Fix bug in rpc client response view parsing in 32b process

Minimal ARM64 consideration

.github/workflows/tests.yml

@@ -94,3 +94,35 @@ jobs:
           secondary_rate_limit_wait_seconds: 90
           seconds_between_github_writes: 10
           seconds_between_github_reads: 1
+
+#   tests_arm64:
+#     needs: generate_ctypes
+#     timeout-minutes: 15
+#     runs-on: windows-ARM64
+#     continue-on-error: true
+#
+#     strategy:
+#       fail-fast: false
+#       matrix:
+#         python-version: [3.11]
+#         python-architecture: [x86, x64, arm64]
+#         include:
+#             # Translate architecture to bitness for py.exe commandline
+#             - python-bitness-to-test: 32
+#               python-architecture: x86
+#             - python-bitness-to-test: 64
+#               python-architecture: x64
+#             - python-bitness-to-test: arm64
+#               python-architecture: arm64
+#
+#     steps:
+#       - uses: actions/checkout@v4
+#
+#       - name: Listing python versions availables
+#         run: py -0
+#
+#       - name: Testing PFW execute
+#         run: py -${{ matrix.python-version}}-${{ matrix.python-bitness-to-test}} -c "import windows; print(windows)"
+#
+#       - name: Arm64 pytests
+#         run: py -${{ matrix.python-version}}-${{ matrix.python-bitness-to-test}} -m pytest tests -k "not test_debugger" -v -s -r fEsx

ctypes_generation/definitions/defines/proc_thread_attributes.txt

@@ -0,0 +1,79 @@
+// We have a rare case of defines that depends on an enum
+// Which is PROC_THREAD_ATTRIBUTE_NUM
+// So i Will just define a copy of those as define here
+// Define version copied from: https://github.com/winsiderss/systeminformer/blob/master/phnt/include/ntpsapi.h#L2666
+// Thx to them, as always :)
+
+#define ProcThreadAttributeParentProcess 0 // in HANDLE
+#define ProcThreadAttributeExtendedFlags 1 // in ULONG (EXTENDED_PROCESS_CREATION_FLAG_*)
+#define ProcThreadAttributeHandleList 2 // in HANDLE[]
+#define ProcThreadAttributeGroupAffinity 3 // in GROUP_AFFINITY // since WIN7
+#define ProcThreadAttributePreferredNode 4 // in USHORT
+#define ProcThreadAttributeIdealProcessor 5 // in PROCESSOR_NUMBER
+#define ProcThreadAttributeUmsThread 6 // in UMS_CREATE_THREAD_ATTRIBUTES
+#define ProcThreadAttributeMitigationPolicy 7 // in ULONG, ULONG64, or ULONG64[2]
+#define ProcThreadAttributePackageFullName 8 // in WCHAR[] // since WIN8
+#define ProcThreadAttributeSecurityCapabilities 9 // in SECURITY_CAPABILITIES
+#define ProcThreadAttributeConsoleReference 10 // BaseGetConsoleReference (kernelbase.dll)
+#define ProcThreadAttributeProtectionLevel 11 // in ULONG (PROTECTION_LEVEL_*) // since WINBLUE
+#define ProcThreadAttributeOsMaxVersionTested 12 // in MAXVERSIONTESTED_INFO // since THRESHOLD // (from exe.manifest)
+#define ProcThreadAttributeJobList 13 // in HANDLE[]
+#define ProcThreadAttributeChildProcessPolicy 14 // in ULONG (PROCESS_CREATION_CHILD_PROCESS_*) // since THRESHOLD2
+#define ProcThreadAttributeAllApplicationPackagesPolicy 15 // in ULONG (PROCESS_CREATION_ALL_APPLICATION_PACKAGES_*) // since REDSTONE
+#define ProcThreadAttributeWin32kFilter 16 // in WIN32K_SYSCALL_FILTER
+#define ProcThreadAttributeSafeOpenPromptOriginClaim 17 // in SE_SAFE_OPEN_PROMPT_RESULTS
+#define ProcThreadAttributeDesktopAppPolicy 18 // in ULONG (PROCESS_CREATION_DESKTOP_APP_*) // since RS2
+#define ProcThreadAttributeBnoIsolation 19 // in PROC_THREAD_BNOISOLATION_ATTRIBUTE
+#define ProcThreadAttributePseudoConsole 22 // in HANDLE (HPCON) // since RS5
+#define ProcThreadAttributeIsolationManifest 23 // in ISOLATION_MANIFEST_PROPERTIES // rev (diversenok) // since 19H2+
+#define ProcThreadAttributeMitigationAuditPolicy 24 // in ULONG, ULONG64, or ULONG64[2] // since 21H1
+#define ProcThreadAttributeMachineType 25 // in USHORT // since 21H2
+#define ProcThreadAttributeComponentFilter 26 // in ULONG
+#define ProcThreadAttributeEnableOptionalXStateFeatures 27 // in ULONG64 // since WIN11
+#define ProcThreadAttributeCreateStore 28 // ULONG // rev (diversenok)
+#define ProcThreadAttributeTrustedApp 29
+#define ProcThreadAttributeSveVectorLength 30
+
+// Real definition of value usef by API
+// From: https://github.com/microsoft/win32metadata/blob/6af96d8470751e13a4e3f579f84b7b8b3ca398e1/generation/WinSDK/RecompiledIdlHeaders/um/WinBase.h#L3568
+// macro ProcThreadAttributeValue is recoded in python in template.py
+// I replace TRUE by True && FALSE by False for native python compat :)
+
+#define PROC_THREAD_ATTRIBUTE_NUMBER    0x0000FFFF
+#define PROC_THREAD_ATTRIBUTE_THREAD    0x00010000  // Attribute may be used with thread creation
+#define PROC_THREAD_ATTRIBUTE_INPUT     0x00020000  // Attribute is input only
+#define PROC_THREAD_ATTRIBUTE_ADDITIVE  0x00040000  // Attribute may be "accumulated," e.g. bitmasks,
+
+#define PROC_THREAD_ATTRIBUTE_PARENT_PROCESS \
+    ProcThreadAttributeValue (ProcThreadAttributeParentProcess, False, True, False)
+#define PROC_THREAD_ATTRIBUTE_HANDLE_LIST \
+    ProcThreadAttributeValue (ProcThreadAttributeHandleList, False, True, False)
+
+#define PROC_THREAD_ATTRIBUTE_GROUP_AFFINITY \
+    ProcThreadAttributeValue (ProcThreadAttributeGroupAffinity, True, True, False)
+#define PROC_THREAD_ATTRIBUTE_PREFERRED_NODE \
+    ProcThreadAttributeValue (ProcThreadAttributePreferredNode, False, True, False)
+#define PROC_THREAD_ATTRIBUTE_IDEAL_PROCESSOR \
+    ProcThreadAttributeValue (ProcThreadAttributeIdealProcessor, True, True, False)
+#define PROC_THREAD_ATTRIBUTE_UMS_THREAD \
+    ProcThreadAttributeValue (ProcThreadAttributeUmsThread, True, True, False)
+#define PROC_THREAD_ATTRIBUTE_MITIGATION_POLICY \
+    ProcThreadAttributeValue (ProcThreadAttributeMitigationPolicy, False, True, False)
+
+#define PROC_THREAD_ATTRIBUTE_SECURITY_CAPABILITIES \
+    ProcThreadAttributeValue (ProcThreadAttributeSecurityCapabilities, False, True, False)
+
+#define PROC_THREAD_ATTRIBUTE_PROTECTION_LEVEL \
+    ProcThreadAttributeValue (ProcThreadAttributeProtectionLevel, False, True, False)
+
+#define PROC_THREAD_ATTRIBUTE_PSEUDOCONSOLE \
+    ProcThreadAttributeValue (ProcThreadAttributePseudoConsole, False, True, False)
+
+#define PROC_THREAD_ATTRIBUTE_MACHINE_TYPE \
+    ProcThreadAttributeValue (ProcThreadAttributeMachineType, False, True, False)
+
+#define PROC_THREAD_ATTRIBUTE_ENABLE_OPTIONAL_XSTATE_FEATURES \
+    ProcThreadAttributeValue (ProcThreadAttributeEnableOptionalXStateFeatures, True, True, False)
+
+#define PROC_THREAD_ATTRIBUTE_SVE_VECTOR_LENGTH \
+    ProcThreadAttributeValue (ProcThreadAttributeSveVectorLength, False, True, False)

