Machine)
+Wow64SetThreadDefaultGuestMachinePrototype = WINFUNCTYPE(USHORT, USHORT)
+Wow64SetThreadDefaultGuestMachineParams = ((1, 'Machine'),)
+
+#def Wow64SuspendThread(hThread):
+#    return Wow64SuspendThread.ctypes_function(hThread)
+Wow64SuspendThreadPrototype = WINFUNCTYPE(DWORD, HANDLE)
+Wow64SuspendThreadParams = ((1, 'hThread'),)
+
+#def NtWow64ReadVirtualMemory64(hProcess, lpBaseAddress, lpBuffer, nSize, lpNumberOfBytesRead):
+#    return NtWow64ReadVirtualMemory64.ctypes_function(hProcess, lpBaseAddress, lpBuffer, nSize, lpNumberOfBytesRead)
+NtWow64ReadVirtualMemory64Prototype = WINFUNCTYPE(NTSTATUS, HANDLE, ULONG64, LPVOID, ULONG64, PULONG64)
+NtWow64ReadVirtualMemory64Params = ((1, 'hProcess'), (1, 'lpBaseAddress'), (1, 'lpBuffer'), (1, 'nSize'), (1, 'lpNumberOfBytesRead'))
+
+#def NtWow64WriteVirtualMemory64(hProcess, lpBaseAddress, lpBuffer, nSize, lpNumberOfBytesWritten):
+#    return NtWow64WriteVirtualMemory64.ctypes_function(hProcess, lpBaseAddress, lpBuffer, nSize, lpNumberOfBytesWritten)
+NtWow64WriteVirtualMemory64Prototype = WINFUNCTYPE(NTSTATUS, HANDLE, ULONG64, LPVOID, ULONG64, PULONG64)
+NtWow64WriteVirtualMemory64Params = ((1, 'hProcess'), (1, 'lpBaseAddress'), (1, 'lpBuffer'), (1, 'nSize'), (1, 'lpNumberOfBytesWritten'))
+
 #def FileTimeToSystemTime(lpFileTime, lpSystemTime):
 #    return FileTimeToSystemTime.ctypes_function(lpFileTime, lpSystemTime)
 FileTimeToSystemTimePrototype = WINFUNCTYPE(BOOL, POINTER(FILETIME), LPSYSTEMTIME)
@@ -3370,6 +3490,11 @@ CreateThreadParams = ((1, 'lpThreadAttributes'), (1, 'dwStackSize'), (1, 'lpStar
 CreateRemoteThreadPrototype = WINFUNCTYPE(HANDLE, HANDLE, LPSECURITY_ATTRIBUTES, SIZE_T, LPTHREAD_START_ROUTINE, LPVOID, DWORD, LPDWORD)
 CreateRemoteThreadParams = ((1, 'hProcess'), (1, 'lpThreadAttributes'), (1, 'dwStackSize'), (1, 'lpStartAddress'), (1, 'lpParameter'), (1, 'dwCreationFlags'), (1, 'lpThreadId'))
 
+#def CreateRemoteThreadEx(hProcess, lpThreadAttributes, dwStackSize, lpStartAddress, lpParameter, dwCreationFlags, lpAttributeList, lpThreadId):
+#    return CreateRemoteThreadEx.ctypes_function(hProcess, lpThreadAttributes, dwStackSize, lpStartAddress, lpParameter, dwCreationFlags, lpAttributeList, lpThreadId)
+CreateRemoteThreadExPrototype = WINFUNCTYPE(HANDLE, HANDLE, LPSECURITY_ATTRIBUTES, SIZE_T, LPTHREAD_START_ROUTINE, LPVOID, DWORD, LPPROC_THREAD_ATTRIBUTE_LIST, LPDWORD)
+CreateRemoteThreadExParams = ((1, 'hProcess'), (1, 'lpThreadAttributes'), (1, 'dwStackSize'), (1, 'lpStartAddress'), (1, 'lpParameter'), (1, 'dwCreationFlags'), (1, 'lpAttributeList'), (1, 'lpThreadId'))
+
 #def CreateProcessA(lpApplicationName, lpCommandLine, lpProcessAttributes, lpThreadAttributes, bInheritHandles, dwCreationFlags, lpEnvironment, lpCurrentDirectory, lpStartupInfo, lpProcessInformation):
 #    return CreateProcessA.ctypes_function(lpApplicationName, lpCommandLine, lpProcessAttributes, lpThreadAttributes, bInheritHandles, dwCreationFlags, lpEnvironment, lpCurrentDirectory, lpStartupInfo, lpProcessInformation)
 CreateProcessAPrototype = WINFUNCTYPE(BOOL, LPCSTR, LPSTR, LPSECURITY_ATTRIBUTES, LPSECURITY_ATTRIBUTES, BOOL, DWORD, LPVOID, LPCSTR, LPSTARTUPINFOA, LPPROCESS_INFORMATION)
@@ -3420,21 +3545,11 @@ CloseHandleParams = ((1, 'hObject'),)
 ReadProcessMemoryPrototype = WINFUNCTYPE(BOOL, HANDLE, LPCVOID, LPVOID, SIZE_T, POINTER(SIZE_T))
 ReadProcessMemoryParams = ((1, 'hProcess'), (1, 'lpBaseAddress'), (1, 'lpBuffer'), (1, 'nSize'), (1, 'lpNumberOfBytesRead'))
 
-#def NtWow64ReadVirtualMemory64(hProcess, lpBaseAddress, lpBuffer, nSize, lpNumberOfBytesRead):
-#    return NtWow64ReadVirtualMemory64.ctypes_function(hProcess, lpBaseAddress, lpBuffer, nSize, lpNumberOfBytesRead)
-NtWow64ReadVirtualMemory64Prototype = WINFUNCTYPE(NTSTATUS, HANDLE, ULONG64, LPVOID, ULONG64, PULONG64)
-NtWow64ReadVirtualMemory64Params = ((1, 'hProcess'), (1, 'lpBaseAddress'), (1, 'lpBuffer'), (1, 'nSize'), (1, 'lpNumberOfBytesRead'))
-
 #def WriteProcessMemory(hProcess, lpBaseAddress, lpBuffer, nSize, lpNumberOfBytesWritten):
 #    return WriteProcessMemory.ctypes_function(hProcess, lpBaseAddress, lpBuffer, nSize, lpNumberOfBytesWritten)
 WriteProcessMemoryPrototype = WINFUNCTYPE(BOOL, HANDLE, LPVOID, LPCVOID, SIZE_T, POINTER(SIZE_T))
 WriteProcessMemoryParams = ((1, 'hProcess'), (1, 'lpBaseAddress'), (1, 'lpBuffer'), (1, 'nSize'), (1, 'lpNumberOfBytesWritten'))
 
-#def NtWow64WriteVirtualMemory64(hProcess, lpBaseAddress, lpBuffer, nSize, lpNumberOfBytesWritten):
-#    return NtWow64WriteVirtualMemory64.ctypes_function(hProcess, lpBaseAddress, lpBuffer, nSize, lpNumberOfBytesWritten)
-NtWow64WriteVirtualMemory64Prototype = WINFUNCTYPE(NTSTATUS, HANDLE, ULONG64, LPVOID, ULONG64, PULONG64)
-NtWow64WriteVirtualMemory64Params = ((1, 'hProcess'), (1, 'lpBaseAddress'), (1, 'lpBuffer'), (1, 'nSize'), (1, 'lpNumberOfBytesWritten'))
-
 #def GetCurrentProcess():
 #    return GetCurrentProcess.ctypes_function()
 GetCurrentProcessPrototype = WINFUNCTYPE(HANDLE)
@@ -3665,26 +3780,6 @@ GetThreadIdParams = ((1, 'Thread'),)
 DeviceIoControlPrototype = WINFUNCTYPE(BOOL, HANDLE, DWORD, LPVOID, DWORD, LPVOID, DWORD, LPDWORD, LPOVERLAPPED)
 DeviceIoControlParams = ((1, 'hDevice'), (1, 'dwIoControlCode'), (1, 'lpInBuffer'), (1, 'nInBufferSize'), (1, 'lpOutBuffer'), (1, 'nOutBufferSize'), (1, 'lpBytesReturned'), (1, 'lpOverlapped'))
 
-#def Wow64DisableWow64FsRedirection(OldValue):
-#    return Wow64DisableWow64FsRedirection.ctypes_function(OldValue)
-Wow64DisableWow64FsRedirectionPrototype = WINFUNCTYPE(BOOL, POINTER(PVOID))
-Wow64DisableWow64FsRedirectionParams = ((1, 'OldValue'),)
-
-#def Wow64RevertWow64FsRedirection(OldValue):
-#    return Wow64RevertWow64FsRedirection.ctypes_function(OldValue)
-Wow64RevertWow64FsRedirectionPrototype = WINFUNCTYPE(BOOL, PVOID)
-Wow64RevertWow64FsRedirectionParams = ((1, 'OldValue'),)
-
-#def Wow64EnableWow64FsRedirection(Wow64FsEnableRedirection):
-#    return Wow64EnableWow64FsRedirection.ctypes_function(Wow64FsEnableRedirection)
-Wow64EnableWow64FsRedirectionPrototype = WINFUNCTYPE(BOOLEAN, BOOLEAN)
-Wow64EnableWow64FsRedirectionParams = ((1, 'Wow64FsEnableRedirection'),)
-
-#def Wow64GetThreadContext(hThread, lpContext):
-#    return Wow64GetThreadContext.ctypes_function(hThread, lpContext)
-Wow64GetThreadContextPrototype = WINFUNCTYPE(BOOL, HANDLE, PWOW64_CONTEXT)
-Wow64GetThreadContextParams = ((1, 'hThread'), (1, 'lpContext'))
-
 #def SetConsoleCtrlHandler(HandlerRoutine, Add):
 #    return SetConsoleCtrlHandler.ctypes_function(HandlerRoutine, Add)
 SetConsoleCtrlHandlerPrototype = WINFUNCTYPE(BOOL, PHANDLER_ROUTINE, BOOL)
@@ -3820,11 +3915,6 @@ DebugBreakProcessParams = ((1, 'Process'),)
 GetProcessIdPrototype = WINFUNCTYPE(DWORD, HANDLE)
 GetProcessIdParams = ((1, 'Process'),)
 
-#def Wow64SetThreadContext(hThread, lpContext):
-#    return Wow64SetThreadContext.ctypes_function(hThread, lpContext)
-Wow64SetThreadContextPrototype = WINFUNCTYPE(BOOL, HANDLE, POINTER(WOW64_CONTEXT))
-Wow64SetThreadContextParams = ((1, 'hThread'), (1, 'lpContext'))
-
 #def GetMappedFileNameW(hProcess, lpv, lpFilename, nSize):
 #    return GetMappedFileNameW.ctypes_function(hProcess, lpv, lpFilename, nSize)
 GetMappedFileNameWPrototype = WINFUNCTYPE(DWORD, HANDLE, LPVOID, PVOID, DWORD)

windows/generated_def/winstructs.py

@@ -138,10 +138,12 @@ PWINDBG_EXTENSION_APIS32 = PVOID
 PWINDBG_EXTENSION_APIS64 = PVOID
 FILEOP_FLAGS = WORD
 NET_API_STATUS = DWORD
+SECURITY_STATUS = LONG
 PVOID32 = DWORD
 PVOID64 = DWORD64
 NCRYPT_HANDLE = ULONG_PTR
 NCRYPT_PROV_HANDLE = ULONG_PTR
+BCRYPT_KEY_HANDLE = ULONG_PTR
 NCRYPT_KEY_HANDLE = ULONG_PTR
 NCRYPT_HASH_HANDLE = ULONG_PTR
 NCRYPT_SECRET_HANDLE = ULONG_PTR
@@ -3595,6 +3597,187 @@ class _IMAGE_LOAD_CONFIG_DIRECTORY64(Structure):
 IMAGE_LOAD_CONFIG_DIRECTORY64 = _IMAGE_LOAD_CONFIG_DIRECTORY64
 PIMAGE_LOAD_CONFIG_DIRECTORY64 = POINTER(_IMAGE_LOAD_CONFIG_DIRECTORY64)
 