ctypes_generation/definitions/defines/processor.txt

@@ -0,0 +1,38 @@
+#define PROCESSOR_INTEL_386     386
+#define PROCESSOR_INTEL_486     486
+#define PROCESSOR_INTEL_PENTIUM 586
+#define PROCESSOR_INTEL_IA64    2200
+#define PROCESSOR_MIPS_R4000    4000    // incl R4101 & R3910 for Windows CE
+#define PROCESSOR_ALPHA_21064   21064
+#define PROCESSOR_PPC_601       601
+#define PROCESSOR_PPC_603       603
+#define PROCESSOR_PPC_604       604
+#define PROCESSOR_PPC_620       620
+#define PROCESSOR_HITACHI_SH3   10003   // Windows CE
+#define PROCESSOR_HITACHI_SH3E  10004   // Windows CE
+#define PROCESSOR_HITACHI_SH4   10005   // Windows CE
+#define PROCESSOR_MOTOROLA_821  821     // Windows CE
+#define PROCESSOR_SHx_SH3       103     // Windows CE
+#define PROCESSOR_SHx_SH4       104     // Windows CE
+#define PROCESSOR_STRONGARM     2577    // Windows CE - 0xA11
+#define PROCESSOR_ARM720        1824    // Windows CE - 0x720
+#define PROCESSOR_ARM820        2080    // Windows CE - 0x820
+#define PROCESSOR_ARM920        2336    // Windows CE - 0x920
+#define PROCESSOR_ARM_7TDMI     70001   // Windows CE
+#define PROCESSOR_OPTIL         0x494f  // MSIL
+
+#define PROCESSOR_ARCHITECTURE_INTEL            0
+#define PROCESSOR_ARCHITECTURE_MIPS             1
+#define PROCESSOR_ARCHITECTURE_ALPHA            2
+#define PROCESSOR_ARCHITECTURE_PPC              3
+#define PROCESSOR_ARCHITECTURE_SHX              4
+#define PROCESSOR_ARCHITECTURE_ARM              5
+#define PROCESSOR_ARCHITECTURE_IA64             6
+#define PROCESSOR_ARCHITECTURE_ALPHA64          7
+#define PROCESSOR_ARCHITECTURE_MSIL             8
+#define PROCESSOR_ARCHITECTURE_AMD64            9
+#define PROCESSOR_ARCHITECTURE_IA32_ON_WIN64    10
+#define PROCESSOR_ARCHITECTURE_NEUTRAL          11
+#define PROCESSOR_ARCHITECTURE_ARM64            12
+#define PROCESSOR_ARCHITECTURE_ARM32_ON_WIN64   13
+#define PROCESSOR_ARCHITECTURE_UNKNOWN          0xFFFF

ctypes_generation/definitions/defines/template.py

@@ -24,3 +24,19 @@ def CTL_CODE(DeviceType, Function, Method, Access):
 
 def HRESULT_FACILITY(hr):
     return (((hr) >> 16) & 0x1fff)
+
+# https://github.com/microsoft/win32metadata/blob/6af96d8470751e13a4e3f579f84b7b8b3ca398e1/generation/WinSDK/RecompiledIdlHeaders/um/WinBase.h#L3562
+# Original MACRO:
+
+#define ProcThreadAttributeValue(Number, Thread, Input, Additive) \
+#      (((Number) & PROC_THREAD_ATTRIBUTE_NUMBER) | \
+#       ((Thread != FALSE) ? PROC_THREAD_ATTRIBUTE_THREAD : 0) | \
+#       ((Input != FALSE) ? PROC_THREAD_ATTRIBUTE_INPUT : 0) | \
+#       ((Additive != FALSE) ? PROC_THREAD_ATTRIBUTE_ADDITIVE : 0))
+
+def ProcThreadAttributeValue(Number, Thread, Input, Additive):
+    return ((Number & PROC_THREAD_ATTRIBUTE_NUMBER) |
+             (Thread and PROC_THREAD_ATTRIBUTE_THREAD) |
+             (Input and PROC_THREAD_ATTRIBUTE_INPUT) |
+             (Additive and PROC_THREAD_ATTRIBUTE_ADDITIVE))
+

ctypes_generation/definitions/defines/thread_context.txt

@@ -0,0 +1,61 @@
+// Atrget architecture description
+
+#define CONTEXT_I386    0x00010000 // An old PFW error in case ?
+#define CONTEXT_AMD64   0x00100000
+#define CONTEXT_ARM   0x00200000
+#define CONTEXT_ARM64   0x00400000
+#define CONTEXT_i386    0x00010000L    // this assumes that i386 and
+#define CONTEXT_i486    0x00010000L    // i486 have identical context records
+#define WOW64_CONTEXT_i386      0x00010000    // this assumes that i386 and
+#define WOW64_CONTEXT_i486      0x00010000    // i486 have identical context records
+
+// Not perfect, should be explicitly for an architecture
+
+#define CONTEXT_CONTROL             0x00000001L
+#define CONTEXT_INTEGER             0x00000002L
+#define CONTEXT_SEGMENTS            0x00000004L
+#define CONTEXT_FLOATING_POINT      0x00000008L
+#define CONTEXT_DEBUG_REGISTERS     0x00000010L
+#define CONTEXT_EXTENDED_REGISTERS  0x00000020L
+#define CONTEXT_FULL (CONTEXT_CONTROL | CONTEXT_INTEGER | CONTEXT_SEGMENTS)
+#define CONTEXT_ALL (CONTEXT_FULL | CONTEXT_FLOATING_POINT | CONTEXT_DEBUG_REGISTERS | CONTEXT_EXTENDED_REGISTERS)
+
+#define CONTEXT_XSTATE          (CONTEXT_I386 | 0x00000040L)
+
+// WOW64
+
+
+
+#define WOW64_CONTEXT_CONTROL               (WOW64_CONTEXT_i386 | 0x00000001L) // SS:SP, CS:IP, FLAGS, BP
+#define WOW64_CONTEXT_INTEGER               (WOW64_CONTEXT_i386 | 0x00000002L) // AX, BX, CX, DX, SI, DI
+#define WOW64_CONTEXT_SEGMENTS              (WOW64_CONTEXT_i386 | 0x00000004L) // DS, ES, FS, GS
+#define WOW64_CONTEXT_FLOATING_POINT        (WOW64_CONTEXT_i386 | 0x00000008L) // 387 state
+#define WOW64_CONTEXT_DEBUG_REGISTERS       (WOW64_CONTEXT_i386 | 0x00000010L) // DB 0-3,6,7
+#define WOW64_CONTEXT_EXTENDED_REGISTERS    (WOW64_CONTEXT_i386 | 0x00000020L) // cpu specific extensions
+
+#define WOW64_CONTEXT_FULL      (WOW64_CONTEXT_CONTROL | WOW64_CONTEXT_INTEGER | WOW64_CONTEXT_SEGMENTS)
+
+#define WOW64_CONTEXT_ALL       (WOW64_CONTEXT_CONTROL | WOW64_CONTEXT_INTEGER | WOW64_CONTEXT_SEGMENTS | \
+                                 WOW64_CONTEXT_FLOATING_POINT | WOW64_CONTEXT_DEBUG_REGISTERS | \
+                                 WOW64_CONTEXT_EXTENDED_REGISTERS)
+
+#define WOW64_CONTEXT_XSTATE                (WOW64_CONTEXT_i386 | 0x00000040L)
+
+#define WOW64_CONTEXT_EXCEPTION_ACTIVE      0x08000000
+#define WOW64_CONTEXT_SERVICE_ACTIVE        0x10000000
+#define WOW64_CONTEXT_EXCEPTION_REQUEST     0x40000000
+#define WOW64_CONTEXT_EXCEPTION_REPORTING   0x80000000
+
+// ARM64
+
+#define CONTEXT_ARM64_CONTROL (CONTEXT_ARM64 | 0x1L)
+#define CONTEXT_ARM64_INTEGER (CONTEXT_ARM64 | 0x2L)
+#define CONTEXT_ARM64_FLOATING_POINT  (CONTEXT_ARM64 | 0x4L)
+#define CONTEXT_ARM64_DEBUG_REGISTERS (CONTEXT_ARM64 | 0x8L)
+#define CONTEXT_ARM64_X18 (CONTEXT_ARM64 | 0x10L)
+
+#define CONTEXT_UNWOUND_TO_CALL 0x20000000
+#define CONTEXT_RET_TO_GUEST    0x04000000
+
+#define ARM64_MAX_BREAKPOINTS     8
+#define ARM64_MAX_WATCHPOINTS     2

ctypes_generation/definitions/defines/windef.txt

@@ -130,22 +130,6 @@
 #define TH32CS_SNAPALL      (TH32CS_SNAPHEAPLIST | TH32CS_SNAPPROCESS | TH32CS_SNAPTHREAD | TH32CS_SNAPMODULE)
 #define TH32CS_INHERIT      0x80000000
 