+ProcThreadAttributeParentProcess = EnumValue("_PROC_THREAD_ATTRIBUTE_NUM", "ProcThreadAttributeParentProcess", 0x0)
+ProcThreadAttributeHandleList = EnumValue("_PROC_THREAD_ATTRIBUTE_NUM", "ProcThreadAttributeHandleList", 0x2)
+ProcThreadAttributeGroupAffinity = EnumValue("_PROC_THREAD_ATTRIBUTE_NUM", "ProcThreadAttributeGroupAffinity", 0x3)
+ProcThreadAttributePreferredNode = EnumValue("_PROC_THREAD_ATTRIBUTE_NUM", "ProcThreadAttributePreferredNode", 0x4)
+ProcThreadAttributeIdealProcessor = EnumValue("_PROC_THREAD_ATTRIBUTE_NUM", "ProcThreadAttributeIdealProcessor", 0x5)
+ProcThreadAttributeUmsThread = EnumValue("_PROC_THREAD_ATTRIBUTE_NUM", "ProcThreadAttributeUmsThread", 0x6)
+ProcThreadAttributeMitigationPolicy = EnumValue("_PROC_THREAD_ATTRIBUTE_NUM", "ProcThreadAttributeMitigationPolicy", 0x7)
+ProcThreadAttributeSecurityCapabilities = EnumValue("_PROC_THREAD_ATTRIBUTE_NUM", "ProcThreadAttributeSecurityCapabilities", 0x9)
+ProcThreadAttributeProtectionLevel = EnumValue("_PROC_THREAD_ATTRIBUTE_NUM", "ProcThreadAttributeProtectionLevel", 0xb)
+ProcThreadAttributeJobList = EnumValue("_PROC_THREAD_ATTRIBUTE_NUM", "ProcThreadAttributeJobList", 0xd)
+ProcThreadAttributeChildProcessPolicy = EnumValue("_PROC_THREAD_ATTRIBUTE_NUM", "ProcThreadAttributeChildProcessPolicy", 0xe)
+ProcThreadAttributeAllApplicationPackagesPolicy = EnumValue("_PROC_THREAD_ATTRIBUTE_NUM", "ProcThreadAttributeAllApplicationPackagesPolicy", 0xf)
+ProcThreadAttributeWin32kFilter = EnumValue("_PROC_THREAD_ATTRIBUTE_NUM", "ProcThreadAttributeWin32kFilter", 0x10)
+ProcThreadAttributeSafeOpenPromptOriginClaim = EnumValue("_PROC_THREAD_ATTRIBUTE_NUM", "ProcThreadAttributeSafeOpenPromptOriginClaim", 0x11)
+ProcThreadAttributeDesktopAppPolicy = EnumValue("_PROC_THREAD_ATTRIBUTE_NUM", "ProcThreadAttributeDesktopAppPolicy", 0x12)
+ProcThreadAttributePseudoConsole = EnumValue("_PROC_THREAD_ATTRIBUTE_NUM", "ProcThreadAttributePseudoConsole", 0x16)
+ProcThreadAttributeMitigationAuditPolicy = EnumValue("_PROC_THREAD_ATTRIBUTE_NUM", "ProcThreadAttributeMitigationAuditPolicy", 0x18)
+ProcThreadAttributeMachineType = EnumValue("_PROC_THREAD_ATTRIBUTE_NUM", "ProcThreadAttributeMachineType", 0x19)
+ProcThreadAttributeComponentFilter = EnumValue("_PROC_THREAD_ATTRIBUTE_NUM", "ProcThreadAttributeComponentFilter", 0x1a)
+ProcThreadAttributeEnableOptionalXStateFeatures = EnumValue("_PROC_THREAD_ATTRIBUTE_NUM", "ProcThreadAttributeEnableOptionalXStateFeatures", 0x1b)
+ProcThreadAttributeTrustedApp = EnumValue("_PROC_THREAD_ATTRIBUTE_NUM", "ProcThreadAttributeTrustedApp", 0x1d)
+ProcThreadAttributeSveVectorLength = EnumValue("_PROC_THREAD_ATTRIBUTE_NUM", "ProcThreadAttributeSveVectorLength", 0x1e)
+class _PROC_THREAD_ATTRIBUTE_NUM(EnumType):
+    values = [ProcThreadAttributeParentProcess, ProcThreadAttributeHandleList, ProcThreadAttributeGroupAffinity, ProcThreadAttributePreferredNode, ProcThreadAttributeIdealProcessor, ProcThreadAttributeUmsThread, ProcThreadAttributeMitigationPolicy, ProcThreadAttributeSecurityCapabilities, ProcThreadAttributeProtectionLevel, ProcThreadAttributeJobList, ProcThreadAttributeChildProcessPolicy, ProcThreadAttributeAllApplicationPackagesPolicy, ProcThreadAttributeWin32kFilter, ProcThreadAttributeSafeOpenPromptOriginClaim, ProcThreadAttributeDesktopAppPolicy, ProcThreadAttributePseudoConsole, ProcThreadAttributeMitigationAuditPolicy, ProcThreadAttributeMachineType, ProcThreadAttributeComponentFilter, ProcThreadAttributeEnableOptionalXStateFeatures, ProcThreadAttributeTrustedApp, ProcThreadAttributeSveVectorLength]
+    mapper = FlagMapper(*values)
+PROC_THREAD_ATTRIBUTE_NUM = _PROC_THREAD_ATTRIBUTE_NUM
+
+
+MemoryBasicInformation = EnumValue("_MEMORY_INFORMATION_CLASS", "MemoryBasicInformation", 0x0)
+MemoryWorkingSetList = EnumValue("_MEMORY_INFORMATION_CLASS", "MemoryWorkingSetList", 0x1)
+MemorySectionName = EnumValue("_MEMORY_INFORMATION_CLASS", "MemorySectionName", 0x2)
+MemoryBasicVlmInformation = EnumValue("_MEMORY_INFORMATION_CLASS", "MemoryBasicVlmInformation", 0x3)
+MemoryWorkingSetListEx = EnumValue("_MEMORY_INFORMATION_CLASS", "MemoryWorkingSetListEx", 0x4)
+class _MEMORY_INFORMATION_CLASS(EnumType):
+    values = [MemoryBasicInformation, MemoryWorkingSetList, MemorySectionName, MemoryBasicVlmInformation, MemoryWorkingSetListEx]
+    mapper = FlagMapper(*values)
+MEMORY_INFORMATION_CLASS = _MEMORY_INFORMATION_CLASS
+
+
+ThreadBasicInformation = EnumValue("_THREAD_INFORMATION_CLASS", "ThreadBasicInformation", 0x0)
+ThreadTimes = EnumValue("_THREAD_INFORMATION_CLASS", "ThreadTimes", 0x1)
+ThreadPriority = EnumValue("_THREAD_INFORMATION_CLASS", "ThreadPriority", 0x2)
+ThreadBasePriority = EnumValue("_THREAD_INFORMATION_CLASS", "ThreadBasePriority", 0x3)
+ThreadAffinityMask = EnumValue("_THREAD_INFORMATION_CLASS", "ThreadAffinityMask", 0x4)
+ThreadImpersonationToken = EnumValue("_THREAD_INFORMATION_CLASS", "ThreadImpersonationToken", 0x5)
+ThreadDescriptorTableEntry = EnumValue("_THREAD_INFORMATION_CLASS", "ThreadDescriptorTableEntry", 0x6)
+ThreadEnableAlignmentFaultFixup = EnumValue("_THREAD_INFORMATION_CLASS", "ThreadEnableAlignmentFaultFixup", 0x7)
+ThreadEventPair = EnumValue("_THREAD_INFORMATION_CLASS", "ThreadEventPair", 0x8)
+ThreadQuerySetWin32StartAddress = EnumValue("_THREAD_INFORMATION_CLASS", "ThreadQuerySetWin32StartAddress", 0x9)
+ThreadZeroTlsCell = EnumValue("_THREAD_INFORMATION_CLASS", "ThreadZeroTlsCell", 0xa)
+ThreadPerformanceCount = EnumValue("_THREAD_INFORMATION_CLASS", "ThreadPerformanceCount", 0xb)
+ThreadAmILastThread = EnumValue("_THREAD_INFORMATION_CLASS", "ThreadAmILastThread", 0xc)
+ThreadIdealProcessor = EnumValue("_THREAD_INFORMATION_CLASS", "ThreadIdealProcessor", 0xd)
+ThreadPriorityBoost = EnumValue("_THREAD_INFORMATION_CLASS", "ThreadPriorityBoost", 0xe)
+ThreadSetTlsArrayAddress = EnumValue("_THREAD_INFORMATION_CLASS", "ThreadSetTlsArrayAddress", 0xf)
+ThreadIsIoPending = EnumValue("_THREAD_INFORMATION_CLASS", "ThreadIsIoPending", 0x10)
+ThreadHideFromDebugger = EnumValue("_THREAD_INFORMATION_CLASS", "ThreadHideFromDebugger", 0x11)
+class _THREAD_INFORMATION_CLASS(EnumType):
+    values = [ThreadBasicInformation, ThreadTimes, ThreadPriority, ThreadBasePriority, ThreadAffinityMask, ThreadImpersonationToken, ThreadDescriptorTableEntry, ThreadEnableAlignmentFaultFixup, ThreadEventPair, ThreadQuerySetWin32StartAddress, ThreadZeroTlsCell, ThreadPerformanceCount, ThreadAmILastThread, ThreadIdealProcessor, ThreadPriorityBoost, ThreadSetTlsArrayAddress, ThreadIsIoPending, ThreadHideFromDebugger]
+    mapper = FlagMapper(*values)
+PTHREAD_INFORMATION_CLASS = POINTER(_THREAD_INFORMATION_CLASS)
+THREAD_INFORMATION_CLASS = _THREAD_INFORMATION_CLASS
+
+
+ProcessBasicInformation = EnumValue("_PROCESSINFOCLASS", "ProcessBasicInformation", 0x0)
+ProcessQuotaLimits = EnumValue("_PROCESSINFOCLASS", "ProcessQuotaLimits", 0x1)
+ProcessIoCounters = EnumValue("_PROCESSINFOCLASS", "ProcessIoCounters", 0x2)
+ProcessVmCounters = EnumValue("_PROCESSINFOCLASS", "ProcessVmCounters", 0x3)
+ProcessTimes = EnumValue("_PROCESSINFOCLASS", "ProcessTimes", 0x4)
+ProcessBasePriority = EnumValue("_PROCESSINFOCLASS", "ProcessBasePriority", 0x5)
+ProcessRaisePriority = EnumValue("_PROCESSINFOCLASS", "ProcessRaisePriority", 0x6)
+ProcessDebugPort = EnumValue("_PROCESSINFOCLASS", "ProcessDebugPort", 0x7)
+ProcessExceptionPort = EnumValue("_PROCESSINFOCLASS", "ProcessExceptionPort", 0x8)
+ProcessAccessToken = EnumValue("_PROCESSINFOCLASS", "ProcessAccessToken", 0x9)
+ProcessLdtInformation = EnumValue("_PROCESSINFOCLASS", "ProcessLdtInformation", 0xa)
+ProcessLdtSize = EnumValue("_PROCESSINFOCLASS", "ProcessLdtSize", 0xb)
+ProcessDefaultHardErrorMode = EnumValue("_PROCESSINFOCLASS", "ProcessDefaultHardErrorMode", 0xc)
+ProcessIoPortHandlers = EnumValue("_PROCESSINFOCLASS", "ProcessIoPortHandlers", 0xd)
+ProcessPooledUsageAndLimits = EnumValue("_PROCESSINFOCLASS", "ProcessPooledUsageAndLimits", 0xe)
+ProcessWorkingSetWatch = EnumValue("_PROCESSINFOCLASS", "ProcessWorkingSetWatch", 0xf)
+ProcessUserModeIOPL = EnumValue("_PROCESSINFOCLASS", "ProcessUserModeIOPL", 0x10)
+ProcessEnableAlignmentFaultFixup = EnumValue("_PROCESSINFOCLASS", "ProcessEnableAlignmentFaultFixup", 0x11)
+ProcessPriorityClass = EnumValue("_PROCESSINFOCLASS", "ProcessPriorityClass", 0x12)
+ProcessWx86Information = EnumValue("_PROCESSINFOCLASS", "ProcessWx86Information", 0x13)
+ProcessHandleCount = EnumValue("_PROCESSINFOCLASS", "ProcessHandleCount", 0x14)
+ProcessAffinityMask = EnumValue("_PROCESSINFOCLASS", "ProcessAffinityMask", 0x15)
+ProcessPriorityBoost = EnumValue("_PROCESSINFOCLASS", "ProcessPriorityBoost", 0x16)
+ProcessDeviceMap = EnumValue("_PROCESSINFOCLASS", "ProcessDeviceMap", 0x17)
+ProcessSessionInformation = EnumValue("_PROCESSINFOCLASS", "ProcessSessionInformation", 0x18)
+ProcessForegroundInformation = EnumValue("_PROCESSINFOCLASS", "ProcessForegroundInformation", 0x19)
+ProcessWow64Information = EnumValue("_PROCESSINFOCLASS", "ProcessWow64Information", 0x1a)
+ProcessImageFileName = EnumValue("_PROCESSINFOCLASS", "ProcessImageFileName", 0x1b)
+ProcessLUIDDeviceMapsEnabled = EnumValue("_PROCESSINFOCLASS", "ProcessLUIDDeviceMapsEnabled", 0x1c)
+ProcessBreakOnTermination = EnumValue("_PROCESSINFOCLASS", "ProcessBreakOnTermination", 0x1d)
+ProcessDebugObjectHandle = EnumValue("_PROCESSINFOCLASS", "ProcessDebugObjectHandle", 0x1e)
+ProcessDebugFlags = EnumValue("_PROCESSINFOCLASS", "ProcessDebugFlags", 0x1f)
+ProcessHandleTracing = EnumValue("_PROCESSINFOCLASS", "ProcessHandleTracing", 0x20)
+ProcessIoPriority = EnumValue("_PROCESSINFOCLASS", "ProcessIoPriority", 0x21)
+ProcessExecuteFlags = EnumValue("_PROCESSINFOCLASS", "ProcessExecuteFlags", 0x22)
+ProcessTlsInformation = EnumValue("_PROCESSINFOCLASS", "ProcessTlsInformation", 0x23)
+ProcessCookie = EnumValue("_PROCESSINFOCLASS", "ProcessCookie", 0x24)
+ProcessImageInformation = EnumValue("_PROCESSINFOCLASS", "ProcessImageInformation", 0x25)
+ProcessCycleTime = EnumValue("_PROCESSINFOCLASS", "ProcessCycleTime", 0x26)
+ProcessPagePriority = EnumValue("_PROCESSINFOCLASS", "ProcessPagePriority", 0x27)
+ProcessInstrumentationCallback = EnumValue("_PROCESSINFOCLASS", "ProcessInstrumentationCallback", 0x28)
+ProcessThreadStackAllocation = EnumValue("_PROCESSINFOCLASS", "ProcessThreadStackAllocation", 0x29)
+ProcessWorkingSetWatchEx = EnumValue("_PROCESSINFOCLASS", "ProcessWorkingSetWatchEx", 0x2a)
+ProcessImageFileNameWin32 = EnumValue("_PROCESSINFOCLASS", "ProcessImageFileNameWin32", 0x2b)
+ProcessImageFileMapping = EnumValue("_PROCESSINFOCLASS", "ProcessImageFileMapping", 0x2c)
+ProcessAffinityUpdateMode = EnumValue("_PROCESSINFOCLASS", "ProcessAffinityUpdateMode", 0x2d)
+ProcessMemoryAllocationMode = EnumValue("_PROCESSINFOCLASS", "ProcessMemoryAllocationMode", 0x2e)
+ProcessGroupInformation = EnumValue("_PROCESSINFOCLASS", "ProcessGroupInformation", 0x2f)
+ProcessTokenVirtualizationEnabled = EnumValue("_PROCESSINFOCLASS", "ProcessTokenVirtualizationEnabled", 0x30)
+ProcessOwnerInformation = EnumValue("_PROCESSINFOCLASS", "ProcessOwnerInformation", 0x31)
+ProcessWindowInformation = EnumValue("_PROCESSINFOCLASS", "ProcessWindowInformation", 0x32)
+ProcessHandleInformation = EnumValue("_PROCESSINFOCLASS", "ProcessHandleInformation", 0x33)
+ProcessMitigationPolicy = EnumValue("_PROCESSINFOCLASS", "ProcessMitigationPolicy", 0x34)
+ProcessDynamicFunctionTableInformation = EnumValue("_PROCESSINFOCLASS", "ProcessDynamicFunctionTableInformation", 0x35)
+ProcessHandleCheckingMode = EnumValue("_PROCESSINFOCLASS", "ProcessHandleCheckingMode", 0x36)
+ProcessKeepAliveCount = EnumValue("_PROCESSINFOCLASS", "ProcessKeepAliveCount", 0x37)
+ProcessRevokeFileHandles = EnumValue("_PROCESSINFOCLASS", "ProcessRevokeFileHandles", 0x38)
+ProcessWorkingSetControl = EnumValue("_PROCESSINFOCLASS", "ProcessWorkingSetControl", 0x39)
+ProcessHandleTable = EnumValue("_PROCESSINFOCLASS", "ProcessHandleTable", 0x3a)
+ProcessCheckStackExtentsMode = EnumValue("_PROCESSINFOCLASS", "ProcessCheckStackExtentsMode", 0x3b)
+ProcessCommandLineInformation = EnumValue("_PROCESSINFOCLASS", "ProcessCommandLineInformation", 0x3c)
+ProcessProtectionInformation = EnumValue("_PROCESSINFOCLASS", "ProcessProtectionInformation", 0x3d)
+ProcessMemoryExhaustion = EnumValue("_PROCESSINFOCLASS", "ProcessMemoryExhaustion", 0x3e)
+ProcessFaultInformation = EnumValue("_PROCESSINFOCLASS", "ProcessFaultInformation", 0x3f)
+ProcessTelemetryIdInformation = EnumValue("_PROCESSINFOCLASS", "ProcessTelemetryIdInformation", 0x40)
+ProcessCommitReleaseInformation = EnumValue("_PROCESSINFOCLASS", "ProcessCommitReleaseInformation", 0x41)
+ProcessReserved1Information = EnumValue("_PROCESSINFOCLASS", "ProcessReserved1Information", 0x42)
+ProcessReserved2Information = EnumValue("_PROCESSINFOCLASS", "ProcessReserved2Information", 0x43)
+ProcessSubsystemProcess = EnumValue("_PROCESSINFOCLASS", "ProcessSubsystemProcess", 0x44)
+ProcessInPrivate = EnumValue("_PROCESSINFOCLASS", "ProcessInPrivate", 0x46)
+ProcessRaiseUMExceptionOnInvalidHandleClose = EnumValue("_PROCESSINFOCLASS", "ProcessRaiseUMExceptionOnInvalidHandleClose", 0x47)
+ProcessSubsystemInformation = EnumValue("_PROCESSINFOCLASS", "ProcessSubsystemInformation", 0x4b)
+ProcessWin32kSyscallFilterInformation = EnumValue("_PROCESSINFOCLASS", "ProcessWin32kSyscallFilterInformation", 0x4f)
+ProcessEnergyTrackingState = EnumValue("_PROCESSINFOCLASS", "ProcessEnergyTrackingState", 0x52)
+MaxProcessInfoClass = EnumValue("_PROCESSINFOCLASS", "MaxProcessInfoClass", 0x53)
+class _PROCESSINFOCLASS(EnumType):
+    values = [ProcessBasicInformation, ProcessQuotaLimits, ProcessIoCounters, ProcessVmCounters, ProcessTimes, ProcessBasePriority, ProcessRaisePriority, ProcessDebugPort, ProcessExceptionPort, ProcessAccessToken, ProcessLdtInformation, ProcessLdtSize, ProcessDefaultHardErrorMode, ProcessIoPortHandlers, ProcessPooledUsageAndLimits, ProcessWorkingSetWatch, ProcessUserModeIOPL, ProcessEnableAlignmentFaultFixup, ProcessPriorityClass, ProcessWx86Information, ProcessHandleCount, ProcessAffinityMask, ProcessPriorityBoost, ProcessDeviceMap, ProcessSessionInformation, ProcessForegroundInformation, ProcessWow64Information, ProcessImageFileName, ProcessLUIDDeviceMapsEnabled, ProcessBreakOnTermination, ProcessDebugObjectHandle, ProcessDebugFlags, ProcessHandleTracing, ProcessIoPriority, ProcessExecuteFlags, ProcessTlsInformation, ProcessCookie, ProcessImageInformation, ProcessCycleTime, ProcessPagePriority, ProcessInstrumentationCallback, ProcessThreadStackAllocation, ProcessWorkingSetWatchEx, ProcessImageFileNameWin32, ProcessImageFileMapping, ProcessAffinityUpdateMode, ProcessMemoryAllocationMode, ProcessGroupInformation, ProcessTokenVirtualizationEnabled, ProcessOwnerInformation, ProcessWindowInformation, ProcessHandleInformation, ProcessMitigationPolicy, ProcessDynamicFunctionTableInformation, ProcessHandleCheckingMode, ProcessKeepAliveCount, ProcessRevokeFileHandles, ProcessWorkingSetControl, ProcessHandleTable, ProcessCheckStackExtentsMode, ProcessCommandLineInformation, ProcessProtectionInformation, ProcessMemoryExhaustion, ProcessFaultInformation, ProcessTelemetryIdInformation, ProcessCommitReleaseInformation, ProcessReserved1Information, ProcessReserved2Information, ProcessSubsystemProcess, ProcessInPrivate, ProcessRaiseUMExceptionOnInvalidHandleClose, ProcessSubsystemInformation, ProcessWin32kSyscallFilterInformation, ProcessEnergyTrackingState, MaxProcessInfoClass]
+    mapper = FlagMapper(*values)
+PROCESSINFOCLASS = _PROCESSINFOCLASS
+
+
+ProcessMemoryPriority = EnumValue("_PROCESS_INFORMATION_CLASS", "ProcessMemoryPriority", 0x0)
+ProcessMemoryExhaustionInfo = EnumValue("_PROCESS_INFORMATION_CLASS", "ProcessMemoryExhaustionInfo", 0x1)
+ProcessAppMemoryInfo = EnumValue("_PROCESS_INFORMATION_CLASS", "ProcessAppMemoryInfo", 0x2)
+ProcessInPrivateInfo = EnumValue("_PROCESS_INFORMATION_CLASS", "ProcessInPrivateInfo", 0x3)
+ProcessPowerThrottling = EnumValue("_PROCESS_INFORMATION_CLASS", "ProcessPowerThrottling", 0x4)
+ProcessReservedValue1 = EnumValue("_PROCESS_INFORMATION_CLASS", "ProcessReservedValue1", 0x5)
+ProcessTelemetryCoverageInfo = EnumValue("_PROCESS_INFORMATION_CLASS", "ProcessTelemetryCoverageInfo", 0x6)
+ProcessProtectionLevelInfo = EnumValue("_PROCESS_INFORMATION_CLASS", "ProcessProtectionLevelInfo", 0x7)
+ProcessLeapSecondInfo = EnumValue("_PROCESS_INFORMATION_CLASS", "ProcessLeapSecondInfo", 0x8)
+ProcessMachineTypeInfo = EnumValue("_PROCESS_INFORMATION_CLASS", "ProcessMachineTypeInfo", 0x9)
+ProcessOverrideSubsequentPrefetchParameter = EnumValue("_PROCESS_INFORMATION_CLASS", "ProcessOverrideSubsequentPrefetchParameter", 0xa)
+ProcessMaxOverridePrefetchParameter = EnumValue("_PROCESS_INFORMATION_CLASS", "ProcessMaxOverridePrefetchParameter", 0xb)
+ProcessInformationClassMax = EnumValue("_PROCESS_INFORMATION_CLASS", "ProcessInformationClassMax", 0xc)
+class _PROCESS_INFORMATION_CLASS(EnumType):
+    values = [ProcessMemoryPriority, ProcessMemoryExhaustionInfo, ProcessAppMemoryInfo, ProcessInPrivateInfo, ProcessPowerThrottling, ProcessReservedValue1, ProcessTelemetryCoverageInfo, ProcessProtectionLevelInfo, ProcessLeapSecondInfo, ProcessMachineTypeInfo, ProcessOverrideSubsequentPrefetchParameter, ProcessMaxOverridePrefetchParameter, ProcessInformationClassMax]
+    mapper = FlagMapper(*values)
+PROCESS_INFORMATION_CLASS = _PROCESS_INFORMATION_CLASS
+
+
+UserEnabled = EnumValue("_MACHINE_ATTRIBUTES", "UserEnabled", 0x1)
+KernelEnabled = EnumValue("_MACHINE_ATTRIBUTES", "KernelEnabled", 0x2)
+Wow64Container = EnumValue("_MACHINE_ATTRIBUTES", "Wow64Container", 0x4)
+class _MACHINE_ATTRIBUTES(EnumType):
+    values = [UserEnabled, KernelEnabled, Wow64Container]
+    mapper = FlagMapper(*values)
+MACHINE_ATTRIBUTES = _MACHINE_ATTRIBUTES
+
+
+class _PROCESS_MACHINE_INFORMATION(Structure):
+    _fields_ = [
+        ("ProcessMachine", USHORT),
+        ("Res0", USHORT),
+        ("MachineAttributes", MACHINE_ATTRIBUTES),
+    ]
+PROCESS_MACHINE_INFORMATION = _PROCESS_MACHINE_INFORMATION
+
 MemExtendedParameterInvalidType = EnumValue("MEM_EXTENDED_PARAMETER_TYPE", "MemExtendedParameterInvalidType", 0x0)
 MemExtendedParameterAddressRequirements = EnumValue("MEM_EXTENDED_PARAMETER_TYPE", "MemExtendedParameterAddressRequirements", 0x1)
 MemExtendedParameterNumaNode = EnumValue("MEM_EXTENDED_PARAMETER_TYPE", "MemExtendedParameterNumaNode", 0x2)
@@ -4630,6 +4813,36 @@ class _SYSTEM_BASIC_INFORMATION(Structure):
 PSYSTEM_BASIC_INFORMATION = POINTER(_SYSTEM_BASIC_INFORMATION)
 SYSTEM_BASIC_INFORMATION = _SYSTEM_BASIC_INFORMATION
 
+class _ANON__ANON__SYSTEM_INFO_SUB_UNION_1_SUB_STRUCTURE_1(Structure):
+    _fields_ = [
+        ("wProcessorArchitecture", WORD),
+        ("wReserved", WORD),
+    ]
+
+class _ANON__SYSTEM_INFO_SUB_UNION_1(Union):
+    _anonymous_ = ("DUMMYSTRUCTNAME",)
+    _fields_ = [
+        ("dwOemId", DWORD),
+        ("DUMMYSTRUCTNAME", _ANON__ANON__SYSTEM_INFO_SUB_UNION_1_SUB_STRUCTURE_1),
+    ]
+
+class _SYSTEM_INFO(Structure):
+    _anonymous_ = ("DUMMYUNIONNAME",)
+    _fields_ = [
+        ("DUMMYUNIONNAME", _ANON__SYSTEM_INFO_SUB_UNION_1),
+        ("dwPageSize", DWORD),
+        ("lpMinimumApplicationAddress", LPVOID),
+        ("lpMaximumApplicationAddress", LPVOID),
+        ("dwActiveProcessorMask", DWORD_PTR),
+        ("dwNumberOfProcessors", DWORD),
+        ("dwProcessorType", DWORD),
+        ("dwAllocationGranularity", DWORD),
+        ("wProcessorLevel", WORD),
+        ("wProcessorRevision", WORD),
+    ]
+LPSYSTEM_INFO = POINTER(_SYSTEM_INFO)
+SYSTEM_INFO = _SYSTEM_INFO
+
 TASK_ACTION_EXEC = EnumValue("_TASK_ACTION_TYPE", "TASK_ACTION_EXEC", 0x0)
 TASK_ACTION_COM_HANDLER = EnumValue("_TASK_ACTION_TYPE", "TASK_ACTION_COM_HANDLER", 0x5)
 TASK_ACTION_SEND_EMAIL = EnumValue("_TASK_ACTION_TYPE", "TASK_ACTION_SEND_EMAIL", 0x6)
@@ -5001,6 +5214,313 @@ class _TEB(Structure):
     ]
 TEB = _TEB
 
+class _ANON__ARM64_NT_NEON128_SUB_STRUCTURE_1(Structure):
+    _fields_ = [
+        ("Low", ULONGLONG),
+        ("High", LONGLONG),
+    ]
+
+class _ARM64_NT_NEON128(Union):
+    _anonymous_ = ("DUMMYSTRUCTNAME",)
+    _fields_ = [
+        ("DUMMYSTRUCTNAME", _ANON__ARM64_NT_NEON128_SUB_STRUCTURE_1),
+        ("D", DOUBLE * (2)),
+        ("S", FLOAT * (4)),
+        ("H", WORD * (8)),
+        ("B", BYTE * (16)),
+    ]
+ARM64_NT_NEON128 = _ARM64_NT_NEON128
+PARM64_NT_NEON128 = POINTER(_ARM64_NT_NEON128)
+
+class _ANON__ANON__ARM64_NT_CONTEXT_SUB_UNION_1_SUB_STRUCTURE_1(Structure):
+    _fields_ = [
+        ("X0", DWORD64),
+        ("X1", DWORD64),
+        ("X2", DWORD64),
+        ("X3", DWORD64),
+        ("X4", DWORD64),
+        ("X5", DWORD64),
+        ("X6", DWORD64),
+        ("X7", DWORD64),
+        ("X8", DWORD64),
+        ("X9", DWORD64),
+        ("X10", DWORD64),
+        ("X11", DWORD64),
+        ("X12", DWORD64),
+        ("X13", DWORD64),
+        ("X14", DWORD64),
+        ("X15", DWORD64),
+        ("X16", DWORD64),
+        ("X17", DWORD64),
+        ("X18", DWORD64),
+        ("X19", DWORD64),
+        ("X20", DWORD64),
+        ("X21", DWORD64),
+        ("X22", DWORD64),
+        ("X23", DWORD64),
+        ("X24", DWORD64),
+        ("X25", DWORD64),
+        ("X26", DWORD64),
+        ("X27", DWORD64),
+        ("X28", DWORD64),
+        ("Fp", DWORD64),
+        ("Lr", DWORD64),
+    ]
+
+class _ANON__ARM64_NT_CONTEXT_SUB_UNION_1(Union):
+    _anonymous_ = ("DUMMYSTRUCTNAME",)
+    _fields_ = [
+        ("DUMMYSTRUCTNAME", _ANON__ANON__ARM64_NT_CONTEXT_SUB_UNION_1_SUB_STRUCTURE_1),
+        ("X", DWORD64 * (31)),
+    ]
+
+class _ARM64_NT_CONTEXT(Structure):
+    _anonymous_ = ("DUMMYUNIONNAME",)
+    _fields_ = [
+        ("ContextFlags", DWORD),
+        ("Cpsr", DWORD),
+        ("DUMMYUNIONNAME", _ANON__ARM64_NT_CONTEXT_SUB_UNION_1),
+        ("Sp", DWORD64),
+        ("Pc", DWORD64),
+        ("V", ARM64_NT_NEON128 * (32)),
+        ("Fpcr", DWORD),
+        ("Fpsr", DWORD),
+        ("Bcr", DWORD * (ARM64_MAX_BREAKPOINTS)),
+        ("Bvr", DWORD64 * (ARM64_MAX_BREAKPOINTS)),
+        ("Wcr", DWORD * (ARM64_MAX_WATCHPOINTS)),
+        ("Wvr", DWORD64 * (ARM64_MAX_WATCHPOINTS)),
+    ]
+ARM64_NT_CONTEXT = _ARM64_NT_CONTEXT
+PARM64_NT_CONTEXT = POINTER(_ARM64_NT_CONTEXT)
+
+class _FLOATING_SAVE_AREA(Structure):
+    _fields_ = [
+        ("ControlWord", DWORD),
+        ("StatusWord", DWORD),
+        ("TagWord", DWORD),
+        ("ErrorOffset", DWORD),
+        ("ErrorSelector", DWORD),
+        ("DataOffset", DWORD),
+        ("DataSelector", DWORD),
+        ("RegisterArea", BYTE * (80)),
+        ("Cr0NpxState", DWORD),
+    ]
+FLOATING_SAVE_AREA = _FLOATING_SAVE_AREA
+
+class _CONTEXT32(Structure):
+    _fields_ = [
+        ("ContextFlags", DWORD),
+        ("Dr0", DWORD),
+        ("Dr1", DWORD),
+        ("Dr2", DWORD),
+        ("Dr3", DWORD),
+        ("Dr6", DWORD),
+        ("Dr7", DWORD),
+        ("FloatSave", FLOATING_SAVE_AREA),
+        ("SegGs", DWORD),
+        ("SegFs", DWORD),
+        ("SegEs", DWORD),
+        ("SegDs", DWORD),
+        ("Edi", DWORD),
+        ("Esi", DWORD),
+        ("Ebx", DWORD),
+        ("Edx", DWORD),
+        ("Ecx", DWORD),
+        ("Eax", DWORD),
+        ("Ebp", DWORD),
+        ("Eip", DWORD),
+        ("SegCs", DWORD),
+        ("EFlags", DWORD),
+        ("Esp", DWORD),
+        ("SegSs", DWORD),
+        ("ExtendedRegisters", BYTE * (512)),
+    ]
+CONTEXT32 = _CONTEXT32
+LPCONTEXT32 = POINTER(_CONTEXT32)
+PCONTEXT32 = POINTER(_CONTEXT32)
+
+class _WOW64_FLOATING_SAVE_AREA(Structure):
+    _fields_ = [
+        ("ControlWord", DWORD),
+        ("StatusWord", DWORD),
+        ("TagWord", DWORD),
+        ("ErrorOffset", DWORD),
+        ("ErrorSelector", DWORD),
+        ("DataOffset", DWORD),
+        ("DataSelector", DWORD),
+        ("RegisterArea", BYTE * (WOW64_SIZE_OF_80387_REGISTERS)),
+        ("Cr0NpxState", DWORD),
+    ]
+WOW64_FLOATING_SAVE_AREA = _WOW64_FLOATING_SAVE_AREA
+
+class _WOW64_CONTEXT(Structure):
+    _fields_ = [
+        ("ContextFlags", DWORD),
+        ("Dr0", DWORD),
+        ("Dr1", DWORD),
+        ("Dr2", DWORD),
+        ("Dr3", DWORD),
+        ("Dr6", DWORD),
+        ("Dr7", DWORD),
+        ("FloatSave", WOW64_FLOATING_SAVE_AREA),
+        ("SegGs", DWORD),
+        ("SegFs", DWORD),
+        ("SegEs", DWORD),
+        ("SegDs", DWORD),
+        ("Edi", DWORD),
+        ("Esi", DWORD),
+        ("Ebx", DWORD),
+        ("Edx", DWORD),
+        ("Ecx", DWORD),
+        ("Eax", DWORD),
+        ("Ebp", DWORD),
+        ("Eip", DWORD),
+        ("SegCs", DWORD),
+        ("EFlags", DWORD),
+        ("Esp", DWORD),
+        ("SegSs", DWORD),
+        ("ExtendedRegisters", BYTE * (WOW64_MAXIMUM_SUPPORTED_EXTENSION)),
+    ]
+PWOW64_CONTEXT = POINTER(_WOW64_CONTEXT)
+WOW64_CONTEXT = _WOW64_CONTEXT
+
+class _M128A(Structure):
+    _fields_ = [
+        ("Low", ULONGLONG),
+        ("High", LONGLONG),
+    ]
+M128A = _M128A
+PM128A = POINTER(_M128A)
+
+class _XSAVE_FORMAT_64(Structure):
+    _fields_ = [
+        ("ControlWord", WORD),
+        ("StatusWord", WORD),
+        ("TagWord", BYTE),
+        ("Reserved1", BYTE),
+        ("ErrorOpcode", WORD),
+        ("ErrorOffset", DWORD),
+        ("ErrorSelector", WORD),
+        ("Reserved2", WORD),
+        ("DataOffset", DWORD),
+        ("DataSelector", WORD),
+        ("Reserved3", WORD),
+        ("MxCsr", DWORD),
+        ("MxCsr_Mask", DWORD),
+        ("FloatRegisters", M128A * (8)),
+        ("XmmRegisters", M128A * (16)),
+        ("Reserved4", BYTE * (96)),
+    ]
+PXSAVE_FORMAT_64 = POINTER(_XSAVE_FORMAT_64)
+XSAVE_FORMAT_64 = _XSAVE_FORMAT_64
+
+class _XSAVE_FORMAT_32(Structure):
+    _fields_ = [
+        ("ControlWord", WORD),
+        ("StatusWord", WORD),
+        ("TagWord", BYTE),
+        ("Reserved1", BYTE),
+        ("ErrorOpcode", WORD),
+        ("ErrorOffset", DWORD),
+        ("ErrorSelector", WORD),
+        ("Reserved2", WORD),
+        ("DataOffset", DWORD),
+        ("DataSelector", WORD),
+        ("Reserved3", WORD),
+        ("MxCsr", DWORD),
+        ("MxCsr_Mask", DWORD),
+        ("FloatRegisters", M128A * (8)),
+        ("XmmRegisters", M128A * (8)),
+        ("Reserved4", BYTE * (192)),
+        ("StackControl", DWORD * (7)),
+        ("Cr0NpxState", DWORD),
+    ]
+PXSAVE_FORMAT_32 = POINTER(_XSAVE_FORMAT_32)
+XSAVE_FORMAT_32 = _XSAVE_FORMAT_32
+
+class _ANON__ANON__CONTEXT64_SUB_UNION_1_SUB_STRUCTURE_1(Structure):
+    _fields_ = [
+        ("Header", M128A * (2)),
+        ("Legacy", M128A * (8)),
+        ("Xmm0", M128A),
+        ("Xmm1", M128A),
+        ("Xmm2", M128A),
+        ("Xmm3", M128A),
+        ("Xmm4", M128A),
+        ("Xmm5", M128A),
+        ("Xmm6", M128A),
+        ("Xmm7", M128A),
+        ("Xmm8", M128A),
+        ("Xmm9", M128A),
+        ("Xmm10", M128A),
+        ("Xmm11", M128A),
+        ("Xmm12", M128A),
+        ("Xmm13", M128A),
+        ("Xmm14", M128A),
+        ("Xmm15", M128A),
+    ]
+
+class _ANON__CONTEXT64_SUB_UNION_1(Union):
+    _anonymous_ = ("DUMMYSTRUCTNAME",)
+    _fields_ = [
+        ("FltSave", XSAVE_FORMAT_64),
+        ("DUMMYSTRUCTNAME", _ANON__ANON__CONTEXT64_SUB_UNION_1_SUB_STRUCTURE_1),
+    ]
+
+class _CONTEXT64(Structure):
+    _anonymous_ = ("DUMMYUNIONNAME",)
+    _fields_ = [
+        ("P1Home", DWORD64),
+        ("P2Home", DWORD64),
+        ("P3Home", DWORD64),
+        ("P4Home", DWORD64),
+        ("P5Home", DWORD64),
+        ("P6Home", DWORD64),
+        ("ContextFlags", DWORD),
+        ("MxCsr", DWORD),
+        ("SegCs", WORD),
+        ("SegDs", WORD),
+        ("SegEs", WORD),
+        ("SegFs", WORD),
+        ("SegGs", WORD),
+        ("SegSs", WORD),
+        ("EFlags", DWORD),
+        ("Dr0", DWORD64),
+        ("Dr1", DWORD64),
+        ("Dr2", DWORD64),
+        ("Dr3", DWORD64),
+        ("Dr6", DWORD64),
+        ("Dr7", DWORD64),
+        ("Rax", DWORD64),
+        ("Rcx", DWORD64),
+        ("Rdx", DWORD64),
+        ("Rbx", DWORD64),
+        ("Rsp", DWORD64),
+        ("Rbp", DWORD64),
+        ("Rsi", DWORD64),
+        ("Rdi", DWORD64),
+        ("R8", DWORD64),
+        ("R9", DWORD64),
+        ("R10", DWORD64),
+        ("R11", DWORD64),
+        ("R12", DWORD64),
+        ("R13", DWORD64),
+        ("R14", DWORD64),
+        ("R15", DWORD64),
+        ("Rip", DWORD64),
+        ("DUMMYUNIONNAME", _ANON__CONTEXT64_SUB_UNION_1),
+        ("VectorRegister", M128A * (26)),
+        ("VectorControl", DWORD64),
+        ("DebugControl", DWORD64),
+        ("LastBranchToRip", DWORD64),
+        ("LastBranchFromRip", DWORD64),
+        ("LastExceptionToRip", DWORD64),
+        ("LastExceptionFromRip", DWORD64),
+    ]
+CONTEXT64 = _CONTEXT64
+LPCONTEXT64 = POINTER(_CONTEXT64)
+PCONTEXT64 = POINTER(_CONTEXT64)
+
 class _TRACE_PROVIDER_INFO(Structure):
     _fields_ = [
         ("ProviderGuid", GUID),
@@ -5495,123 +6015,6 @@ class _SECTION_INHERIT(EnumType):
 SECTION_INHERIT = _SECTION_INHERIT
 