-#define CONTEXT_I386    0x00010000
-#define CONTEXT_AMD64   0x00100000
-#define CONTEXT_ARM   0x00200000
-#define CONTEXT_ARM64   0x00400000
-
-#define CONTEXT_CONTROL             0x00000001L
-#define CONTEXT_INTEGER             0x00000002L
-#define CONTEXT_SEGMENTS            0x00000004L
-#define CONTEXT_FLOATING_POINT      0x00000008L
-#define CONTEXT_DEBUG_REGISTERS     0x00000010L
-#define CONTEXT_EXTENDED_REGISTERS  0x00000020L
-#define CONTEXT_FULL (CONTEXT_CONTROL | CONTEXT_INTEGER | CONTEXT_SEGMENTS)
-#define CONTEXT_ALL (CONTEXT_FULL | CONTEXT_FLOATING_POINT | CONTEXT_DEBUG_REGISTERS | CONTEXT_EXTENDED_REGISTERS)
-
-#define CONTEXT_XSTATE          (CONTEXT_I386 | 0x00000040L)
-
 
 #define PAGE_NOACCESS          0x01
 #define PAGE_READONLY          0x02

ctypes_generation/definitions/defines/windef_pe.txt

@@ -100,4 +100,6 @@
 #define IMAGE_FILE_MACHINE_AMD64             0x8664
 #define IMAGE_FILE_MACHINE_M32R              0x9041
 #define IMAGE_FILE_MACHINE_CEE               0xC0EE
-#define IMAGE_FILE_MACHINE_ARM64             0xAA64
+#define IMAGE_FILE_MACHINE_ARM64             0xAA64
+
+#define IMAGE_FILE_MACHINE_TARGET_HOST      0x0001  // Useful for indicating we want to interact with the host and not a WoW guest.

ctypes_generation/definitions/functions/process.txt

@@ -65,6 +65,19 @@ BOOL FreeLibrary(
   HMODULE hLibModule
 );
 
+BOOL GetProcessInformation(
+  [in] HANDLE                    hProcess,
+  [in] PROCESS_INFORMATION_CLASS ProcessInformationClass,
+       LPVOID                    ProcessInformation,
+  [in] DWORD                     ProcessInformationSize
+);
+
+BOOL SetProcessInformation(
+  [in] HANDLE                    hProcess,
+  [in] PROCESS_INFORMATION_CLASS ProcessInformationClass,
+       LPVOID                    ProcessInformation,
+  [in] DWORD                     ProcessInformationSize
+);
 
 /* Not documented by seems present since dawn of time (WRK)
     I Prefere PVOID as a return value to allow simple cast to PEB subclass in process.py*/

ctypes_generation/definitions/functions/sysinfo.txt

@@ -59,4 +59,12 @@ BOOL LookupAccountNameW(
   LPWSTR        ReferencedDomainName,
   LPDWORD       cchReferencedDomainName,
   PSID_NAME_USE peUse
+);
+
+PVOID GetNativeSystemInfo(
+  [out] LPSYSTEM_INFO lpSystemInfo
+);
+
+PVOID GetSystemInfo(
+  [out] LPSYSTEM_INFO lpSystemInfo
 );

ctypes_generation/definitions/functions/syswow64.txt

@@ -0,0 +1,83 @@
+BOOL IsWow64Process(
+  [in]  HANDLE hProcess,
+  [out] PBOOL  Wow64Process
+);
+
+BOOL IsWow64Process2(
+  [in]            HANDLE hProcess,
+  [out]           USHORT *pProcessMachine,
+  [out, optional] USHORT *pNativeMachine
+);
+
+HRESULT IsWow64GuestMachineSupported(
+  [in]  USHORT WowGuestMachine,
+  [out] BOOL   *MachineIsSupported
+);
+
+UINT GetSystemWow64DirectoryA(
+  [out] LPSTR lpBuffer,
+  [in]  UINT  uSize
+);
+
+UINT GetSystemWow64DirectoryW(
+  [out] LPWSTR lpBuffer,
+  [in]  UINT   uSize
+);
+
+UINT GetSystemWow64Directory2A(
+  [out] LPSTR lpBuffer,
+  [in]  UINT  uSize,
+  [in]  WORD  ImageFileMachineType
+);
+
+UINT GetSystemWow64Directory2W(
+  [out] LPWSTR lpBuffer,
+  [in]  UINT   uSize,
+  [in]  WORD   ImageFileMachineType
+);
+
+BOOL Wow64DisableWow64FsRedirection(
+  [out] PVOID *OldValue
+);
+
+BOOLEAN Wow64EnableWow64FsRedirection(
+  BOOLEAN Wow64FsEnableRedirection
+);
+
+BOOL Wow64RevertWow64FsRedirection(
+  [in] PVOID OlValue
+);
+
+BOOL Wow64GetThreadContext(
+  HANDLE         hThread,
+  PWOW64_CONTEXT lpContext
+);
+
+BOOL Wow64SetThreadContext(
+  HANDLE         hThread,
+  WOW64_CONTEXT *lpContext
+);
+
+USHORT Wow64SetThreadDefaultGuestMachine(
+  USHORT Machine
+);
+
+DWORD Wow64SuspendThread(
+  HANDLE hThread
+);
+
+NTSTATUS WINAPI NtWow64ReadVirtualMemory64(
+  _In_   HANDLE     hProcess,
+  _In_   ULONG64    lpBaseAddress,
+  _Out_  LPVOID     lpBuffer,
+  _In_   ULONG64    nSize,
+  _Out_  PULONG64   lpNumberOfBytesRead
+);
+
+NTSTATUS WINAPI NtWow64WriteVirtualMemory64(
+  _In_   HANDLE     hProcess,
+  _In_   ULONG64    lpBaseAddress,
+  _Out_  LPVOID     lpBuffer,
+  _In_   ULONG64    nSize,
+  _Out_  PULONG64   lpNumberOfBytesWritten
+);

ctypes_generation/definitions/functions/winfunc.txt

@@ -150,6 +150,17 @@ HANDLE WINAPI CreateRemoteThread(
   _Out_  LPDWORD lpThreadId
 );
 
+HANDLE CreateRemoteThreadEx(
+  [in]            HANDLE                       hProcess,
+  [in, optional]  LPSECURITY_ATTRIBUTES        lpThreadAttributes,
+  [in]            SIZE_T                       dwStackSize,
+  [in]            LPTHREAD_START_ROUTINE       lpStartAddress,
+  [in, optional]  LPVOID                       lpParameter,
+  [in]            DWORD                        dwCreationFlags,
+  [in, optional]  LPPROC_THREAD_ATTRIBUTE_LIST lpAttributeList,
+  [out, optional] LPDWORD                      lpThreadId
+);
+
 BOOL WINAPI CreateProcessA(
     __in_opt    LPCSTR lpApplicationName,
     __inout_opt LPSTR lpCommandLine,
@@ -242,13 +253,6 @@ BOOL WINAPI ReadProcessMemory(
   _Out_  SIZE_T     *lpNumberOfBytesRead
 );
 
-NTSTATUS WINAPI NtWow64ReadVirtualMemory64(
-  _In_   HANDLE     hProcess,
-  _In_   ULONG64    lpBaseAddress,
-  _Out_  LPVOID     lpBuffer,
-  _In_   ULONG64    nSize,
-  _Out_  PULONG64   lpNumberOfBytesRead
-);
 
 
 BOOL WINAPI WriteProcessMemory(
@@ -260,13 +264,7 @@ BOOL WINAPI WriteProcessMemory(
 );
 
 
-NTSTATUS WINAPI NtWow64WriteVirtualMemory64(
-  _In_   HANDLE     hProcess,
-  _In_   ULONG64    lpBaseAddress,
-  _Out_  LPVOID     lpBuffer,
-  _In_   ULONG64    nSize,
-  _Out_  PULONG64   lpNumberOfBytesWritten
-);
+
 
 
 
@@ -518,23 +516,6 @@ BOOL WINAPI DeviceIoControl(
 );
 
 
-BOOL WINAPI Wow64DisableWow64FsRedirection(
-  _Out_ PVOID *OldValue
-);
-
-BOOL WINAPI Wow64RevertWow64FsRedirection(
-  _In_ PVOID OldValue
-);
-
-BOOLEAN WINAPI Wow64EnableWow64FsRedirection(
-  _In_ BOOLEAN Wow64FsEnableRedirection
-);
-
-BOOL WINAPI Wow64GetThreadContext(
-    _In_    HANDLE hThread,
-    _Inout_ PWOW64_CONTEXT lpContext
-);
-
 BOOL WINAPI SetConsoleCtrlHandler(
   _In_opt_ PHANDLER_ROUTINE HandlerRoutine,
   _In_     BOOL             Add
@@ -669,10 +650,6 @@ DWORD WINAPI GetProcessId(
   _In_ HANDLE Process
 );
 