 
-ProcessBasicInformation = EnumValue("_PROCESSINFOCLASS", "ProcessBasicInformation", 0x0)
-ProcessQuotaLimits = EnumValue("_PROCESSINFOCLASS", "ProcessQuotaLimits", 0x1)
-ProcessIoCounters = EnumValue("_PROCESSINFOCLASS", "ProcessIoCounters", 0x2)
-ProcessVmCounters = EnumValue("_PROCESSINFOCLASS", "ProcessVmCounters", 0x3)
-ProcessTimes = EnumValue("_PROCESSINFOCLASS", "ProcessTimes", 0x4)
-ProcessBasePriority = EnumValue("_PROCESSINFOCLASS", "ProcessBasePriority", 0x5)
-ProcessRaisePriority = EnumValue("_PROCESSINFOCLASS", "ProcessRaisePriority", 0x6)
-ProcessDebugPort = EnumValue("_PROCESSINFOCLASS", "ProcessDebugPort", 0x7)
-ProcessExceptionPort = EnumValue("_PROCESSINFOCLASS", "ProcessExceptionPort", 0x8)
-ProcessAccessToken = EnumValue("_PROCESSINFOCLASS", "ProcessAccessToken", 0x9)
-ProcessLdtInformation = EnumValue("_PROCESSINFOCLASS", "ProcessLdtInformation", 0xa)
-ProcessLdtSize = EnumValue("_PROCESSINFOCLASS", "ProcessLdtSize", 0xb)
-ProcessDefaultHardErrorMode = EnumValue("_PROCESSINFOCLASS", "ProcessDefaultHardErrorMode", 0xc)
-ProcessIoPortHandlers = EnumValue("_PROCESSINFOCLASS", "ProcessIoPortHandlers", 0xd)
-ProcessPooledUsageAndLimits = EnumValue("_PROCESSINFOCLASS", "ProcessPooledUsageAndLimits", 0xe)
-ProcessWorkingSetWatch = EnumValue("_PROCESSINFOCLASS", "ProcessWorkingSetWatch", 0xf)
-ProcessUserModeIOPL = EnumValue("_PROCESSINFOCLASS", "ProcessUserModeIOPL", 0x10)
-ProcessEnableAlignmentFaultFixup = EnumValue("_PROCESSINFOCLASS", "ProcessEnableAlignmentFaultFixup", 0x11)
-ProcessPriorityClass = EnumValue("_PROCESSINFOCLASS", "ProcessPriorityClass", 0x12)
-ProcessWx86Information = EnumValue("_PROCESSINFOCLASS", "ProcessWx86Information", 0x13)
-ProcessHandleCount = EnumValue("_PROCESSINFOCLASS", "ProcessHandleCount", 0x14)
-ProcessAffinityMask = EnumValue("_PROCESSINFOCLASS", "ProcessAffinityMask", 0x15)
-ProcessPriorityBoost = EnumValue("_PROCESSINFOCLASS", "ProcessPriorityBoost", 0x16)
-ProcessDeviceMap = EnumValue("_PROCESSINFOCLASS", "ProcessDeviceMap", 0x17)
-ProcessSessionInformation = EnumValue("_PROCESSINFOCLASS", "ProcessSessionInformation", 0x18)
-ProcessForegroundInformation = EnumValue("_PROCESSINFOCLASS", "ProcessForegroundInformation", 0x19)
-ProcessWow64Information = EnumValue("_PROCESSINFOCLASS", "ProcessWow64Information", 0x1a)
-ProcessImageFileName = EnumValue("_PROCESSINFOCLASS", "ProcessImageFileName", 0x1b)
-ProcessLUIDDeviceMapsEnabled = EnumValue("_PROCESSINFOCLASS", "ProcessLUIDDeviceMapsEnabled", 0x1c)
-ProcessBreakOnTermination = EnumValue("_PROCESSINFOCLASS", "ProcessBreakOnTermination", 0x1d)
-ProcessDebugObjectHandle = EnumValue("_PROCESSINFOCLASS", "ProcessDebugObjectHandle", 0x1e)
-ProcessDebugFlags = EnumValue("_PROCESSINFOCLASS", "ProcessDebugFlags", 0x1f)
-ProcessHandleTracing = EnumValue("_PROCESSINFOCLASS", "ProcessHandleTracing", 0x20)
-ProcessIoPriority = EnumValue("_PROCESSINFOCLASS", "ProcessIoPriority", 0x21)
-ProcessExecuteFlags = EnumValue("_PROCESSINFOCLASS", "ProcessExecuteFlags", 0x22)
-ProcessTlsInformation = EnumValue("_PROCESSINFOCLASS", "ProcessTlsInformation", 0x23)
-ProcessCookie = EnumValue("_PROCESSINFOCLASS", "ProcessCookie", 0x24)
-ProcessImageInformation = EnumValue("_PROCESSINFOCLASS", "ProcessImageInformation", 0x25)
-ProcessCycleTime = EnumValue("_PROCESSINFOCLASS", "ProcessCycleTime", 0x26)
-ProcessPagePriority = EnumValue("_PROCESSINFOCLASS", "ProcessPagePriority", 0x27)
-ProcessInstrumentationCallback = EnumValue("_PROCESSINFOCLASS", "ProcessInstrumentationCallback", 0x28)
-ProcessThreadStackAllocation = EnumValue("_PROCESSINFOCLASS", "ProcessThreadStackAllocation", 0x29)
-ProcessWorkingSetWatchEx = EnumValue("_PROCESSINFOCLASS", "ProcessWorkingSetWatchEx", 0x2a)
-ProcessImageFileNameWin32 = EnumValue("_PROCESSINFOCLASS", "ProcessImageFileNameWin32", 0x2b)
-ProcessImageFileMapping = EnumValue("_PROCESSINFOCLASS", "ProcessImageFileMapping", 0x2c)
-ProcessAffinityUpdateMode = EnumValue("_PROCESSINFOCLASS", "ProcessAffinityUpdateMode", 0x2d)
-ProcessMemoryAllocationMode = EnumValue("_PROCESSINFOCLASS", "ProcessMemoryAllocationMode", 0x2e)
-ProcessGroupInformation = EnumValue("_PROCESSINFOCLASS", "ProcessGroupInformation", 0x2f)
-ProcessTokenVirtualizationEnabled = EnumValue("_PROCESSINFOCLASS", "ProcessTokenVirtualizationEnabled", 0x30)
-ProcessOwnerInformation = EnumValue("_PROCESSINFOCLASS", "ProcessOwnerInformation", 0x31)
-ProcessWindowInformation = EnumValue("_PROCESSINFOCLASS", "ProcessWindowInformation", 0x32)
-ProcessHandleInformation = EnumValue("_PROCESSINFOCLASS", "ProcessHandleInformation", 0x33)
-ProcessMitigationPolicy = EnumValue("_PROCESSINFOCLASS", "ProcessMitigationPolicy", 0x34)
-ProcessDynamicFunctionTableInformation = EnumValue("_PROCESSINFOCLASS", "ProcessDynamicFunctionTableInformation", 0x35)
-ProcessHandleCheckingMode = EnumValue("_PROCESSINFOCLASS", "ProcessHandleCheckingMode", 0x36)
-ProcessKeepAliveCount = EnumValue("_PROCESSINFOCLASS", "ProcessKeepAliveCount", 0x37)
-ProcessRevokeFileHandles = EnumValue("_PROCESSINFOCLASS", "ProcessRevokeFileHandles", 0x38)
-ProcessWorkingSetControl = EnumValue("_PROCESSINFOCLASS", "ProcessWorkingSetControl", 0x39)
-ProcessHandleTable = EnumValue("_PROCESSINFOCLASS", "ProcessHandleTable", 0x3a)
-ProcessCheckStackExtentsMode = EnumValue("_PROCESSINFOCLASS", "ProcessCheckStackExtentsMode", 0x3b)
-ProcessCommandLineInformation = EnumValue("_PROCESSINFOCLASS", "ProcessCommandLineInformation", 0x3c)
-ProcessProtectionInformation = EnumValue("_PROCESSINFOCLASS", "ProcessProtectionInformation", 0x3d)
-ProcessMemoryExhaustion = EnumValue("_PROCESSINFOCLASS", "ProcessMemoryExhaustion", 0x3e)
-ProcessFaultInformation = EnumValue("_PROCESSINFOCLASS", "ProcessFaultInformation", 0x3f)
-ProcessTelemetryIdInformation = EnumValue("_PROCESSINFOCLASS", "ProcessTelemetryIdInformation", 0x40)
-ProcessCommitReleaseInformation = EnumValue("_PROCESSINFOCLASS", "ProcessCommitReleaseInformation", 0x41)
-ProcessReserved1Information = EnumValue("_PROCESSINFOCLASS", "ProcessReserved1Information", 0x42)
-ProcessReserved2Information = EnumValue("_PROCESSINFOCLASS", "ProcessReserved2Information", 0x43)
-ProcessSubsystemProcess = EnumValue("_PROCESSINFOCLASS", "ProcessSubsystemProcess", 0x44)
-ProcessInPrivate = EnumValue("_PROCESSINFOCLASS", "ProcessInPrivate", 0x46)
-ProcessRaiseUMExceptionOnInvalidHandleClose = EnumValue("_PROCESSINFOCLASS", "ProcessRaiseUMExceptionOnInvalidHandleClose", 0x47)
-ProcessSubsystemInformation = EnumValue("_PROCESSINFOCLASS", "ProcessSubsystemInformation", 0x4b)
-ProcessWin32kSyscallFilterInformation = EnumValue("_PROCESSINFOCLASS", "ProcessWin32kSyscallFilterInformation", 0x4f)
-ProcessEnergyTrackingState = EnumValue("_PROCESSINFOCLASS", "ProcessEnergyTrackingState", 0x52)
-MaxProcessInfoClass = EnumValue("_PROCESSINFOCLASS", "MaxProcessInfoClass", 0x53)
-class _PROCESSINFOCLASS(EnumType):
-    values = [ProcessBasicInformation, ProcessQuotaLimits, ProcessIoCounters, ProcessVmCounters, ProcessTimes, ProcessBasePriority, ProcessRaisePriority, ProcessDebugPort, ProcessExceptionPort, ProcessAccessToken, ProcessLdtInformation, ProcessLdtSize, ProcessDefaultHardErrorMode, ProcessIoPortHandlers, ProcessPooledUsageAndLimits, ProcessWorkingSetWatch, ProcessUserModeIOPL, ProcessEnableAlignmentFaultFixup, ProcessPriorityClass, ProcessWx86Information, ProcessHandleCount, ProcessAffinityMask, ProcessPriorityBoost, ProcessDeviceMap, ProcessSessionInformation, ProcessForegroundInformation, ProcessWow64Information, ProcessImageFileName, ProcessLUIDDeviceMapsEnabled, ProcessBreakOnTermination, ProcessDebugObjectHandle, ProcessDebugFlags, ProcessHandleTracing, ProcessIoPriority, ProcessExecuteFlags, ProcessTlsInformation, ProcessCookie, ProcessImageInformation, ProcessCycleTime, ProcessPagePriority, ProcessInstrumentationCallback, ProcessThreadStackAllocation, ProcessWorkingSetWatchEx, ProcessImageFileNameWin32, ProcessImageFileMapping, ProcessAffinityUpdateMode, ProcessMemoryAllocationMode, ProcessGroupInformation, ProcessTokenVirtualizationEnabled, ProcessOwnerInformation, ProcessWindowInformation, ProcessHandleInformation, ProcessMitigationPolicy, ProcessDynamicFunctionTableInformation, ProcessHandleCheckingMode, ProcessKeepAliveCount, ProcessRevokeFileHandles, ProcessWorkingSetControl, ProcessHandleTable, ProcessCheckStackExtentsMode, ProcessCommandLineInformation, ProcessProtectionInformation, ProcessMemoryExhaustion, ProcessFaultInformation, ProcessTelemetryIdInformation, ProcessCommitReleaseInformation, ProcessReserved1Information, ProcessReserved2Information, ProcessSubsystemProcess, ProcessInPrivate, ProcessRaiseUMExceptionOnInvalidHandleClose, ProcessSubsystemInformation, ProcessWin32kSyscallFilterInformation, ProcessEnergyTrackingState, MaxProcessInfoClass]
-    mapper = FlagMapper(*values)
-PROCESSINFOCLASS = _PROCESSINFOCLASS
-
-
-MemoryBasicInformation = EnumValue("_MEMORY_INFORMATION_CLASS", "MemoryBasicInformation", 0x0)
-MemoryWorkingSetList = EnumValue("_MEMORY_INFORMATION_CLASS", "MemoryWorkingSetList", 0x1)
-MemorySectionName = EnumValue("_MEMORY_INFORMATION_CLASS", "MemorySectionName", 0x2)
-MemoryBasicVlmInformation = EnumValue("_MEMORY_INFORMATION_CLASS", "MemoryBasicVlmInformation", 0x3)
-MemoryWorkingSetListEx = EnumValue("_MEMORY_INFORMATION_CLASS", "MemoryWorkingSetListEx", 0x4)
-class _MEMORY_INFORMATION_CLASS(EnumType):
-    values = [MemoryBasicInformation, MemoryWorkingSetList, MemorySectionName, MemoryBasicVlmInformation, MemoryWorkingSetListEx]
-    mapper = FlagMapper(*values)
-MEMORY_INFORMATION_CLASS = _MEMORY_INFORMATION_CLASS
-
-
-ThreadBasicInformation = EnumValue("_THREAD_INFORMATION_CLASS", "ThreadBasicInformation", 0x0)
-ThreadTimes = EnumValue("_THREAD_INFORMATION_CLASS", "ThreadTimes", 0x1)
-ThreadPriority = EnumValue("_THREAD_INFORMATION_CLASS", "ThreadPriority", 0x2)
-ThreadBasePriority = EnumValue("_THREAD_INFORMATION_CLASS", "ThreadBasePriority", 0x3)
-ThreadAffinityMask = EnumValue("_THREAD_INFORMATION_CLASS", "ThreadAffinityMask", 0x4)
-ThreadImpersonationToken = EnumValue("_THREAD_INFORMATION_CLASS", "ThreadImpersonationToken", 0x5)
-ThreadDescriptorTableEntry = EnumValue("_THREAD_INFORMATION_CLASS", "ThreadDescriptorTableEntry", 0x6)
-ThreadEnableAlignmentFaultFixup = EnumValue("_THREAD_INFORMATION_CLASS", "ThreadEnableAlignmentFaultFixup", 0x7)
-ThreadEventPair = EnumValue("_THREAD_INFORMATION_CLASS", "ThreadEventPair", 0x8)
-ThreadQuerySetWin32StartAddress = EnumValue("_THREAD_INFORMATION_CLASS", "ThreadQuerySetWin32StartAddress", 0x9)
-ThreadZeroTlsCell = EnumValue("_THREAD_INFORMATION_CLASS", "ThreadZeroTlsCell", 0xa)
-ThreadPerformanceCount = EnumValue("_THREAD_INFORMATION_CLASS", "ThreadPerformanceCount", 0xb)
-ThreadAmILastThread = EnumValue("_THREAD_INFORMATION_CLASS", "ThreadAmILastThread", 0xc)
-ThreadIdealProcessor = EnumValue("_THREAD_INFORMATION_CLASS", "ThreadIdealProcessor", 0xd)
-ThreadPriorityBoost = EnumValue("_THREAD_INFORMATION_CLASS", "ThreadPriorityBoost", 0xe)
-ThreadSetTlsArrayAddress = EnumValue("_THREAD_INFORMATION_CLASS", "ThreadSetTlsArrayAddress", 0xf)
-ThreadIsIoPending = EnumValue("_THREAD_INFORMATION_CLASS", "ThreadIsIoPending", 0x10)
-ThreadHideFromDebugger = EnumValue("_THREAD_INFORMATION_CLASS", "ThreadHideFromDebugger", 0x11)
-class _THREAD_INFORMATION_CLASS(EnumType):
-    values = [ThreadBasicInformation, ThreadTimes, ThreadPriority, ThreadBasePriority, ThreadAffinityMask, ThreadImpersonationToken, ThreadDescriptorTableEntry, ThreadEnableAlignmentFaultFixup, ThreadEventPair, ThreadQuerySetWin32StartAddress, ThreadZeroTlsCell, ThreadPerformanceCount, ThreadAmILastThread, ThreadIdealProcessor, ThreadPriorityBoost, ThreadSetTlsArrayAddress, ThreadIsIoPending, ThreadHideFromDebugger]
-    mapper = FlagMapper(*values)
-PTHREAD_INFORMATION_CLASS = POINTER(_THREAD_INFORMATION_CLASS)
-THREAD_INFORMATION_CLASS = _THREAD_INFORMATION_CLASS
-
-
 VT_EMPTY = EnumValue("_VARENUM", "VT_EMPTY", 0x0)
 VT_NULL = EnumValue("_VARENUM", "VT_NULL", 0x1)
 VT_I2 = EnumValue("_VARENUM", "VT_I2", 0x2)
@@ -6227,234 +6630,6 @@ LPPROCESS_INFORMATION = POINTER(_PROCESS_INFORMATION)
 PPROCESS_INFORMATION = POINTER(_PROCESS_INFORMATION)
 PROCESS_INFORMATION = _PROCESS_INFORMATION
 