-BOOL WINAPI Wow64SetThreadContext(
-    __in HANDLE hThread,
-    __in CONST WOW64_CONTEXT *lpContext
-);
 
 DWORD WINAPI GetMappedFileNameW (
     __in HANDLE hProcess,

ctypes_generation/definitions/structures/proc_thread_attributes.txt

@@ -0,0 +1,24 @@
+typedef enum _PROC_THREAD_ATTRIBUTE_NUM {
+    ProcThreadAttributeParentProcess                = 0,
+    ProcThreadAttributeHandleList                   = 2,
+    ProcThreadAttributeGroupAffinity                = 3,
+    ProcThreadAttributePreferredNode                = 4,
+    ProcThreadAttributeIdealProcessor               = 5,
+    ProcThreadAttributeUmsThread                    = 6,
+    ProcThreadAttributeMitigationPolicy             = 7,
+    ProcThreadAttributeSecurityCapabilities         = 9,
+    ProcThreadAttributeProtectionLevel              = 11,
+    ProcThreadAttributeJobList                      = 13,
+    ProcThreadAttributeChildProcessPolicy           = 14,
+    ProcThreadAttributeAllApplicationPackagesPolicy = 15,
+    ProcThreadAttributeWin32kFilter                 = 16,
+    ProcThreadAttributeSafeOpenPromptOriginClaim    = 17,
+    ProcThreadAttributeDesktopAppPolicy             = 18,
+    ProcThreadAttributePseudoConsole                = 22,
+    ProcThreadAttributeMitigationAuditPolicy        = 24,
+    ProcThreadAttributeMachineType                  = 25,
+    ProcThreadAttributeComponentFilter              = 26,
+    ProcThreadAttributeEnableOptionalXStateFeatures = 27,
+    ProcThreadAttributeTrustedApp                   = 29,
+    ProcThreadAttributeSveVectorLength              = 30,
+} PROC_THREAD_ATTRIBUTE_NUM;

ctypes_generation/definitions/structures/process.txt

@@ -0,0 +1,124 @@
+typedef enum _MEMORY_INFORMATION_CLASS {
+    MemoryBasicInformation,
+    MemoryWorkingSetList,
+    MemorySectionName,
+    MemoryBasicVlmInformation,
+    MemoryWorkingSetListEx
+} MEMORY_INFORMATION_CLASS;
+
+typedef enum _THREAD_INFORMATION_CLASS {
+    ThreadBasicInformation,
+    ThreadTimes,
+    ThreadPriority,
+    ThreadBasePriority,
+    ThreadAffinityMask,
+    ThreadImpersonationToken,
+    ThreadDescriptorTableEntry,
+    ThreadEnableAlignmentFaultFixup,
+    ThreadEventPair,
+    ThreadQuerySetWin32StartAddress,
+    ThreadZeroTlsCell,
+    ThreadPerformanceCount,
+    ThreadAmILastThread,
+    ThreadIdealProcessor,
+    ThreadPriorityBoost,
+    ThreadSetTlsArrayAddress,
+    ThreadIsIoPending,
+    ThreadHideFromDebugger
+} THREAD_INFORMATION_CLASS, *PTHREAD_INFORMATION_CLASS;
+
+// For NtQueryInformationProcess
+typedef enum _PROCESSINFOCLASS {
+    ProcessBasicInformation                      = 0,
+    ProcessQuotaLimits                           = 1,
+    ProcessIoCounters                            = 2,
+    ProcessVmCounters                            = 3,
+    ProcessTimes                                 = 4,
+    ProcessBasePriority                          = 5,
+    ProcessRaisePriority                         = 6,
+    ProcessDebugPort                             = 7,
+    ProcessExceptionPort                         = 8,
+    ProcessAccessToken                           = 9,
+    ProcessLdtInformation                        = 10,
+    ProcessLdtSize                               = 11,
+    ProcessDefaultHardErrorMode                  = 12,
+    ProcessIoPortHandlers                        = 13,   // Note: this is kernel mode only
+    ProcessPooledUsageAndLimits                  = 14,
+    ProcessWorkingSetWatch                       = 15,
+    ProcessUserModeIOPL                          = 16,
+    ProcessEnableAlignmentFaultFixup             = 17,
+    ProcessPriorityClass                         = 18,
+    ProcessWx86Information                       = 19,
+    ProcessHandleCount                           = 20,
+    ProcessAffinityMask                          = 21,
+    ProcessPriorityBoost                         = 22,
+    ProcessDeviceMap                             = 23,
+    ProcessSessionInformation                    = 24,
+    ProcessForegroundInformation                 = 25,
+    ProcessWow64Information                      = 26,
+    ProcessImageFileName                         = 27,
+    ProcessLUIDDeviceMapsEnabled                 = 28,
+    ProcessBreakOnTermination                    = 29,
+    ProcessDebugObjectHandle                     = 30,
+    ProcessDebugFlags                            = 31,
+    ProcessHandleTracing                         = 32,
+    ProcessIoPriority                            = 33,
+    ProcessExecuteFlags                          = 34,
+    ProcessTlsInformation                        = 35,
+    ProcessCookie                                = 36,
+    ProcessImageInformation                      = 37,
+    ProcessCycleTime                             = 38,
+    ProcessPagePriority                          = 39,
+    ProcessInstrumentationCallback               = 40,
+    ProcessThreadStackAllocation                 = 41,
+    ProcessWorkingSetWatchEx                     = 42,
+    ProcessImageFileNameWin32                    = 43,
+    ProcessImageFileMapping                      = 44,
+    ProcessAffinityUpdateMode                    = 45,
+    ProcessMemoryAllocationMode                  = 46,
+    ProcessGroupInformation                      = 47,
+    ProcessTokenVirtualizationEnabled            = 48,
+    ProcessOwnerInformation                      = 49,
+    ProcessWindowInformation                     = 50,
+    ProcessHandleInformation                     = 51,
+    ProcessMitigationPolicy                      = 52,
+    ProcessDynamicFunctionTableInformation       = 53,
+    ProcessHandleCheckingMode                    = 54,
+    ProcessKeepAliveCount                        = 55,
+    ProcessRevokeFileHandles                     = 56,
+    ProcessWorkingSetControl                     = 57,
+    ProcessHandleTable                           = 58,
+    ProcessCheckStackExtentsMode                 = 59,
+    ProcessCommandLineInformation                = 60,
+    ProcessProtectionInformation                 = 61,
+    ProcessMemoryExhaustion                      = 62,
+    ProcessFaultInformation                      = 63,
+    ProcessTelemetryIdInformation                = 64,
+    ProcessCommitReleaseInformation              = 65,
+    ProcessReserved1Information                  = 66,
+    ProcessReserved2Information                  = 67,
+    ProcessSubsystemProcess                      = 68,
+    ProcessInPrivate                             = 70,
+    ProcessRaiseUMExceptionOnInvalidHandleClose  = 71,
+    ProcessSubsystemInformation                  = 75,
+    ProcessWin32kSyscallFilterInformation        = 79,
+    ProcessEnergyTrackingState                   = 82,
+    MaxProcessInfoClass                             // MaxProcessInfoClass should always be the last enum
+} PROCESSINFOCLASS;
+
+// GetProcessInfo
+typedef enum _PROCESS_INFORMATION_CLASS {
+  ProcessMemoryPriority,
+  ProcessMemoryExhaustionInfo,
+  ProcessAppMemoryInfo,
+  ProcessInPrivateInfo,
+  ProcessPowerThrottling,
+  ProcessReservedValue1,
+  ProcessTelemetryCoverageInfo,
+  ProcessProtectionLevelInfo,
+  ProcessLeapSecondInfo,
+  ProcessMachineTypeInfo, // Map to 0xe6(230) for the syscall NtQueryInformationProcess
+  ProcessOverrideSubsequentPrefetchParameter,
+  ProcessMaxOverridePrefetchParameter,
+  ProcessInformationClassMax
+} PROCESS_INFORMATION_CLASS;

ctypes_generation/definitions/structures/processor.txt

@@ -0,0 +1,11 @@
+typedef enum _MACHINE_ATTRIBUTES {
+  UserEnabled = 0x00000001,
+  KernelEnabled = 0x00000002,
+  Wow64Container = 0x00000004
+} MACHINE_ATTRIBUTES;
+
+typedef struct _PROCESS_MACHINE_INFORMATION {
+  USHORT             ProcessMachine;
+  USHORT             Res0;
+  MACHINE_ATTRIBUTES MachineAttributes;
+} PROCESS_MACHINE_INFORMATION;

ctypes_generation/definitions/structures/system_info.txt

@@ -67,3 +67,22 @@ typedef enum _COMPUTER_NAME_FORMAT {
   ComputerNamePhysicalDnsFullyQualified,
   ComputerNameMax
 } COMPUTER_NAME_FORMAT;
+
+typedef struct _SYSTEM_INFO {
+  union {
+    DWORD dwOemId;
+    struct {
+      WORD wProcessorArchitecture;
+      WORD wReserved;
+    } DUMMYSTRUCTNAME;
+  } DUMMYUNIONNAME;
+  DWORD     dwPageSize;
+  LPVOID    lpMinimumApplicationAddress;
+  LPVOID    lpMaximumApplicationAddress;
+  DWORD_PTR dwActiveProcessorMask;
+  DWORD     dwNumberOfProcessors;
+  DWORD     dwProcessorType;
+  DWORD     dwAllocationGranularity;
+  WORD      wProcessorLevel;
+  WORD      wProcessorRevision;
+} SYSTEM_INFO, *LPSYSTEM_INFO;

ctypes_generation/definitions/structures/thread_context.txt

@@ -0,0 +1,347 @@
+typedef union _ARM64_NT_NEON128 {
+    struct {
+        ULONGLONG Low;
+        LONGLONG High;
+    } DUMMYSTRUCTNAME;
+    DOUBLE D[2];
+    FLOAT S[4];
+    WORD   H[8];
+    BYTE  B[16];
+} ARM64_NT_NEON128, *PARM64_NT_NEON128;
+
+typedef struct _ARM64_NT_CONTEXT {
+
+    //
+    // Control flags.
+    //
+
+    /* +0x000 */ DWORD ContextFlags;
+
+    //
+    // Integer registers
+    //
+
+    /* +0x004 */ DWORD Cpsr;       // NZVF + DAIF + CurrentEL + SPSel
+    /* +0x008 */ union {
+                    struct {
+                        DWORD64 X0;
+                        DWORD64 X1;
+                        DWORD64 X2;
+                        DWORD64 X3;
+                        DWORD64 X4;
+                        DWORD64 X5;
+                        DWORD64 X6;
+                        DWORD64 X7;
+                        DWORD64 X8;
+                        DWORD64 X9;
+                        DWORD64 X10;
+                        DWORD64 X11;
+                        DWORD64 X12;
+                        DWORD64 X13;
+                        DWORD64 X14;
+                        DWORD64 X15;
+                        DWORD64 X16;
+                        DWORD64 X17;
+                        DWORD64 X18;
+                        DWORD64 X19;
+                        DWORD64 X20;
+                        DWORD64 X21;
+                        DWORD64 X22;
+                        DWORD64 X23;
+                        DWORD64 X24;
+                        DWORD64 X25;
+                        DWORD64 X26;
+                        DWORD64 X27;
+                        DWORD64 X28;
+    /* +0x0f0 */        DWORD64 Fp;
+    /* +0x0f8 */        DWORD64 Lr;
+                    } DUMMYSTRUCTNAME;
+                    DWORD64 X[31];
+                 } DUMMYUNIONNAME;
+    /* +0x100 */ DWORD64 Sp;
+    /* +0x108 */ DWORD64 Pc;
+
+    //
+    // Floating Point/NEON Registers
+    //
+
+    /* +0x110 */ ARM64_NT_NEON128 V[32];
+    /* +0x310 */ DWORD Fpcr;
+    /* +0x314 */ DWORD Fpsr;
+
+    //
+    // Debug registers
+    //
+
+    /* +0x318 */ DWORD Bcr[ARM64_MAX_BREAKPOINTS];
+    /* +0x338 */ DWORD64 Bvr[ARM64_MAX_BREAKPOINTS];
+    /* +0x378 */ DWORD Wcr[ARM64_MAX_WATCHPOINTS];
+    /* +0x380 */ DWORD64 Wvr[ARM64_MAX_WATCHPOINTS];
+    /* +0x390 */
+
+} ARM64_NT_CONTEXT, *PARM64_NT_CONTEXT;
+
+
+
+
+typedef struct _FLOATING_SAVE_AREA {
+    DWORD   ControlWord;
+    DWORD   StatusWord;
+    DWORD   TagWord;
+    DWORD   ErrorOffset;
+    DWORD   ErrorSelector;
+    DWORD   DataOffset;
+    DWORD   DataSelector;
+    BYTE    RegisterArea[80];
+    DWORD   Cr0NpxState;
+} FLOATING_SAVE_AREA;
+
+typedef struct _CONTEXT32 {
+
+    DWORD ContextFlags;
+
+    DWORD   Dr0;
+    DWORD   Dr1;
+    DWORD   Dr2;
+    DWORD   Dr3;
+    DWORD   Dr6;
+    DWORD   Dr7;
+
+    FLOATING_SAVE_AREA FloatSave;
+
+    DWORD   SegGs;
+    DWORD   SegFs;
+    DWORD   SegEs;
+    DWORD   SegDs;
+
+    DWORD   Edi;
+    DWORD   Esi;
+    DWORD   Ebx;
+    DWORD   Edx;
+    DWORD   Ecx;
+    DWORD   Eax;
+
+    DWORD   Ebp;
+    DWORD   Eip;
+    DWORD   SegCs;
+    DWORD   EFlags;
+    DWORD   Esp;
+    DWORD   SegSs;
+
+    BYTE    ExtendedRegisters[512];
+
+} CONTEXT32, *PCONTEXT32, *LPCONTEXT32;
+
+typedef struct _WOW64_FLOATING_SAVE_AREA {
+    DWORD   ControlWord;
+    DWORD   StatusWord;
+    DWORD   TagWord;
+    DWORD   ErrorOffset;
+    DWORD   ErrorSelector;
+    DWORD   DataOffset;
+    DWORD   DataSelector;
+    BYTE    RegisterArea[WOW64_SIZE_OF_80387_REGISTERS];
+    DWORD   Cr0NpxState;
+} WOW64_FLOATING_SAVE_AREA;
+
+typedef struct _WOW64_CONTEXT {
+
+    DWORD ContextFlags;
+
+    DWORD   Dr0;
+    DWORD   Dr1;
+    DWORD   Dr2;
+    DWORD   Dr3;
+    DWORD   Dr6;
+    DWORD   Dr7;
+
+    WOW64_FLOATING_SAVE_AREA FloatSave;
+
+    DWORD   SegGs;
+    DWORD   SegFs;
+    DWORD   SegEs;
+    DWORD   SegDs;
+
+    DWORD   Edi;
+    DWORD   Esi;
+    DWORD   Ebx;
+    DWORD   Edx;
+    DWORD   Ecx;
+    DWORD   Eax;
+    DWORD   Ebp;
+    DWORD   Eip;
+    DWORD   SegCs;
+    DWORD   EFlags;
+    DWORD   Esp;
+    DWORD   SegSs;
+
+    BYTE    ExtendedRegisters[WOW64_MAXIMUM_SUPPORTED_EXTENSION];
+
+} WOW64_CONTEXT, *PWOW64_CONTEXT;
+
+
+typedef struct _M128A {
+    ULONGLONG Low;
+    LONGLONG High;
+} M128A, *PM128A;
+
+typedef struct _XSAVE_FORMAT_64 {
+    WORD   ControlWord;
+    WORD   StatusWord;
+    BYTE  TagWord;
+    BYTE  Reserved1;
+    WORD   ErrorOpcode;
+    DWORD ErrorOffset;
+    WORD   ErrorSelector;
+    WORD   Reserved2;
+    DWORD DataOffset;
+    WORD   DataSelector;
+    WORD   Reserved3;
+    DWORD MxCsr;
+    DWORD MxCsr_Mask;
+    M128A FloatRegisters[8];
+    M128A XmmRegisters[16];
+    BYTE  Reserved4[96];
+} XSAVE_FORMAT_64, *PXSAVE_FORMAT_64;
+
+typedef struct  _XSAVE_FORMAT_32 {
+    WORD   ControlWord;
+    WORD   StatusWord;
+    BYTE  TagWord;
+    BYTE  Reserved1;
+    WORD   ErrorOpcode;
+    DWORD ErrorOffset;
+    WORD   ErrorSelector;
+    WORD   Reserved2;
+    DWORD DataOffset;
+    WORD   DataSelector;
+    WORD   Reserved3;
+    DWORD MxCsr;
+    DWORD MxCsr_Mask;
+    M128A FloatRegisters[8];
+    M128A XmmRegisters[8];
+    BYTE  Reserved4[192];
+    DWORD   StackControl[7];
+    DWORD   Cr0NpxState;
+} XSAVE_FORMAT_32, *PXSAVE_FORMAT_32;
+
+
+typedef struct _CONTEXT64 {
+
+    //
+    // Register parameter home addresses.
+    //
+    // N.B. These fields are for convience - they could be used to extend the
+    //      context record in the future.
+    //
+
+    DWORD64 P1Home;
+    DWORD64 P2Home;
+    DWORD64 P3Home;
+    DWORD64 P4Home;
+    DWORD64 P5Home;
+    DWORD64 P6Home;
+
+    //
+    // Control flags.
+    //
+
+    DWORD ContextFlags;
+    DWORD MxCsr;
+
+    //
+    // Segment Registers and processor flags.
+    //
+
+    WORD   SegCs;
+    WORD   SegDs;
+    WORD   SegEs;
+    WORD   SegFs;
+    WORD   SegGs;
+    WORD   SegSs;
+    DWORD EFlags;
+
+    //
+    // Debug registers
+    //
+
+    DWORD64 Dr0;
+    DWORD64 Dr1;
+    DWORD64 Dr2;
+    DWORD64 Dr3;
+    DWORD64 Dr6;
+    DWORD64 Dr7;
+
+    //
+    // Integer registers.
+    //
+
+    DWORD64 Rax;
+    DWORD64 Rcx;
+    DWORD64 Rdx;
+    DWORD64 Rbx;
+    DWORD64 Rsp;
+    DWORD64 Rbp;
+    DWORD64 Rsi;
+    DWORD64 Rdi;
+    DWORD64 R8;
+    DWORD64 R9;
+    DWORD64 R10;
+    DWORD64 R11;
+    DWORD64 R12;
+    DWORD64 R13;
+    DWORD64 R14;
+    DWORD64 R15;
+
+    //
+    // Program counter.
+    //
+
+    DWORD64 Rip;
+
+    //
+    // Floating point state.
+    //
+
+    union {
+        XSAVE_FORMAT_64 FltSave;
+        struct {
+            M128A Header[2];
+            M128A Legacy[8];
+            M128A Xmm0;
+            M128A Xmm1;
+            M128A Xmm2;
+            M128A Xmm3;
+            M128A Xmm4;
+            M128A Xmm5;
+            M128A Xmm6;
+            M128A Xmm7;
+            M128A Xmm8;
+            M128A Xmm9;
+            M128A Xmm10;
+            M128A Xmm11;
+            M128A Xmm12;
+            M128A Xmm13;
+            M128A Xmm14;
+            M128A Xmm15;
+        } DUMMYSTRUCTNAME;
+    } DUMMYUNIONNAME;
+
+    //
+    // Vector registers.
+    //
+
+    M128A VectorRegister[26];
+    DWORD64 VectorControl;
+
+    //
+    // Special debug control registers.
+    //
+
+    DWORD64 DebugControl;
+    DWORD64 LastBranchToRip;
+    DWORD64 LastBranchFromRip;
+    DWORD64 LastExceptionToRip;
+    DWORD64 LastExceptionFromRip;
+
+} CONTEXT64, *PCONTEXT64, *LPCONTEXT64;