-class _FLOATING_SAVE_AREA(Structure):
-    _fields_ = [
-        ("ControlWord", DWORD),
-        ("StatusWord", DWORD),
-        ("TagWord", DWORD),
-        ("ErrorOffset", DWORD),
-        ("ErrorSelector", DWORD),
-        ("DataOffset", DWORD),
-        ("DataSelector", DWORD),
-        ("RegisterArea", BYTE * (80)),
-        ("Cr0NpxState", DWORD),
-    ]
-FLOATING_SAVE_AREA = _FLOATING_SAVE_AREA
-
-class _CONTEXT32(Structure):
-    _fields_ = [
-        ("ContextFlags", DWORD),
-        ("Dr0", DWORD),
-        ("Dr1", DWORD),
-        ("Dr2", DWORD),
-        ("Dr3", DWORD),
-        ("Dr6", DWORD),
-        ("Dr7", DWORD),
-        ("FloatSave", FLOATING_SAVE_AREA),
-        ("SegGs", DWORD),
-        ("SegFs", DWORD),
-        ("SegEs", DWORD),
-        ("SegDs", DWORD),
-        ("Edi", DWORD),
-        ("Esi", DWORD),
-        ("Ebx", DWORD),
-        ("Edx", DWORD),
-        ("Ecx", DWORD),
-        ("Eax", DWORD),
-        ("Ebp", DWORD),
-        ("Eip", DWORD),
-        ("SegCs", DWORD),
-        ("EFlags", DWORD),
-        ("Esp", DWORD),
-        ("SegSs", DWORD),
-        ("ExtendedRegisters", BYTE * (512)),
-    ]
-CONTEXT32 = _CONTEXT32
-LPCONTEXT32 = POINTER(_CONTEXT32)
-PCONTEXT32 = POINTER(_CONTEXT32)
-
-class _WOW64_FLOATING_SAVE_AREA(Structure):
-    _fields_ = [
-        ("ControlWord", DWORD),
-        ("StatusWord", DWORD),
-        ("TagWord", DWORD),
-        ("ErrorOffset", DWORD),
-        ("ErrorSelector", DWORD),
-        ("DataOffset", DWORD),
-        ("DataSelector", DWORD),
-        ("RegisterArea", BYTE * (WOW64_SIZE_OF_80387_REGISTERS)),
-        ("Cr0NpxState", DWORD),
-    ]
-WOW64_FLOATING_SAVE_AREA = _WOW64_FLOATING_SAVE_AREA
-
-class _WOW64_CONTEXT(Structure):
-    _fields_ = [
-        ("ContextFlags", DWORD),
-        ("Dr0", DWORD),
-        ("Dr1", DWORD),
-        ("Dr2", DWORD),
-        ("Dr3", DWORD),
-        ("Dr6", DWORD),
-        ("Dr7", DWORD),
-        ("FloatSave", WOW64_FLOATING_SAVE_AREA),
-        ("SegGs", DWORD),
-        ("SegFs", DWORD),
-        ("SegEs", DWORD),
-        ("SegDs", DWORD),
-        ("Edi", DWORD),
-        ("Esi", DWORD),
-        ("Ebx", DWORD),
-        ("Edx", DWORD),
-        ("Ecx", DWORD),
-        ("Eax", DWORD),
-        ("Ebp", DWORD),
-        ("Eip", DWORD),
-        ("SegCs", DWORD),
-        ("EFlags", DWORD),
-        ("Esp", DWORD),
-        ("SegSs", DWORD),
-        ("ExtendedRegisters", BYTE * (WOW64_MAXIMUM_SUPPORTED_EXTENSION)),
-    ]
-PWOW64_CONTEXT = POINTER(_WOW64_CONTEXT)
-WOW64_CONTEXT = _WOW64_CONTEXT
-
-class _M128A(Structure):
-    _fields_ = [
-        ("Low", ULONGLONG),
-        ("High", LONGLONG),
-    ]
-M128A = _M128A
-PM128A = POINTER(_M128A)
-
-class _XSAVE_FORMAT_64(Structure):
-    _fields_ = [
-        ("ControlWord", WORD),
-        ("StatusWord", WORD),
-        ("TagWord", BYTE),
-        ("Reserved1", BYTE),
-        ("ErrorOpcode", WORD),
-        ("ErrorOffset", DWORD),
-        ("ErrorSelector", WORD),
-        ("Reserved2", WORD),
-        ("DataOffset", DWORD),
-        ("DataSelector", WORD),
-        ("Reserved3", WORD),
-        ("MxCsr", DWORD),
-        ("MxCsr_Mask", DWORD),
-        ("FloatRegisters", M128A * (8)),
-        ("XmmRegisters", M128A * (16)),
-        ("Reserved4", BYTE * (96)),
-    ]
-PXSAVE_FORMAT_64 = POINTER(_XSAVE_FORMAT_64)
-XSAVE_FORMAT_64 = _XSAVE_FORMAT_64
-
-class _XSAVE_FORMAT_32(Structure):
-    _fields_ = [
-        ("ControlWord", WORD),
-        ("StatusWord", WORD),
-        ("TagWord", BYTE),
-        ("Reserved1", BYTE),
-        ("ErrorOpcode", WORD),
-        ("ErrorOffset", DWORD),
-        ("ErrorSelector", WORD),
-        ("Reserved2", WORD),
-        ("DataOffset", DWORD),
-        ("DataSelector", WORD),
-        ("Reserved3", WORD),
-        ("MxCsr", DWORD),
-        ("MxCsr_Mask", DWORD),
-        ("FloatRegisters", M128A * (8)),
-        ("XmmRegisters", M128A * (8)),
-        ("Reserved4", BYTE * (192)),
-        ("StackControl", DWORD * (7)),
-        ("Cr0NpxState", DWORD),
-    ]
-PXSAVE_FORMAT_32 = POINTER(_XSAVE_FORMAT_32)
-XSAVE_FORMAT_32 = _XSAVE_FORMAT_32
-
-class _TMP_DUMMYSTRUCTNAME(Structure):
-    _fields_ = [
-        ("Header", M128A * (2)),
-        ("Legacy", M128A * (8)),
-        ("Xmm0", M128A),
-        ("Xmm1", M128A),
-        ("Xmm2", M128A),
-        ("Xmm3", M128A),
-        ("Xmm4", M128A),
-        ("Xmm5", M128A),
-        ("Xmm6", M128A),
-        ("Xmm7", M128A),
-        ("Xmm8", M128A),
-        ("Xmm9", M128A),
-        ("Xmm10", M128A),
-        ("Xmm11", M128A),
-        ("Xmm12", M128A),
-        ("Xmm13", M128A),
-        ("Xmm14", M128A),
-        ("Xmm15", M128A),
-    ]
-TMP_DUMMYSTRUCTNAME = _TMP_DUMMYSTRUCTNAME
-
-class _TMP_CONTEXT64_SUBUNION(Union):
-    _fields_ = [
-        ("FltSave", XSAVE_FORMAT_64),
-        ("DUMMYSTRUCTNAME", TMP_DUMMYSTRUCTNAME),
-    ]
-TMP_CONTEXT64_SUBUNION = _TMP_CONTEXT64_SUBUNION
-
-class _CONTEXT64(Structure):
-    _fields_ = [
-        ("P1Home", DWORD64),
-        ("P2Home", DWORD64),
-        ("P3Home", DWORD64),
-        ("P4Home", DWORD64),
-        ("P5Home", DWORD64),
-        ("P6Home", DWORD64),
-        ("ContextFlags", DWORD),
-        ("MxCsr", DWORD),
-        ("SegCs", WORD),
-        ("SegDs", WORD),
-        ("SegEs", WORD),
-        ("SegFs", WORD),
-        ("SegGs", WORD),
-        ("SegSs", WORD),
-        ("EFlags", DWORD),
-        ("Dr0", DWORD64),
-        ("Dr1", DWORD64),
-        ("Dr2", DWORD64),
-        ("Dr3", DWORD64),
-        ("Dr6", DWORD64),
-        ("Dr7", DWORD64),
-        ("Rax", DWORD64),
-        ("Rcx", DWORD64),
-        ("Rdx", DWORD64),
-        ("Rbx", DWORD64),
-        ("Rsp", DWORD64),
-        ("Rbp", DWORD64),
-        ("Rsi", DWORD64),
-        ("Rdi", DWORD64),
-        ("R8", DWORD64),
-        ("R9", DWORD64),
-        ("R10", DWORD64),
-        ("R11", DWORD64),
-        ("R12", DWORD64),
-        ("R13", DWORD64),
-        ("R14", DWORD64),
-        ("R15", DWORD64),
-        ("Rip", DWORD64),
-        ("DUMMYUNIONNAME", TMP_CONTEXT64_SUBUNION),
-        ("VectorRegister", M128A * (26)),
-        ("VectorControl", DWORD64),
-        ("DebugControl", DWORD64),
-        ("LastBranchToRip", DWORD64),
-        ("LastBranchFromRip", DWORD64),
-        ("LastExceptionToRip", DWORD64),
-        ("LastExceptionFromRip", DWORD64),
-    ]
-CONTEXT64 = _CONTEXT64
-LPCONTEXT64 = POINTER(_CONTEXT64)
-PCONTEXT64 = POINTER(_CONTEXT64)
-
 class tagPROCESSENTRY32W(Structure):
     _fields_ = [
         ("dwSize", DWORD),
@@ -9109,6 +9284,17 @@ class _STRUCT_PLAINTEXTKEYBLOB(Structure):
 PSTRUCT_PLAINTEXTKEYBLOB = POINTER(_STRUCT_PLAINTEXTKEYBLOB)
 STRUCT_PLAINTEXTKEYBLOB = _STRUCT_PLAINTEXTKEYBLOB
 
+class _CERT_REQUEST_INFO(Structure):
+    _fields_ = [
+        ("dwVersion", DWORD),
+        ("Subject", CERT_NAME_BLOB),
+        ("SubjectPublicKeyInfo", CERT_PUBLIC_KEY_INFO),
+        ("cAttribute", DWORD),
+        ("rgAttribute", PCRYPT_ATTRIBUTE),
+    ]
+CERT_REQUEST_INFO = _CERT_REQUEST_INFO
+PCERT_REQUEST_INFO = POINTER(_CERT_REQUEST_INFO)
+
 class _EXCEPTION_DEBUG_INFO(Structure):
     _fields_ = [
         ("ExceptionRecord", EXCEPTION_RECORD),

windows/injection.py

@@ -184,6 +184,8 @@ def perform_manual_getproc_loadlib(target, *args, **kwargs):
 
 
 def load_dll_in_remote_process(target, dll_path):
+    if target.architecture == gdef.IMAGE_FILE_MACHINE_ARM64:
+        raise NotImplementedError("Injection in ARM64 target process is not implemented")
     rpeb = target.peb
     if rpeb.Ldr:
         # LDR est parcourable, ca va etre deja plus simple..
@@ -372,6 +374,8 @@ def generate_python_exec_shellcode_64(target, PyDll):
 
 def inject_python_command(target, code_injected, PYDLL):
     """Postulate: PYDLL is already loaded in target process"""
+    if target.architecture == gdef.IMAGE_FILE_MACHINE_ARM64:
+        raise NotImplementedError("Injection in ARM64 target process is not implemented")
     PYCODE = code_injected + "\x00"
     # TODO: free this (how ? when ?)
     remote_python_code_addr = target.virtual_alloc(len(PYCODE))