ctypes_generation/definitions/structures/winstruct.txt

@@ -380,112 +380,7 @@ typedef enum _SECTION_INHERIT {
   ViewUnmap = 2
 } SECTION_INHERIT;
 
-typedef enum _PROCESSINFOCLASS {
-    ProcessBasicInformation                      = 0,
-    ProcessQuotaLimits                           = 1,
-    ProcessIoCounters                            = 2,
-    ProcessVmCounters                            = 3,
-    ProcessTimes                                 = 4,
-    ProcessBasePriority                          = 5,
-    ProcessRaisePriority                         = 6,
-    ProcessDebugPort                             = 7,
-    ProcessExceptionPort                         = 8,
-    ProcessAccessToken                           = 9,
-    ProcessLdtInformation                        = 10,
-    ProcessLdtSize                               = 11,
-    ProcessDefaultHardErrorMode                  = 12,
-    ProcessIoPortHandlers                        = 13,   // Note: this is kernel mode only
-    ProcessPooledUsageAndLimits                  = 14,
-    ProcessWorkingSetWatch                       = 15,
-    ProcessUserModeIOPL                          = 16,
-    ProcessEnableAlignmentFaultFixup             = 17,
-    ProcessPriorityClass                         = 18,
-    ProcessWx86Information                       = 19,
-    ProcessHandleCount                           = 20,
-    ProcessAffinityMask                          = 21,
-    ProcessPriorityBoost                         = 22,
-    ProcessDeviceMap                             = 23,
-    ProcessSessionInformation                    = 24,
-    ProcessForegroundInformation                 = 25,
-    ProcessWow64Information                      = 26,
-    ProcessImageFileName                         = 27,
-    ProcessLUIDDeviceMapsEnabled                 = 28,
-    ProcessBreakOnTermination                    = 29,
-    ProcessDebugObjectHandle                     = 30,
-    ProcessDebugFlags                            = 31,
-    ProcessHandleTracing                         = 32,
-    ProcessIoPriority                            = 33,
-    ProcessExecuteFlags                          = 34,
-    ProcessTlsInformation                        = 35,
-    ProcessCookie                                = 36,
-    ProcessImageInformation                      = 37,
-    ProcessCycleTime                             = 38,
-    ProcessPagePriority                          = 39,
-    ProcessInstrumentationCallback               = 40,
-    ProcessThreadStackAllocation                 = 41,
-    ProcessWorkingSetWatchEx                     = 42,
-    ProcessImageFileNameWin32                    = 43,
-    ProcessImageFileMapping                      = 44,
-    ProcessAffinityUpdateMode                    = 45,
-    ProcessMemoryAllocationMode                  = 46,
-    ProcessGroupInformation                      = 47,
-    ProcessTokenVirtualizationEnabled            = 48,
-    ProcessOwnerInformation                      = 49,
-    ProcessWindowInformation                     = 50,
-    ProcessHandleInformation                     = 51,
-    ProcessMitigationPolicy                      = 52,
-    ProcessDynamicFunctionTableInformation       = 53,
-    ProcessHandleCheckingMode                    = 54,
-    ProcessKeepAliveCount                        = 55,
-    ProcessRevokeFileHandles                     = 56,
-    ProcessWorkingSetControl                     = 57,
-    ProcessHandleTable                           = 58,
-    ProcessCheckStackExtentsMode                 = 59,
-    ProcessCommandLineInformation                = 60,
-    ProcessProtectionInformation                 = 61,
-    ProcessMemoryExhaustion                      = 62,
-    ProcessFaultInformation                      = 63,
-    ProcessTelemetryIdInformation                = 64,
-    ProcessCommitReleaseInformation              = 65,
-    ProcessReserved1Information                  = 66,
-    ProcessReserved2Information                  = 67,
-    ProcessSubsystemProcess                      = 68,
-    ProcessInPrivate                             = 70,
-    ProcessRaiseUMExceptionOnInvalidHandleClose  = 71,
-    ProcessSubsystemInformation                  = 75,
-    ProcessWin32kSyscallFilterInformation        = 79,
-    ProcessEnergyTrackingState                   = 82,
-    MaxProcessInfoClass                             // MaxProcessInfoClass should always be the last enum
-} PROCESSINFOCLASS;
 
-typedef enum _MEMORY_INFORMATION_CLASS {
-    MemoryBasicInformation,
-    MemoryWorkingSetList,
-    MemorySectionName,
-    MemoryBasicVlmInformation,
-    MemoryWorkingSetListEx
-} MEMORY_INFORMATION_CLASS;
-
-typedef enum _THREAD_INFORMATION_CLASS {
-    ThreadBasicInformation,
-    ThreadTimes,
-    ThreadPriority,
-    ThreadBasePriority,
-    ThreadAffinityMask,
-    ThreadImpersonationToken,
-    ThreadDescriptorTableEntry,
-    ThreadEnableAlignmentFaultFixup,
-    ThreadEventPair,
-    ThreadQuerySetWin32StartAddress,
-    ThreadZeroTlsCell,
-    ThreadPerformanceCount,
-    ThreadAmILastThread,
-    ThreadIdealProcessor,
-    ThreadPriorityBoost,
-    ThreadSetTlsArrayAddress,
-    ThreadIsIoPending,
-    ThreadHideFromDebugger
-} THREAD_INFORMATION_CLASS, *PTHREAD_INFORMATION_CLASS;
 
 
 