windows/native_exec/simple_arm64.py

@@ -0,0 +1,627 @@
+# -*- coding: utf-8 -*-
+import sys
+import collections
+import struct
+import binascii
+import operator
+
+
+# py3
+is_py3 = (sys.version_info.major >= 3)
+if is_py3:
+    basestring = str
+    int_types = int
+else:
+    int_types = (int, long)
+
+# https://documentation-service.arm.com/static/67581b3355451e3c38d97c22
+# Chapter C4: A64 Instruction Set Encoding: :
+
+## C2.1.3
+# 32-bit variant (sf = 0).
+# 64-bit variant (sf = 1).
+
+## C2.1.5
+# The following symbol conventions are used:
+# <Xn> The 64-bit name of a general-purpose register (X0-X30) or the zero register (XZR).
+# <Wn> The 32-bit name of a general-purpose register (W0-W30) or the zero register (WZR).
+# <Xn|SP> The 64-bit name of a general-purpose register (X0-X30) or the current stack pointer (SP).
+# <Wn|WSP> The 32-bit name of a general-purpose register (W0-W30) or the current stack pointer (WSP).
+# <Bn>, <Hn>, <Sn>, <Dn>, <Qn>
+# The 8, 16, 32, 64, or 128-bit name of a SIMD and floating-point register in a scalar context, as
+# described in Register names.
+# <Vn> The name of a SIMD and floating-point register in a vector context, as described in Register names.
+# <Zn> The name of an SVE scalable vector register, as described in Treatment of SVE scalable vector
+# registers.
+# <Pn> The name of an SVE scalable predicate register, as described in Vector predication
+
+
+# Make a special memoryview that match what is show in the ARM Chapter C4 ?
+
+# A lot of hardcoded bits are filled this way:
+
+## self.bits[24:32] = reversed(bytearray(XXX))
+
+# This allow to write the bits in the same order as the ARM manual which is describe with most significant bit first
+# Whereas our internal structure is reverse for simplicity of mapping it on list index
+
+XREGISTER = {'X0', 'X1', 'X2', 'X3', 'X4', 'X5', 'X6', 'X7', 'X8', 'X9', 'X10', 'X11', 'X12', 'X13', 'X14', 'X15', 'X16', 'X17', 'X18', 'X19', 'X20', 'X21', 'X22', 'X23', 'X24', 'X25', 'X26', 'X27', 'X28', 'X29', 'X30'}
+WREGISTER = {'W0', 'W1', 'W2', 'W3', 'W4', 'W5', 'W6', 'W7', 'W8', 'W9', 'W10', 'W11', 'W12', 'W13', 'W14', 'W15', 'W16', 'W17', 'W18', 'W19', 'W20', 'W21', 'W22', 'W23', 'W24', 'W25', 'W26', 'W27', 'W28', 'W29', 'W30'}
+ALL_REGISTER = XREGISTER | WREGISTER
+
+SP = "SP"
+WSP = "WSP"
+
+ZR = "XZR"
+WZR = "WZR"
+# Special register name for simple_arm64 that do not setup bitness
+# Bitness will depends on others registers in the instruction
+ZERO = "ZERO"
+
+SPECIAL_X31 = set((SP, WSP, ZR, WZR, ZERO))
+
+# Argument class
+class Shift(object):
+    """Represent a shift parameter of an instruction.
+    Allow to JIT shift at instruction crafting time without string manipulation for the #XXX"""
+    def __init__(self, type, value):
+        assert isinstance(type, str)
+        assert isinstance(value, int)
+        type = type.upper()
+        assert type in ("LSL", "LSR", "ASR", "ROR")
+        self.type = type
+        self.value = value
+
+    def __eq__(self, other):
+        if not isinstance(other, Shift): # Allow compare to tuple & iterable
+            return ((len(other) == 2) and
+                    (self.type == other[0]) and
+                    (self.value == other[1]))
+        return (self.type == other.type) and (self.value == other.value)
+
+    def __repr__(self):
+        return """{0}(type={1}, value={2})""".format(type(self).__name__, self.type, self.value)
+
+    @classmethod
+    def parse(cls, shiftstr):
+        if not isinstance(shiftstr, str):
+            return None
+        if not shiftstr.count(" ") == 1:
+            return None
+        stype, svalue = shiftstr.split(" ", 1)
+        stype = stype.upper()
+        if stype not in ("LSL", "LSR", "ASR", "ROR"):
+            return None
+        if len(svalue) <= 1:
+            return None
+        if not svalue.startswith("#"):
+            return None
+        try:
+            intvalue = int(svalue[1:])
+        except ValueError:
+            return None
+        return cls(stype, intvalue)
+# instruction Encoding
+
+class InstructionEncoding(object):
+    # Sub classes can force 32/64 only instrs by setting this to 32 or 64
+    BITNESS = None
+
+    def __init__(self):
+        super(InstructionEncoding, self).__init__()
+        # Bits are in
+        # 0 1 2 3 4 ... 31
+        # Translation to real little-endian is done last
+        self.bytearray = bytearray(32)
+        self.bits = memoryview(self.bytearray)
+
+        self.bitness = self.BITNESS
+
+    @classmethod
+    def is_register(self, arg, accept_sp=False):
+        arg = arg.upper()
+        return (arg in ALL_REGISTER or
+                (accept_sp and (arg in [SP, WSP])) or
+                (not accept_sp and (arg in [ZR, WZR, ZERO])))
+
+    @classmethod
+    def is_imm(self, arg):
+        try:
+            value = int(arg)
+        except (ValueError, TypeError):
+            return False
+        return True # Check size max ?
+
+    @classmethod
+    def is_shift(self, arg):
+        return (arg is None) or isinstance(arg, Shift) or Shift.parse(arg)
+
+
+    @classmethod
+    def gen(cls, **encoding_array):
+        class GeneratedEncodingCls(cls):
+            ENCODING_VALUES = encoding_array
+        return GeneratedEncodingCls
+
+    # Instruction filing at instanciation
+
+    def setup_fixed_values(self):
+        # Setup the values registered by InstructionEncoding.gen(x=1, y=2)
+        for name, value in self.ENCODING_VALUES.items():
+            assert isinstance(value, int)
+            self.setup_immediat(getattr(self, name), value)
+
+    def binencode_imm(self, immediat, outsize):
+        binstr = "{:0{outsize}b}".format(immediat, outsize=outsize)
+        if len(binstr) != outsize:
+            raise ValueError("Could not encode immediat {0} in {1} bits. Value take {2} bits".format(immediat, outsize, len(binstr)))
+
+        binlist = [int(c) for c in reversed(binstr)]
+        return bytearray(binlist)
+
+    def setup_bitness(self, bitness):
+        assert bitness in (32, 64)
+        if self.bitness is None:
+            self.bitness = bitness
+            if bitness == 32:
+                self.sf[:] = b"\x00"
+            else: # bitness == 64:
+                self.sf[:] = b"\x01"
+        if self.bitness != bitness:
+            raise ValueError("Bitness mismatch on <{0}> encoding, instruction is alredy {1} cannot set as {2}".format(type(self).__name__, self.bitness, bitness))
+
+    def encode_register(self, register, outsize=5):
+        register = register.upper()
+        if register in SPECIAL_X31:
+            if register == ZERO:
+                pass # Special simple_arm64 value that do not setup bitness
+            elif register.startswith("W"):
+               self.setup_bitness(32)
+            else:
+                self.setup_bitness(64)
+            return self.binencode_imm(31, outsize)
+
+        assert register in ALL_REGISTER
+        if register in XREGISTER:
+            self.setup_bitness(64)
+        else:
+            self.setup_bitness(32)
+        return self.binencode_imm(int(register[1:]), outsize)
+
+    def setup_register(self, regfield, register):
+        encoded = self.encode_register(register)
+        regfield[:] = encoded
+
+    # Instruction filing at instanciation
+    def setup_immediat(self, immfield, value):
+        immsize = len(immfield)
+        immfield[:] = self.binencode_imm(value, immsize)
+        return True
+
+
+
+# C4.1.93 Data Processing - Immediate
+
+class DataProcessingImmediate(InstructionEncoding):
+    def __init__(self):
+        super(DataProcessingImmediate, self).__init__()
+        self.bits[26:29] = bytearray((0,0,1))
+        self.op0 = self.bits[29:31]
+        self.op1 = self.bits[22:26]
+
+class AddSubtractImmediate(DataProcessingImmediate):
+    def __init__(self, argsdict):
+        super(AddSubtractImmediate, self).__init__()
+        self.sf = self.bits[31:32] # Keep it a memoryview
+        self.op = self.bits[30:31] # Keep it a memoryview
+        self.S = self.bits[29:30] # Keep it a memoryview
+        self.bits[23:29] = bytearray((0, 1, 0, 0, 0, 1))
+        self.sh = self.bits[22:23]
+        self.imm12 = self.bits[10:22]
+        self.rn = self.bits[5:10]
+        self.rd = self.bits[0:5]
+
+
+        self.setup_fixed_values()
+        # Change instruction based of parameter
+        self.setup_register(self.rd, argsdict[0])
+        self.setup_register(self.rn, argsdict[1])
+        self.setup_immediat(self.imm12, argsdict[2])
+
+        shift = Shift.parse(argsdict.get(3))
+        if not shift:
+            return
+
+        if shift not in [("LSL", 0), ("LSL", 12)]:
+            raise ValueError("Invalid shift for instruction: {0}".format(shift))
+        if shift == ("LSL", 12):
+            self.sh[:] = bytearray((1,))
+
+
+    @classmethod
+    def accept_arg(cls, argsdict):
+        return (cls.is_register(argsdict[0], accept_sp=True) and
+                cls.is_register(argsdict[1], accept_sp=True) and
+                cls.is_imm(argsdict[2]) and
+                cls.is_shift(argsdict.get(3)))
+
+
+# C4.1.93.6 Logical (immediate)
+# Wtf : https://kddnewton.com/2022/08/11/aarch64-bitmask-immediates.html
+
+class DataProcessingLogicalImmediate(DataProcessingImmediate):
+    def __init__(self, argsdict):
+        super(DataProcessingLogicalImmediate, self).__init__()
+        self.sf = self.bits[31:32]
+        self.opc = self.bits[29:31]
+        self.bits[23:29] = bytearray(reversed((1, 0, 0, 1, 0, 0)))
+        self.N = self.bits[22:23]
+        self.immr = self.bits[16:22]
+        self.imms = self.bits[10:16]
+        self.rn = self.bits[5:10]
+        self.rd = self.bits[0:5]
+
+        self.setup_fixed_values()
+        # Change instruction based of parameter
+        self.setup_register(self.rd, argsdict[0])
+        self.setup_register(self.rn, argsdict[1])
+        self.setup_bitmask_imm(self.imm12, argsdict[2])
+
+    @classmethod
+    def accept_arg(cls, argsdict):
+        return (cls.is_register(argsdict[0], accept_sp=True) and
+                cls.is_register(argsdict[1], accept_sp=True) and
+                cls.is_bitmask_imm(argsdict[2]))
+
+    @classmethod
+    def is_bitmask_imm(*args, **kwargs):
+        raise NotImplementedError("is_bitmask_imm")
+
+    def setup_bitmask_imm(*args, **kwargs):
+        raise NotImplementedError("setup_bitmask_imm")
+
+
+class MovWideImmediat(DataProcessingImmediate):
+    def __init__(self, argsdict):
+        super(MovWideImmediat, self).__init__()
+        self.sf = self.bits[31:32]
+        self.opc = self.bits[29:31]
+        self.bits[23:29] = bytearray(reversed((1, 0, 0, 1, 0, 1)))
+        self.hw = self.bits[21:23]
+        self.imm16 = self.bits[5:21]
+        self.rd = self.bits[0:5]
+
+
+        self.setup_fixed_values()
+        # Change instruction based of parameter
+        self.setup_register(self.rd, argsdict[0])
+        self.setup_immediat(self.imm16, argsdict[1])
+
+        shift = Shift.parse(argsdict.get(2))
+        if not shift:
+            return
+        if shift.type != "LSL":
+            raise ValueError("Invalid shift type for {0} : {1}".format(type(self).__name__, shift.value))
+        if shift.value not in (0, 16 ,32, 48):
+            raise ValueError("Invalid shift value for {0} : {1}".format(type(self).__name__, shift.value))
+        if self.bitness == 32 and shift.value > 16:
+            raise ValueError("Invalid shift value for 32bits encoding of {0} : {1}".format(type(self).__name__, shift.value))
+
+        self.setup_immediat(self.hw, shift.value // 16)
+
+
+    @classmethod
+    def accept_arg(cls, argsdict):
+        return (cls.is_register(argsdict[0], accept_sp=True) and
+                cls.is_imm(argsdict[1]) and
+                cls.is_shift(argsdict.get(2)))
+
+
+
+### C4.1.94.13 Unconditional branch (register)
+
+class UnconditionalBranchRegister(InstructionEncoding):
+    BITNESS = 64
+
+    def __init__(self, argsdict):
+        super(UnconditionalBranchRegister, self).__init__()
+        # Allow to fill it in the same order as the ARM manual
+        self.bits[25:32] = bytearray(reversed((1, 1, 0, 1, 0, 1, 1)))
+        self.opc = self.bits[21:25]
+        self.op2 = self.bits[16:21]
+        self.op3 = self.bits[10:16]
+        self.rn = self.bits[5:10]
+        self.op4 = self.bits[0:5]
+
+        self.setup_fixed_values()
+        self.setup_register(self.rn, argsdict[0])
+
+    @classmethod
+    def accept_arg(cls, argsdict):
+        return (cls.is_register(argsdict[0], accept_sp=True))
+
+
+class RetEncoding(UnconditionalBranchRegister.gen(opc=0b10, op2=0b11111, op3=0, op4=0)):
+    # Ret can accept no register and default to X30
+    def __init__(self, argsdict):
+        if not argsdict:
+            argsdict[0] = "X30"
+        super(RetEncoding, self).__init__(argsdict)
+
+    @classmethod
+    def accept_arg(cls, argsdict):
+        return not argsdict or cls.is_register(argsdict[0], accept_sp=True)
+
+
+# C4.1.95 Data Processing – Register
+
+class DataProcessingRegister(InstructionEncoding):
+    def __init__(self):
+        super(DataProcessingRegister, self).__init__()
+        self.op0 = self.bits[30:31]
+        self.op1 = self.bits[28:29]
+        self.bits[25:28] = bytearray(reversed((1, 0, 1)))
+        self.op2 = self.bits[21:25]
+        self.op3 = self.bits[10:16]
+
+class DataProcessingLogicalShiftedRegister(DataProcessingRegister):
+    def __init__(self, argsdict):
+        super(DataProcessingLogicalShiftedRegister, self).__init__()
+        self.sf = self.bits[31:32]
+        self.opc = self.bits[29:31]
+        self.bits[24:29] = bytearray(reversed((0, 1, 0, 1, 0)))
+        self.shift = self.bits[22:24]
+        self.N = self.bits[21:22]
+        self.rm = self.bits[16:21]
+        self.imm6 = self.bits[10:16]
+        self.rn = self.bits[5:10]
+        self.rd = self.bits[0:5]
+
+        self.setup_fixed_values()
+        # Change instruction based of parameter
+        self.setup_register(self.rd, argsdict[0])
+        self.setup_register(self.rn, argsdict[1])
+        self.setup_register(self.rm, argsdict[2])
+
+        shift = Shift.parse(argsdict.get(3))
+        if not shift:
+            return
+        # Is this mapping generic ? Store ir somewhere ?
+        # Is the shift size logic repeatable and factorisable ?
+        if self.bitness == 32 and shift.value > 31:
+            raise ValueError("Invalid shift value for 32bits encoding of {0} : {1}".format(type(self).__name__, shift.value))
+
+        SHIFT_MAPPING = {"LSL": 0b00, "LSR": 0b01, "ASR": 0b10, "ROR": 0b11}
+        self.setup_immediat(self.shift, SHIFT_MAPPING[shift.type])
+        self.setup_immediat(self.imm6, shift.value)
+
+
+    @classmethod
+    def accept_arg(cls, argsdict):
+        return (cls.is_register(argsdict[0]) and
+                cls.is_register(argsdict[1]) and
+                cls.is_register(argsdict[2]) and
+                cls.is_shift(argsdict.get(3)))
+
+# An instruction is a Name that can have multiple encoding
+# It's the class we instanciate to assemble instructions
+# C6.2.270 ORR (immediate)
+# C6.2.271 ORR (shifted register)
+
+# there also seem to exist "alias instructions" like "mov"
+# That just map to others instruction when specific condition are met on the params
+
+
+class Instruction(object):
+    encoding = []
+
+    def __init__(self, *args):
+        argsdict = dict(enumerate(args)) # Like a list but allow arg.get(4)
+        for i, encodcls in enumerate(self.encoding):
+            # Late rewrite of GeneratedEncodingCls classname for better message error
+            if encodcls.__name__ == "GeneratedEncodingCls":
+                encodcls.__name__ = "{0}Encoding{1}".format(type(self).__name__, i)
+
+
+            if encodcls.accept_arg(argsdict):
+                self.encoded = encodcls(argsdict)
+                return
+        raise ValueError("Cannot encode <{0} {1}>:(".format(type(self).__name__, args))
+
+    def get_code(self):
+        intlist = list(self.encoded.bits)
+        if not is_py3:
+            intlist = [ord(x) for x in intlist]
+        # Our encoding to real little-endian
+        encoding_getter = operator.itemgetter(7, 6, 5, 4, 3, 2, 1, 0, 15, 14, 13, 12, 11, 10, 9, 8, 23, 22, 21, 20, 19, 18, 17, 16, 31, 30, 29, 28, 27, 26, 25, 24)
+        dword = 0
+        for bit in encoding_getter(intlist):
+            assert bit in (0, 1), "Unexpected bite value in encoding of {0} : {1} in {2}".format(type(self).__name__, bit, intlist)
+            dword = (dword << 1) | bit
+        return struct.pack(">I", dword) # We already have handled endianess
+
+
+
+        # Fix endianned
+
+
+class Add(Instruction):
+    encoding = [AddSubtractImmediate.gen(op=0, S=0)]
+
+class Subs(Instruction):
+    encoding = [AddSubtractImmediate.gen(op=1, S=1)]
+
+### C6.2.307 RET (page 2203) (11010110010111110000000000000000)
+
+class Ret(Instruction):
+    encoding = [RetEncoding]
+
+#  C6.2.254
+
+class Movz(Instruction):
+    encoding = [MovWideImmediat.gen(opc=0b10)]
+
+class Movk(Instruction):
+    encoding = [MovWideImmediat.gen(opc=0b11)]
+
+# The encoding for "mov reg, reg" :D
+# C6.2.271
+# Todo: Instruction like "mov" that dispatch to other instruction encoding based on more precise condition on param ?
+class Orr(Instruction):
+    encoding = [DataProcessingLogicalShiftedRegister.gen(opc=0b01)]
+
+
+# Meta Instruction that can dispatch to others Instruction/Encoding based on special case
+# Ex: "mov reg1, re2" -> "orr reg1, xzr, reg2"
+
+class Mov(Instruction): # VirtualInstruction ?
+    def __new__(self, *args):
+        argsdict = dict(enumerate(args)) # Like a list but allow arg.get(4)
+        if (set(argsdict) == {0, 1} and  # Only 2 args
+                InstructionEncoding.is_register(argsdict[0]) and
+                InstructionEncoding.is_register(argsdict[1])):
+            return Orr(argsdict[0], ZERO, argsdict[1])
+
+        raise ValueError("Cannot encode <{0} {1}>:(".format(type(self).__name__, args))
+
+
+class MultipleInstr(object):
+    INSTRUCTION_SIZE = 4
+
+    def __init__(self, init_instrs=()):
+        self.instrs = {}
+        self.labels = {}
+        self.expected_labels = {}
+        # List of all labeled jump already resolved
+        # Will be used for 'relocation'
+        self.computed_jump = []
+        self.size = 0
+        for i in init_instrs:
+            self += i
+
+    def get_code(self):
+        if self.expected_labels:
+            raise ValueError("Unresolved labels: {0}".format(self.expected_labels.keys()))
+        return b"".join([x[1].get_code() for x in sorted(self.instrs.items())])
+
+    def add_instruction(self, instruction):
+        # if isinstance(instruction, Label):
+        #     return self.add_label(instruction)
+        # # Change DelayedJump to LabeledJump ?
+        # if isinstance(instruction, DelayedJump):
+        #     return self.add_delayed_jump(instruction)
+        if isinstance(instruction, Instruction):
+            self.instrs[self.size] = instruction
+            self.size += self.INSTRUCTION_SIZE
+            return
+        raise ValueError("Don't know what to do with {0} of type {1}".format(instruction, type(instruction)))
+
+    def add_label(self, label):
+        if label.name not in self.expected_labels:
+            # Label that have no jump before definition
+            # Just registed the address of the label
+            self.labels[label.name] = self.size
+            return
+        # Label with jmp before definition
+        # Lot of stuff todo:
+            # Find all delayed jump that refer to this jump
+            # Replace them with real jump
+            # If size of jump < JUMP_SIZE: relocate everything we can
+            # Update expected_labels
+        for jump_to_label in self.expected_labels[label.name]:
+            if jump_to_label.offset in self.instrs:
+                raise ValueError("WTF REPLACE EXISTING INSTR...")
+            distance = self.size - jump_to_label.offset
+            real_jump = jump_to_label.type(distance)
+            self.instrs[jump_to_label.offset] = real_jump
+            self.computed_jump.append((jump_to_label.offset, self.size))
+            for i in range(self.JUMP_SIZE - len(real_jump.get_code())):
+                self.instrs[jump_to_label.offset + len(real_jump.get_code()) + i] = _NopArtifact()
+        del self.expected_labels[label.name]
+        self.labels[label.name] = self.size
+        if not self.expected_labels:
+            # No more un-resolved label (for now): time to reduce the shellcode
+            self._reduce_shellcode()
+
+    def add_delayed_jump(self, jump):
+        dst = jump.label
+        if dst in self.labels:
+            # Jump to already defined labels
+            # Nothing fancy: get offset of label and jump to it !
+            distance = self.size - self.labels[dst]
+            jump_instruction = jump.type(-distance)
+            self.computed_jump.append((self.size, self.labels[dst]))
+            return self.add_instruction(jump_instruction)
+        # Jump to undefined label
+        # Add label to expected ones
+        # Add jump info -> offset of jump | type
+        # Reserve space for call !
+        jump.offset = self.size
+        self.expected_labels.setdefault(dst, []).append(jump)
+        self.size += self.JUMP_SIZE
+        return
+
+    def merge_shellcode(self, other):
+        shared_labels = set(self.labels) & set(other.labels)
+        if shared_labels:
+            raise ValueError("Cannot merge shellcode: shared labels {0}".format(shared_labels))
+        for offset, instr in sorted(other.instrs.items()):
+            for label_name in [name for name, label_offset in other.labels.items() if label_offset == offset]:
+                self.add_instruction(Label(label_name))
+            self.add_instruction(instr)
+
+    def __iadd__(self, other):
+        if isinstance(other, MultipleInstr):
+            self.merge_shellcode(other)
+        elif isinstance(other, basestring):
+            self.assemble(other)
+        else:
+            self.add_instruction(other)
+        return self
+
+    def assemble(self, code):
+        for instr in assemble_instructions_generator(code):
+            self.add_instruction(instr)
+
+
+def split_in_instruction(str):
+    for line in str.split("\n"):
+        if not line:
+            continue
+        for instr in line.split(";"):
+            if not instr:
+                continue
+            yield instr.strip()
+
+def assemble_instructions_generator(str):
+    for instr in split_in_instruction(str):
+        data = instr.split(" ", 1)
+        mnemo, args_raw = data[0], data[1:]
+        try:
+            instr_object = globals()[mnemo.capitalize()]
+        except:
+            raise ValueError("Unknow mnemonic <{0}>".format(mnemo))
+
+        # if issubclass(instr_object, Raw):
+        #     # Raw should received the raw buffer as it expect encoded hex
+        #     # The transformation may transform 'raw 9090' (nopnop) as 0n9090
+        #     # If other fake-instr need this : make a class attribute
+        #     yield instr_object(*args_raw)
+        #     continue
+
+        args = []
+        if args_raw:
+            for arg in args_raw[0].split(","):
+                arg = arg.strip()
+                try:
+                    arg = int(arg, 0)
+                except ValueError:
+                    pass
+                args.append(arg)
+        yield instr_object(*args)
+
+def assemble(str):
+    """Play test"""
+    shellcode = MultipleInstr()
+    shellcode += str
+    return shellcode.get_code()

windows/pe_parse.py

@@ -3,6 +3,7 @@ import windows
 import windows.hooks as hooks
 import windows.utils as utils
 
+import windows.generated_def as gdef
 from windows.generated_def.winstructs import *
 from windows.utils import transform_ctypes_fields
 import windows.remotectypes as rctypes
@@ -38,9 +39,9 @@ def get_pe_bitness(baseaddr, target):
     # We can force bitness as the field we access are bitness-independant
     pe = GetPEFile(baseaddr, target, force_bitness=32)
     machine = pe.get_NT_HEADER().FileHeader.Machine
-    if machine == 0x14c:
+    if machine == gdef.IMAGE_FILE_MACHINE_I386:
         return 32
-    elif machine == 0x8664:
+    elif machine in (gdef.IMAGE_FILE_MACHINE_AMD64, gdef.IMAGE_FILE_MACHINE_ARM64):
         return 64
     else:
         raise ValueError("Unknow PE target machine <0x{0:x}>".format(machine))
@@ -108,7 +109,7 @@ class PESection(IMAGE_SECTION_HEADER):
         if self.target is None:
             name = get_string(self.target, ctypes.addressof(self.Name))[:8]
         else:
-            name = get_string(self.target, self._base_addr)[:8]
+            name = self.target.read_memory(self._base_addr, 8).split(b"\x00", 1)[0].decode("ascii")
         # Decode as UTF-8 as the MS doc say ?
         return name
 
@@ -450,4 +451,17 @@ class PEFile(object):
                     iat_entry.name = str(name) if name else ""
             name = get_string(self.target, self.baseaddr + import_descriptor.Name)
             res.setdefault(name.lower(), []).extend(IAT)
-        return res
+        return res
+
+    @utils.fixedpropety
+    def binid(self):
+        """Return the hex-string {TimeStamp}{SizeOfCode} used by PDB to identify a PE.
+
+        I do not know the official name of this value...
+
+        :type: :class:`str`
+        """
+        nth = self.get_NT_HEADER()
+        timestamp = nth.FileHeader.TimeDateStamp
+        image_size = nth.OptionalHeader.SizeOfImage
+        return "{timestamp:08x}{image_size:x}".format(timestamp=timestamp, image_size=image_size)

windows/rpc/client.py

@@ -220,11 +220,16 @@ class RPCClient(object):
             data = response.data[ctypes.sizeof(ALPC_RPC_RESPONSE):]
         else:
             # Response in view M extract size from PORT_MESSAGE & read data from view
-            assert response.port_message.u1.s1.TotalLength >= 0x48 # At least 0x20 of data
+            assert response.port_message.u1.s1.DataLength >= ctypes.sizeof(ALPC_RPC_RESPONSE) # 0x20
             rpcdatasize = struct.unpack("<I", response.data[0x18:0x1c])[0] # ctypes.sizeof(ALPC_RPC_RESPONSE)
             viewattr = response.view_attribute
             assert viewattr.ViewSize >= rpcdatasize
             data = windows.current_process.read_memory(viewattr.ViewBase, rpcdatasize)
+            # We have copied the data from the view: free it
+            # It looks like:
+            # windows.winproxy.NtAlpcDeleteSectionView(self.alpc_client.handle, 0, viewattr.ViewBase)
+            # Will ne be enough, as it will wait for the message to be reused to unmap the section..
+            # And the current architecture encourage creating new message every time
         if response_header.request_id == self.REQUEST_IDENTIFIER_ORPC:
             # Parse & remove ORPC headers (orpcthat + LocalThat)
             data = self._pass_orpc_response_structures(data)

windows/rpc/ndr.py

@@ -173,6 +173,8 @@ class NdrWString(object):
         assert size1 == size2
         assert zero == 0
         s = stream.read(size1 * 2)
+        if stream.use_memoryview:
+            return bytearray(s).decode("utf-16-le")
         return s.decode("utf-16-le")
 
     @classmethod
@@ -551,10 +553,14 @@ class NdrGuidConformantArray(NdrConformantArray):
 
 class NdrStream(object):
     """A stream of bytes used for NDR unpacking"""
-    def __init__(self, data):
+    def __init__(self, data, use_memoryview=False):
+        """"""
         self.fulldata = data
-        self.data = data
-        # self.data = memoryview(data) # FAST but need some code rewrite at some places
+        self.use_memoryview = use_memoryview
+        if use_memoryview:
+            self.data = memoryview(data) # FAST but need some code rewrite at some places
+        else:
+            self.data = data
 
     def partial_unpack(self, format):
         size = struct.calcsize(format)

windows/rpc/stubborn.py

@@ -62,10 +62,14 @@ def stubborn_create_instance(clsid, iid):
     # resolver_info.OxidInfo.containerVersion.version is part of OxidInfo.ipidRemUnknown on PPRIV_RESOLVER_INFO_LEGACY
     # And this part of ipidRemUnknown is a PID
     # So a good value to check for > 3 :)
+    # On 2019 IT IS NOT :( as it's its own struct. So I will hardcod this one.
     # Bad alignemetn of containerVersion -> its an older version
-    if resolver_info.OxidInfo.containerVersion.version > 3:
-        dcomversionstruct = resolver_info.OxidInfo.dcomVersion
+    dcomversionstruct = resolver_info.OxidInfo.dcomVersion
+    if windows.system.build_number == 17763:
+        resolver_info = ctypes.cast(rpiv_infoptr, gdef.PPRIV_RESOLVER_INFO_17763)[0]
+    elif resolver_info.OxidInfo.containerVersion.version > 3:
         # If 5,7 -> good alignement of dcomversion so we know its PRIV_RESOLVER_INFO_17763
+        # Should never happen as its now covered by the `windows.system.build_number == 17763` check
         dcomversion = (dcomversionstruct.MajorVersion, dcomversionstruct.MinorVersion)
         if dcomversion == (5, 7):
             resolver_info = ctypes.cast(rpiv_infoptr, gdef.PPRIV_RESOLVER_INFO_17763)[0]

windows/utils/winutils.py

@@ -36,19 +36,6 @@ def get_remote_func_addr(target, dll_name, func_name):
         return mod.pe.exports[func_name]
 
 
-def is_wow_64(hProcess):
-    try:
-        fnIsWow64Process = get_func_addr("kernel32.dll", "IsWow64Process")
-    except winproxy.WinproxyError:
-        return False
-    IsWow64Process = ctypes.WINFUNCTYPE(BOOL, HANDLE, ctypes.POINTER(BOOL))(fnIsWow64Process)
-    Wow64Process = BOOL()
-    res = IsWow64Process(hProcess, ctypes.byref(Wow64Process))
-    if res:
-        return bool(Wow64Process)
-    raise ctypes.WinError()
-
-
 def create_file_from_handle(handle, mode="r"):
     """Return a Python :class:`file` around a ``Windows`` HANDLE"""
     flags = os.O_BINARY if "b" in mode else os.O_TEXT
@@ -86,14 +73,35 @@ def create_console():
     sys.stderr = console_stderr
 
 
-def create_process(path, args=None, dwCreationFlags=0, show_windows=True):
-    """A convenient wrapper arround :func:`windows.winproxy.CreateProcessW`"""
+def create_process(path, args=None, dwCreationFlags=0, show_windows=True, machine=None):
+    """A convenient wrapper arround :func:`windows.winproxy.CreateProcessW`
+    ..note:
+        The machine param only works starting at vista and should be used on arm64 computer
+    """
     proc_info = PROCESS_INFORMATION()
+    StartupInfo = None
     lpStartupInfo = None
+
+    if machine is not None:
+        buffer = ctypes.create_string_buffer(0x100)
+        size = gdef.DWORD64(len(buffer))
+        machine = gdef.WORD(machine)
+        windows.winproxy.InitializeProcThreadAttributeList(buffer, 1, 0, size)
+        windows.winproxy.UpdateProcThreadAttribute(buffer, 0, gdef.PROC_THREAD_ATTRIBUTE_MACHINE_TYPE, ctypes.addressof(machine), ctypes.sizeof(machine), None, None)
+
+        startup_infoex = gdef.STARTUPINFOEXW()
+        startup_infoex.StartupInfo.cb = ctypes.sizeof(gdef.STARTUPINFOEXW)
+        startup_infoex.lpAttributeList = ctypes.cast(buffer, gdef.PVOID)
+        StartupInfo = startup_infoex.StartupInfo
+
+        dwCreationFlags |= gdef.EXTENDED_STARTUPINFO_PRESENT
+
     if show_windows:
-        StartupInfo = STARTUPINFOW()
-        StartupInfo.cb = ctypes.sizeof(StartupInfo)
+        if StartupInfo is None:
+            StartupInfo = STARTUPINFOW()
+            StartupInfo.cb = ctypes.sizeof(StartupInfo)
         StartupInfo.dwFlags = 0
+    if StartupInfo:
         lpStartupInfo = ctypes.byref(StartupInfo)
     lpCommandLine = None
     if isinstance(path, bytes):
@@ -110,6 +118,8 @@ def create_process(path, args=None, dwCreationFlags=0, show_windows=True):
     dbgprint("CreateProcessW new thread handle {:#x}".format(proc_info.hThread), "HANDLE")
     dbgprint("Automatic close of thread handle {:#x}".format(proc_info.hThread), "HANDLE")
     windows.winproxy.CloseHandle(proc_info.hThread)  # Give access to a WinThread in addition of the WinProcess ?
+    if machine:
+        windows.winproxy.DeleteProcThreadAttributeList(buffer)
     return windows.winobject.process.WinProcess(pid=proc_info.dwProcessId, handle=proc_info.hProcess)
 
 
@@ -300,6 +310,16 @@ def datetime_from_systemtime(systime):
             microsecond=systime.wMilliseconds * 1000,
     )
 
+IMAGE_FILE_MACHINE_TO_PROC_ARCH = {
+    gdef.IMAGE_FILE_MACHINE_I386: gdef.PROCESSOR_ARCHITECTURE_INTEL,
+    gdef.IMAGE_FILE_MACHINE_AMD64: gdef.PROCESSOR_ARCHITECTURE_AMD64,
+    gdef.IMAGE_FILE_MACHINE_ARM64: gdef.PROCESSOR_ARCHITECTURE_ARM64,
+    gdef.IMAGE_FILE_MACHINE_UNKNOWN: gdef.PROCESSOR_ARCHITECTURE_UNKNOWN
+}
+
+def image_file_machine_to_processor_architecture(image_file_machine):
+    return IMAGE_FILE_MACHINE_TO_PROC_ARCH[image_file_machine]
+
 class FixedInteractiveConsole(code.InteractiveConsole):
     def raw_input(self, prompt=">>>"):
         sys.stdout.write(prompt)
@@ -557,6 +577,14 @@ def create_file(name, access=gdef.GENERIC_READ, share=gdef.FILE_SHARE_READ, secu
 #    addr = windows.winproxy.MapViewOfFile(h, dwDesiredAccess=FILE_MAP_READ, dwNumberOfBytesToMap=1)
 #    return addr
 
+def get_system_info(native=False):
+    res = gdef.SYSTEM_INFO()
+    if native:
+        windows.winproxy.GetNativeSystemInfo(res)
+    else:
+        windows.winproxy.GetSystemInfo(res)
+    return res
+
 def decompress_buffer(buffer, comptype=gdef.COMPRESSION_FORMAT_LZNT1, uncompress_size=None):
     if uncompress_size is None:
         uncompress_size = len(buffer) * 10

windows/winobject/handle.py

@@ -144,6 +144,8 @@ def enumerate_handles():
 
 
 def enumerate_handles_syswow64():
+    if windows.current_process._is_x86_on_arm64:
+        raise NotImplementedError("Crossing heaven gate x86 -> arm64 not implemented")
     size_needed = gdef.ULONG()
     # Should at least be sizeof(gdef.SYSTEM_HANDLE_INFORMATION)
     tmp_buffer = windows.utils.BUFFER(gdef.SYSTEM_HANDLE_INFORMATION64)()

windows/winobject/process.py

@@ -12,6 +12,7 @@ from collections import namedtuple
 import windows
 import windows.native_exec.simple_x86 as x86
 import windows.native_exec.simple_x64 as x64
+import windows.native_exec.simple_arm64 as arm64
 import windows.remotectypes as rctypes
 import windows.generated_def as gdef
 
@@ -70,8 +71,24 @@ class Process(utils.AutoHandle):
 
         :type: :class:`bool`
 		"""
-        # return utils.is_wow_64(self.handle)
-        return utils.is_wow_64(self.limited_handle)
+        if not windows.winproxy.is_implemented(windows.winproxy.IsWow64Process):
+            return False
+        Wow64Process = gdef.BOOL()
+        windows.winproxy.IsWow64Process(self.handle, Wow64Process)
+        return bool(Wow64Process)
+
+
+
+    @utils.fixedproperty
+    def is_wow_64_2(self):
+        if not windows.winproxy.is_implemented(windows.winproxy.IsWow64Process2):
+            return None, None
+        processMachine = gdef.USHORT()
+        nativeMachine = gdef.USHORT()
+        windows.winproxy.IsWow64Process2(self.handle, processMachine, nativeMachine)
+        return (gdef.IMAGE_FILE_MACHINE_MAPPER[processMachine.value],
+                gdef.IMAGE_FILE_MACHINE_MAPPER[nativeMachine.value])
+
 
     @utils.fixedproperty
     def bitness(self):
@@ -79,13 +96,52 @@ class Process(utils.AutoHandle):
 
         :returns: :class:`int` -- 32 or 64
 		"""
-        if windows.system.bitness == 32:
-            return 32
-        if self.is_wow_64:
+        if windows.system.bitness == 32 or self.is_wow_64:
             return 32
         return 64
 