@@ -842,232 +737,7 @@ typedef struct _PROCESS_INFORMATION {
 } PROCESS_INFORMATION, *PPROCESS_INFORMATION, *LPPROCESS_INFORMATION;
 
 
-typedef struct _FLOATING_SAVE_AREA {
-    DWORD   ControlWord;
-    DWORD   StatusWord;
-    DWORD   TagWord;
-    DWORD   ErrorOffset;
-    DWORD   ErrorSelector;
-    DWORD   DataOffset;
-    DWORD   DataSelector;
-    BYTE    RegisterArea[80];
-    DWORD   Cr0NpxState;
-} FLOATING_SAVE_AREA;
 
-typedef struct _CONTEXT32 {
-
-    DWORD ContextFlags;
-
-    DWORD   Dr0;
-    DWORD   Dr1;
-    DWORD   Dr2;
-    DWORD   Dr3;
-    DWORD   Dr6;
-    DWORD   Dr7;
-
-    FLOATING_SAVE_AREA FloatSave;
-
-    DWORD   SegGs;
-    DWORD   SegFs;
-    DWORD   SegEs;
-    DWORD   SegDs;
-
-    DWORD   Edi;
-    DWORD   Esi;
-    DWORD   Ebx;
-    DWORD   Edx;
-    DWORD   Ecx;
-    DWORD   Eax;
-
-    DWORD   Ebp;
-    DWORD   Eip;
-    DWORD   SegCs;
-    DWORD   EFlags;
-    DWORD   Esp;
-    DWORD   SegSs;
-
-    BYTE    ExtendedRegisters[512];
-
-} CONTEXT32, *PCONTEXT32, *LPCONTEXT32;
-
-typedef struct _WOW64_FLOATING_SAVE_AREA {
-    DWORD   ControlWord;
-    DWORD   StatusWord;
-    DWORD   TagWord;
-    DWORD   ErrorOffset;
-    DWORD   ErrorSelector;
-    DWORD   DataOffset;
-    DWORD   DataSelector;
-    BYTE    RegisterArea[WOW64_SIZE_OF_80387_REGISTERS];
-    DWORD   Cr0NpxState;
-} WOW64_FLOATING_SAVE_AREA;
-
-typedef struct _WOW64_CONTEXT {
-
-    DWORD ContextFlags;
-
-    DWORD   Dr0;
-    DWORD   Dr1;
-    DWORD   Dr2;
-    DWORD   Dr3;
-    DWORD   Dr6;
-    DWORD   Dr7;
-
-    WOW64_FLOATING_SAVE_AREA FloatSave;
-
-    DWORD   SegGs;
-    DWORD   SegFs;
-    DWORD   SegEs;
-    DWORD   SegDs;
-
-    DWORD   Edi;
-    DWORD   Esi;
-    DWORD   Ebx;
-    DWORD   Edx;
-    DWORD   Ecx;
-    DWORD   Eax;
-    DWORD   Ebp;
-    DWORD   Eip;
-    DWORD   SegCs;
-    DWORD   EFlags;
-    DWORD   Esp;
-    DWORD   SegSs;
-
-    BYTE    ExtendedRegisters[WOW64_MAXIMUM_SUPPORTED_EXTENSION];
-
-} WOW64_CONTEXT, *PWOW64_CONTEXT;
-
-
-typedef struct _M128A {
-    ULONGLONG Low;
-    LONGLONG High;
-} M128A, *PM128A;
-
-typedef struct _XSAVE_FORMAT_64 {
-    WORD   ControlWord;
-    WORD   StatusWord;
-    BYTE  TagWord;
-    BYTE  Reserved1;
-    WORD   ErrorOpcode;
-    DWORD ErrorOffset;
-    WORD   ErrorSelector;
-    WORD   Reserved2;
-    DWORD DataOffset;
-    WORD   DataSelector;
-    WORD   Reserved3;
-    DWORD MxCsr;
-    DWORD MxCsr_Mask;
-    M128A FloatRegisters[8];
-    M128A XmmRegisters[16];
-    BYTE  Reserved4[96];
-} XSAVE_FORMAT_64, *PXSAVE_FORMAT_64;
-
-typedef struct  _XSAVE_FORMAT_32 {
-    WORD   ControlWord;
-    WORD   StatusWord;
-    BYTE  TagWord;
-    BYTE  Reserved1;
-    WORD   ErrorOpcode;
-    DWORD ErrorOffset;
-    WORD   ErrorSelector;
-    WORD   Reserved2;
-    DWORD DataOffset;
-    WORD   DataSelector;
-    WORD   Reserved3;
-    DWORD MxCsr;
-    DWORD MxCsr_Mask;
-    M128A FloatRegisters[8];
-    M128A XmmRegisters[8];
-    BYTE  Reserved4[192];
-    DWORD   StackControl[7];
-    DWORD   Cr0NpxState;
-} XSAVE_FORMAT_32, *PXSAVE_FORMAT_32;
-
-typedef struct _TMP_DUMMYSTRUCTNAME {
-    M128A Header[2];
-    M128A Legacy[8];
-    M128A Xmm0;
-    M128A Xmm1;
-    M128A Xmm2;
-    M128A Xmm3;
-    M128A Xmm4;
-    M128A Xmm5;
-    M128A Xmm6;
-    M128A Xmm7;
-    M128A Xmm8;
-    M128A Xmm9;
-    M128A Xmm10;
-    M128A Xmm11;
-    M128A Xmm12;
-    M128A Xmm13;
-    M128A Xmm14;
-    M128A Xmm15;
-} TMP_DUMMYSTRUCTNAME;
-
-
-typedef union _TMP_CONTEXT64_SUBUNION {
-    XSAVE_FORMAT_64 FltSave;
-    TMP_DUMMYSTRUCTNAME DUMMYSTRUCTNAME;
-} TMP_CONTEXT64_SUBUNION;
-
-typedef struct _CONTEXT64 {
-
-    DWORD64 P1Home;
-    DWORD64 P2Home;
-    DWORD64 P3Home;
-    DWORD64 P4Home;
-    DWORD64 P5Home;
-    DWORD64 P6Home;
-
-    DWORD ContextFlags;
-    DWORD MxCsr;
-
-    WORD   SegCs;
-    WORD   SegDs;
-    WORD   SegEs;
-    WORD   SegFs;
-    WORD   SegGs;
-    WORD   SegSs;
-    DWORD EFlags;
-
-    DWORD64 Dr0;
-    DWORD64 Dr1;
-    DWORD64 Dr2;
-    DWORD64 Dr3;
-    DWORD64 Dr6;
-    DWORD64 Dr7;
-
-
-    DWORD64 Rax;
-    DWORD64 Rcx;
-    DWORD64 Rdx;
-    DWORD64 Rbx;
-    DWORD64 Rsp;
-    DWORD64 Rbp;
-    DWORD64 Rsi;
-    DWORD64 Rdi;
-    DWORD64 R8;
-    DWORD64 R9;
-    DWORD64 R10;
-    DWORD64 R11;
-    DWORD64 R12;
-    DWORD64 R13;
-    DWORD64 R14;
-    DWORD64 R15;
-
-    DWORD64 Rip;
-
-    TMP_CONTEXT64_SUBUNION DUMMYUNIONNAME;
-
-    M128A VectorRegister[26];
-    DWORD64 VectorControl;
-
-    DWORD64 DebugControl;
-    DWORD64 LastBranchToRip;
-    DWORD64 LastBranchFromRip;
-    DWORD64 LastExceptionToRip;
-    DWORD64 LastExceptionFromRip;
-} CONTEXT64, *PCONTEXT64, *LPCONTEXT64;
 