     @utils.fixedproperty
+    def architecture(self):
+        # Syswow2 will exactly tell us the architecture
+        if windows.winproxy.is_implemented(windows.winproxy.IsWow64Process2):
+            process_machine, native_machine = self.is_wow_64_2
+            if process_machine != gdef.IMAGE_FILE_MACHINE_UNKNOWN:
+                return process_machine
+
+            if windows.system.architecture == gdef.PROCESSOR_ARCHITECTURE_ARM64:
+                # May be ARM64 or AMD64 as X64TA64 is not considered WOW64
+                # ProcessMachineTypeInfo is from build 22000
+                # What if not implemented ? parse target main binary PE ?
+                machine_archi = gdef.PROCESS_MACHINE_INFORMATION()
+                windows.winproxy.GetProcessInformation(self.handle, gdef.ProcessMachineTypeInfo, ctypes.byref(machine_archi), ctypes.sizeof(machine_archi))
+                return gdef.IMAGE_FILE_MACHINE_MAPPER[machine_archi.ProcessMachine]
+
+        # No IsWow64Process2 -> No ARM
+        # So its up on x86 -> x64 based on process bitness
+        if self.bitness == 32:
+            return gdef.IMAGE_FILE_MACHINE_I386
+        return gdef.IMAGE_FILE_MACHINE_AMD64
+
+    @utils.fixedproperty
+    def _is_x86_on_arm64(self):
+        return (windows.system.architecture == gdef.PROCESSOR_ARCHITECTURE_ARM64 and
+                    self.architecture == gdef.IMAGE_FILE_MACHINE_I386)
+
+    @utils.fixedproperty
+    def _is_x86_on_x64(self):
+        return (windows.system.architecture == gdef.PROCESSOR_ARCHITECTURE_AMD64 and
+                    self.architecture == gdef.IMAGE_FILE_MACHINE_I386)
+
+    @utils.fixedproperty
+    def _is_native_architecture(self):
+        return ((windows.system.architecture == gdef.PROCESSOR_ARCHITECTURE_INTEL and
+                    self.architecture == gdef.IMAGE_FILE_MACHINE_I386) or
+                (windows.system.architecture == gdef.PROCESSOR_ARCHITECTURE_AMD64 and
+                    self.architecture == gdef.IMAGE_FILE_MACHINE_AMD64) or
+                (windows.system.architecture == gdef.PROCESSOR_ARCHITECTURE_ARM64 and
+                    self.architecture == gdef.IMAGE_FILE_MACHINE_ARM64))
+
+    @utils.fixedpropety
     def limited_handle(self):
         if windows.system.version[0] <= 5:
             # Windows XP | Serveur 2003
@@ -110,6 +166,8 @@ class Process(utils.AutoHandle):
         :type: :class:`int`
 		"""
         if windows.current_process.bitness == 32 and self.bitness == 64:
+            if windows.current_process._is_x86_on_arm64:
+                raise NotImplementedError("Crossing heaven gate x86 -> arm64 not implemented")
             xtype = windows.remotectypes.transform_type_to_remote64bits(PROCESS_BASIC_INFORMATION)
             # Fuck-it <3
             data = (ctypes.c_char * ctypes.sizeof(xtype))()
@@ -180,6 +238,8 @@ class Process(utils.AutoHandle):
     def virtual_protect(self, addr, size, protect, old_protect=None):
         """Change the access right of one or more page of the process"""
         if windows.current_process.bitness == 32 and self.bitness == 64:
+            if windows.current_process._is_x86_on_arm64:
+                raise NotImplementedError("Crossing heaven gate x86 -> arm64 not implemented")
             if size & 0x0fff:
                 size = ((size >> 12) + 1) << 12
             if old_protect is None:
@@ -210,6 +270,8 @@ class Process(utils.AutoHandle):
         :rtype: :class:`~windows.generated_def.winstructs.MEMORY_BASIC_INFORMATION`
 		"""
         if windows.current_process.bitness == 32 and self.bitness == 64:
+            if windows.current_process._is_x86_on_arm64:
+                raise NotImplementedError("Crossing heaven gate x86 -> arm64 not implemented")
             res = MEMORY_BASIC_INFORMATION64()
             try:
                 v = windows.syswow64.NtQueryVirtualMemory_32_to_64(ProcessHandle=self.handle, BaseAddress=addr, MemoryInformationClass=MemoryBasicInformation, MemoryInformation=res)
@@ -290,6 +352,8 @@ class Process(utils.AutoHandle):
         for i, data in enumerate(info_array):
             info_array[i].VirtualAddress = addresses[i]
         if windows.current_process.bitness == 32 and self.bitness == 64:
+            if windows.current_process._is_x86_on_arm64:
+                raise NotImplementedError("Crossing heaven gate x86 -> arm64 not implemented")
             windows.syswow64.NtQueryVirtualMemory_32_to_64(self.handle, 0, MemoryWorkingSetListEx, info_array)
         else:
             winproxy.QueryWorkingSetEx(self.handle, ctypes.byref(info_array), ctypes.sizeof(info_array))
@@ -571,10 +635,10 @@ class Thread(utils.AutoHandle):
 class CurrentThread(Thread):
     """The current thread"""
 
-    get_teb_code_by_bitness = {
-        32: x86.assemble("mov eax, fs:[0x18]; ret"),
-        64: x64.assemble("mov rax, gs:[0x30]; ret")
-
+    get_teb_code_by_architecture = {
+        gdef.IMAGE_FILE_MACHINE_I386: x86.assemble("mov eax, fs:[0x18]; ret"),
+        gdef.IMAGE_FILE_MACHINE_AMD64: x64.assemble("mov rax, gs:[0x30]; ret"),
+        gdef.IMAGE_FILE_MACHINE_ARM64: arm64.assemble("mov x0, x18; ret")
     }
 
     @property #It's not a fixedproperty because executing thread might change
@@ -587,7 +651,7 @@ class CurrentThread(Thread):
 
     @property #It's not a fixedproperty because executing thread might change
     def teb_base(self):
-        get_teb_base_code = self.get_teb_code_by_bitness[self.owner.bitness]
+        get_teb_base_code = self.get_teb_code_by_architecture[self.owner.architecture]
         return self.owner.execute(get_teb_base_code)
 
     @property
@@ -656,13 +720,14 @@ class CurrentProcess(Process):
 		"""
         return ctypes.sizeof(gdef.PVOID) * 8 # byte to bits
 
-    def virtual_alloc(self, size, prot=PAGE_EXECUTE_READWRITE):
+
+    def virtual_alloc(self, size, prot=PAGE_EXECUTE_READWRITE, addr=None, type=gdef.MEM_COMMIT):
         """Allocate memory in the process
 
         :return: The address of the allocated memory
         :rtype: :class:`int`
 		"""
-        return winproxy.VirtualAlloc(dwSize=size, flProtect=prot)
+        return winproxy.VirtualAlloc(lpAddress=addr, dwSize=size, flAllocationType=type, flProtect=prot)
 
     def virtual_free(self, addr):
         """Free memory in the process by virtual_alloc"""
@@ -724,6 +789,8 @@ class CurrentProcess(Process):
 		"""
         if not self.is_wow_64:
             raise ValueError("Not a syswow process")
+        if windows.current_process._is_x86_on_arm64:
+            raise NotImplementedError("Crossing heaven gate x86 -> arm64 not implemented")
         return windows.syswow64.get_current_process_syswow_peb()
 
     # TODO: use ctypes.string_at / ctypes.wstring_at for read_string / read_wstring ?
@@ -850,6 +917,8 @@ class WinThread(Thread):
             :type: :class:`int`
 		"""
         if windows.current_process.bitness == 32 and self.owner.bitness == 64:
+            if windows.current_process._is_x86_on_arm64:
+                raise NotImplementedError("Crossing heaven gate x86 -> arm64 not implemented")
             res = ULONGLONG()
             windows.syswow64.NtQueryInformationThread_32_to_64(self.handle, ThreadQuerySetWin32StartAddress, byref(res), ctypes.sizeof(res))
             return res.value
@@ -869,6 +938,9 @@ class WinThread(Thread):
         # - Want the TEB of a 64b process
         # - Want the TEB64 of a Wowprocess
         # It's the same code for both
+        if windows.current_process._is_x86_on_arm64:
+            raise NotImplementedError("Crossing heaven gate x86 -> arm64 not implemented")
+
         if windows.current_process.is_wow_64:
             restype = rctypes.transform_type_to_remote64bits(THREAD_BASIC_INFORMATION)
             ressize = (ctypes.sizeof(restype))
@@ -973,8 +1045,6 @@ class WinThread(Thread):
 
     @staticmethod
     def _get_thread_id_manual(handle):
-        if windows.current_process.bitness == 32 and self.owner.bitness == 64:
-            raise NotImplementedError("[_get_thread_id_manual] 32 -> 64 (XP64 bits + Syswow process ?)")
         res = THREAD_BASIC_INFORMATION()
         windows.winproxy.NtQueryInformationThread(handle, ThreadBasicInformation, byref(res), ctypes.sizeof(res))
         id2 = res.ClientId.UniqueThread
@@ -1037,13 +1107,13 @@ class WinProcess(Process):
             pass
         return urepr_encode(u'<{0} "{1}" pid {2} at {3}>'.format(self.__class__.__name__, exe_name, self.pid, hex(id(self))))
 
-    def virtual_alloc(self, size, prot=PAGE_EXECUTE_READWRITE, addr=None):
+    def virtual_alloc(self, size, prot=PAGE_EXECUTE_READWRITE, addr=None, type=gdef.MEM_COMMIT):
         """Allocate memory in the process
 
         :return: The address of the allocated memory
         :rtype: :class:`int`
 		"""
-        return winproxy.VirtualAllocEx(self.handle, lpAddress=addr, dwSize=size, flProtect=prot)
+        return winproxy.VirtualAllocEx(self.handle, lpAddress=addr, dwSize=size, flAllocationType=type, flProtect=prot)
 
     def virtual_free(self, addr):
         """Free memory in the process by virtual_alloc"""
@@ -1109,11 +1179,16 @@ class WinProcess(Process):
 
             :rtype: :class:`WinThread` or :class:`DeadThread`
 		"""
+        # We are using NtCreateThreadEx as  its more permissive about cross-bitness / cross-architecture
+        # And we can asume we known what we are doing -> So no safeguard ;)
+        thread_handle = HANDLE()
         if windows.current_process.bitness == 32 and self.bitness == 64:
-            thread_handle = HANDLE()
+            if self._is_x86_on_arm64:
+                raise NotImplementedError("Crossing heaven gate x86 -> arm64 not implemented")
             windows.syswow64.NtCreateThreadEx_32_to_64(ThreadHandle=byref(thread_handle) ,ProcessHandle=self.handle, lpStartAddress=addr, lpParameter=param)
-            return WinThread._from_handle(thread_handle.value)
-        return WinThread._from_handle(winproxy.CreateRemoteThread(hProcess=self.handle, lpStartAddress=addr, lpParameter=param))
+        else:
+            windows.winproxy.NtCreateThreadEx(ThreadHandle=byref(thread_handle) ,ProcessHandle=self.handle, lpStartAddress=addr, lpParameter=param)
+        return WinThread._from_handle(thread_handle.value)
 
     def load_library(self, dll_path):
         """Load the library in remote process
@@ -1149,26 +1224,27 @@ class WinProcess(Process):
 
     @utils.fixedproperty
     def peb_addr(self):
-        """The address of the PEB
+        """The address of the PEB.
 
             :type: :class:`int`
 		"""
-        if windows.current_process.bitness == 32 and self.bitness == 64:
+        if windows.current_process._is_x86_on_arm64 and not self.bitness == 32:
+            raise NotImplementedError("Crossing heaven gate x86 -> arm64 not implemented")
+
+        if windows.current_process.bitness == 32 and self.bitness == 64: # Intel to Intel
             x = windows.remotectypes.transform_type_to_remote64bits(PROCESS_BASIC_INFORMATION)
             # Fuck-it <3
             data = (ctypes.c_char * ctypes.sizeof(x))()
-            windows.syswow64.NtQueryInformationProcess_32_to_64(self.handle, ProcessInformation=data, ProcessInformationLength=ctypes.sizeof(x))
+            windows.syswow64.NtQueryInformationProcess_32_to_64(self.handle, gdef.ProcessBasicInformation, ProcessInformation=data)
             peb_offset = x.PebBaseAddress.offset
             peb_addr = struct.unpack("<Q", data[x.PebBaseAddress.offset: x.PebBaseAddress.offset+8])[0]
         elif windows.current_process.bitness == 64 and self.bitness == 32:
-            information_type = 26
             y = ULONGLONG()
-            winproxy.NtQueryInformationProcess(self.handle, information_type, byref(y), sizeof(y))
+            winproxy.NtQueryInformationProcess(self.handle, gdef.ProcessWow64Information, byref(y), sizeof(y))
             peb_addr = y.value
         else:
-            information_type = 0
             x = PROCESS_BASIC_INFORMATION()
-            winproxy.NtQueryInformationProcess(self.handle, information_type, x)
+            winproxy.NtQueryInformationProcess(self.handle, gdef.ProcessBasicInformation, x)
             peb_addr = ctypes.cast(x.PebBaseAddress, PVOID).value
         if peb_addr is None:
             raise ValueError("Could not get peb addr of process {0}".format(self.name))
@@ -1192,6 +1268,10 @@ class WinProcess(Process):
     def peb_syswow_addr(self):
         if not self.is_wow_64:
             raise ValueError("Not a syswow process")
+
+        if windows.current_process._is_x86_on_arm64:
+            raise NotImplementedError("Crossing heaven gate x86 -> arm64 not implemented")
+
         if windows.current_process.bitness == 64:
             information_type = 0
             x = PROCESS_BASIC_INFORMATION()

windows/winobject/system.py

@@ -10,7 +10,6 @@ from windows import utils
 import windows.generated_def as gdef
 
 
-
 from windows.winobject import process
 from windows.winobject import network
 from windows.winobject import registry
@@ -586,6 +585,24 @@ class System(object):
         # These are the part that do not move much between XP & Win10
         return gdef.PFW_MINIMAL_KUSER_SHARED_DATA.from_address(gdef.MM_SHARED_USER_DATA_VA)
 
+    @utils.fixedproperty
+    def architecture(self):
+        # Retrieve system processor architecture
+        # It's not that easy as x64-on-ARM64 will lie on most API except IsWow64Process2
+        # EX: GetNativeSystemInfo will returns PROCESSOR_ARCHITECTURE_AMD64
+        if windows.winproxy.is_implemented(windows.winproxy.IsWow64Process2):
+            process_machine, native_machine = windows.current_process.is_wow_64_2
+            try:
+                return utils.image_file_machine_to_processor_architecture(native_machine)
+            except KeyError as e:
+                raise ValueError("Unknown IsWow64Process2(native_machine:#x) -> {0}".format(native_machine))
+
+        # No IsWow64Process2 -> assert it cannot be ARM64 and thus GetNativeSystemInfo will not lie ?
+        sysinfo = gdef.SYSTEM_INFO()
+        windows.winproxy.GetNativeSystemInfo(sysinfo)
+        return gdef.PROCESSOR_ARCHITECTURE_MAPPER[sysinfo.wProcessorArchitecture]
+
+
 
     @staticmethod
     def enumerate_processes():

windows/winobject/system_module.py

@@ -44,6 +44,8 @@ def enumerate_kernel_modules():
     return list(modules)
 
 def enumerate_kernel_modules_syswow64():
+    if windows.current_process._is_x86_on_arm64:
+        raise NotImplementedError("Crossing heaven gate x86 -> arm64 not implemented")
     cbsize = gdef.DWORD()
     windows.syswow64.NtQuerySystemInformation_32_to_64(gdef.SystemModuleInformation, None, 0, ctypes.addressof(cbsize))
     raw_buffer = (cbsize.value * gdef.BYTE)()

windows/winproxy/apis/__init__.py

@@ -7,6 +7,7 @@ from .dnsapi import *
 from .iphlpapi import *
 from .kernel32 import *
 from .ktmw32 import *
+from .ncrypt import *
 from .ntdll import *
 from .netapi32 import *
 from .ole32 import *

windows/winproxy/apis/crypt32.py

@@ -147,6 +147,10 @@ def CryptSignMessage(pSignPara, fDetachedSignature, cToBeSigned, rgpbToBeSigned,
 def CryptSignAndEncryptMessage(pSignPara, pEncryptPara, cRecipientCert, rgpRecipientCert, pbToBeSignedAndEncrypted, cbToBeSignedAndEncrypted, pbSignedAndEncryptedBlob, pcbSignedAndEncryptedBlob):
     return CryptSignAndEncryptMessage.ctypes_function(pSignPara, pEncryptPara, cRecipientCert, rgpRecipientCert, pbToBeSignedAndEncrypted, cbToBeSignedAndEncrypted, pbSignedAndEncryptedBlob, pcbSignedAndEncryptedBlob)
 
+@Crypt32Proxy()
+def CryptSignAndEncodeCertificate(hBCryptKey, dwKeySpec, dwCertEncodingType, lpszStructType, pvStructInfo, pSignatureAlgorithm, pvHashAuxInfo, pbEncoded, pcbEncoded):
+   lpszStructType = gdef.LPCSTR(lpszStructType) if isinstance(lpszStructType, int_types) else lpszStructType
+   return CryptSignAndEncodeCertificate.ctypes_function(hBCryptKey, dwKeySpec, dwCertEncodingType, lpszStructType, pvStructInfo, pSignatureAlgorithm, pvHashAuxInfo, pbEncoded, pcbEncoded)
 
 @Crypt32Proxy()
 def CryptVerifyMessageSignature(pVerifyPara, dwSignerIndex, pbSignedBlob, cbSignedBlob, pbDecoded, pcbDecoded, ppSignerCert):
@@ -176,6 +180,7 @@ def CryptQueryObject(dwObjectType, pvObject, dwExpectedContentTypeFlags, dwExpec
 
 @Crypt32Proxy()
 def CryptDecodeObject(dwCertEncodingType, lpszStructType, pbEncoded, cbEncoded, dwFlags, pvStructInfo, pcbStructInfo):
+    lpszStructType = gdef.LPCSTR(lpszStructType) if isinstance(lpszStructType, int_types) else lpszStructType
     return CryptDecodeObject.ctypes_function(dwCertEncodingType, lpszStructType, pbEncoded, cbEncoded, dwFlags, pvStructInfo, pcbStructInfo)
 
 @Crypt32Proxy()