 
 typedef struct tagPROCESSENTRY32W

docs/source/windef_generated.rst

@@ -1145,6 +1145,89 @@ WinDef
 .. autodata:: NMPWAIT_WAIT_FOREVER
 .. autodata:: NMPWAIT_NOWAIT
 .. autodata:: NMPWAIT_USE_DEFAULT_WAIT
+.. autodata:: ProcThreadAttributeParentProcess
+.. autodata:: ProcThreadAttributeExtendedFlags
+.. autodata:: ProcThreadAttributeHandleList
+.. autodata:: ProcThreadAttributeGroupAffinity
+.. autodata:: ProcThreadAttributePreferredNode
+.. autodata:: ProcThreadAttributeIdealProcessor
+.. autodata:: ProcThreadAttributeUmsThread
+.. autodata:: ProcThreadAttributeMitigationPolicy
+.. autodata:: ProcThreadAttributePackageFullName
+.. autodata:: ProcThreadAttributeSecurityCapabilities
+.. autodata:: ProcThreadAttributeConsoleReference
+.. autodata:: ProcThreadAttributeProtectionLevel
+.. autodata:: ProcThreadAttributeOsMaxVersionTested
+.. autodata:: ProcThreadAttributeJobList
+.. autodata:: ProcThreadAttributeChildProcessPolicy
+.. autodata:: ProcThreadAttributeAllApplicationPackagesPolicy
+.. autodata:: ProcThreadAttributeWin32kFilter
+.. autodata:: ProcThreadAttributeSafeOpenPromptOriginClaim
+.. autodata:: ProcThreadAttributeDesktopAppPolicy
+.. autodata:: ProcThreadAttributeBnoIsolation
+.. autodata:: ProcThreadAttributePseudoConsole
+.. autodata:: ProcThreadAttributeIsolationManifest
+.. autodata:: ProcThreadAttributeMitigationAuditPolicy
+.. autodata:: ProcThreadAttributeMachineType
+.. autodata:: ProcThreadAttributeComponentFilter
+.. autodata:: ProcThreadAttributeEnableOptionalXStateFeatures
+.. autodata:: ProcThreadAttributeCreateStore
+.. autodata:: ProcThreadAttributeTrustedApp
+.. autodata:: ProcThreadAttributeSveVectorLength
+.. autodata:: PROC_THREAD_ATTRIBUTE_NUMBER
+.. autodata:: PROC_THREAD_ATTRIBUTE_THREAD
+.. autodata:: PROC_THREAD_ATTRIBUTE_INPUT
+.. autodata:: PROC_THREAD_ATTRIBUTE_ADDITIVE
+.. autodata:: PROC_THREAD_ATTRIBUTE_PARENT_PROCESS
+.. autodata:: PROC_THREAD_ATTRIBUTE_HANDLE_LIST
+.. autodata:: PROC_THREAD_ATTRIBUTE_GROUP_AFFINITY
+.. autodata:: PROC_THREAD_ATTRIBUTE_PREFERRED_NODE
+.. autodata:: PROC_THREAD_ATTRIBUTE_IDEAL_PROCESSOR
+.. autodata:: PROC_THREAD_ATTRIBUTE_UMS_THREAD
+.. autodata:: PROC_THREAD_ATTRIBUTE_MITIGATION_POLICY
+.. autodata:: PROC_THREAD_ATTRIBUTE_SECURITY_CAPABILITIES
+.. autodata:: PROC_THREAD_ATTRIBUTE_PROTECTION_LEVEL
+.. autodata:: PROC_THREAD_ATTRIBUTE_PSEUDOCONSOLE
+.. autodata:: PROC_THREAD_ATTRIBUTE_MACHINE_TYPE
+.. autodata:: PROC_THREAD_ATTRIBUTE_ENABLE_OPTIONAL_XSTATE_FEATURES
+.. autodata:: PROC_THREAD_ATTRIBUTE_SVE_VECTOR_LENGTH
+.. autodata:: PROCESSOR_INTEL_386
+.. autodata:: PROCESSOR_INTEL_486
+.. autodata:: PROCESSOR_INTEL_PENTIUM
+.. autodata:: PROCESSOR_INTEL_IA64
+.. autodata:: PROCESSOR_MIPS_R4000
+.. autodata:: PROCESSOR_ALPHA_21064
+.. autodata:: PROCESSOR_PPC_601
+.. autodata:: PROCESSOR_PPC_603
+.. autodata:: PROCESSOR_PPC_604
+.. autodata:: PROCESSOR_PPC_620
+.. autodata:: PROCESSOR_HITACHI_SH3
+.. autodata:: PROCESSOR_HITACHI_SH3E
+.. autodata:: PROCESSOR_HITACHI_SH4
+.. autodata:: PROCESSOR_MOTOROLA_821
+.. autodata:: PROCESSOR_SHx_SH3
+.. autodata:: PROCESSOR_SHx_SH4
+.. autodata:: PROCESSOR_STRONGARM
+.. autodata:: PROCESSOR_ARM720
+.. autodata:: PROCESSOR_ARM820
+.. autodata:: PROCESSOR_ARM920
+.. autodata:: PROCESSOR_ARM_7TDMI
+.. autodata:: PROCESSOR_OPTIL
+.. autodata:: PROCESSOR_ARCHITECTURE_INTEL
+.. autodata:: PROCESSOR_ARCHITECTURE_MIPS
+.. autodata:: PROCESSOR_ARCHITECTURE_ALPHA
+.. autodata:: PROCESSOR_ARCHITECTURE_PPC
+.. autodata:: PROCESSOR_ARCHITECTURE_SHX
+.. autodata:: PROCESSOR_ARCHITECTURE_ARM
+.. autodata:: PROCESSOR_ARCHITECTURE_IA64
+.. autodata:: PROCESSOR_ARCHITECTURE_ALPHA64
+.. autodata:: PROCESSOR_ARCHITECTURE_MSIL
+.. autodata:: PROCESSOR_ARCHITECTURE_AMD64
+.. autodata:: PROCESSOR_ARCHITECTURE_IA32_ON_WIN64
+.. autodata:: PROCESSOR_ARCHITECTURE_NEUTRAL
+.. autodata:: PROCESSOR_ARCHITECTURE_ARM64
+.. autodata:: PROCESSOR_ARCHITECTURE_ARM32_ON_WIN64
+.. autodata:: PROCESSOR_ARCHITECTURE_UNKNOWN
 .. autodata:: HKEY_CLASSES_ROOT
 .. autodata:: HKEY_CURRENT_USER
 .. autodata:: HKEY_LOCAL_MACHINE
@@ -1766,6 +1849,45 @@ WinDef
 .. autodata:: SPC_FINANCIAL_CRITERIA_OBJID
 .. autodata:: SPC_LINK_OBJID
 .. autodata:: SPC_SIGINFO_OBJID
+.. autodata:: CONTEXT_I386
+.. autodata:: CONTEXT_AMD64
+.. autodata:: CONTEXT_ARM
+.. autodata:: CONTEXT_ARM64
+.. autodata:: CONTEXT_i386
+.. autodata:: CONTEXT_i486
+.. autodata:: WOW64_CONTEXT_i386
+.. autodata:: WOW64_CONTEXT_i486
+.. autodata:: CONTEXT_CONTROL
+.. autodata:: CONTEXT_INTEGER
+.. autodata:: CONTEXT_SEGMENTS
+.. autodata:: CONTEXT_FLOATING_POINT
+.. autodata:: CONTEXT_DEBUG_REGISTERS
+.. autodata:: CONTEXT_EXTENDED_REGISTERS
+.. autodata:: CONTEXT_FULL
+.. autodata:: CONTEXT_ALL
+.. autodata:: CONTEXT_XSTATE
+.. autodata:: WOW64_CONTEXT_CONTROL
+.. autodata:: WOW64_CONTEXT_INTEGER
+.. autodata:: WOW64_CONTEXT_SEGMENTS
+.. autodata:: WOW64_CONTEXT_FLOATING_POINT
+.. autodata:: WOW64_CONTEXT_DEBUG_REGISTERS
+.. autodata:: WOW64_CONTEXT_EXTENDED_REGISTERS
+.. autodata:: WOW64_CONTEXT_FULL
+.. autodata:: WOW64_CONTEXT_ALL
+.. autodata:: WOW64_CONTEXT_XSTATE
+.. autodata:: WOW64_CONTEXT_EXCEPTION_ACTIVE
+.. autodata:: WOW64_CONTEXT_SERVICE_ACTIVE
+.. autodata:: WOW64_CONTEXT_EXCEPTION_REQUEST
+.. autodata:: WOW64_CONTEXT_EXCEPTION_REPORTING
+.. autodata:: CONTEXT_ARM64_CONTROL
+.. autodata:: CONTEXT_ARM64_INTEGER
+.. autodata:: CONTEXT_ARM64_FLOATING_POINT
+.. autodata:: CONTEXT_ARM64_DEBUG_REGISTERS
+.. autodata:: CONTEXT_ARM64_X18
+.. autodata:: CONTEXT_UNWOUND_TO_CALL
+.. autodata:: CONTEXT_RET_TO_GUEST
+.. autodata:: ARM64_MAX_BREAKPOINTS
+.. autodata:: ARM64_MAX_WATCHPOINTS
 .. autodata:: FILE_VER_GET_LOCALISED
 .. autodata:: FILE_VER_GET_NEUTRAL
 .. autodata:: FILE_VER_GET_PREFETCHED
@@ -1877,19 +1999,6 @@ WinDef
 .. autodata:: TH32CS_SNAPMODULE32
 .. autodata:: TH32CS_SNAPALL
 .. autodata:: TH32CS_INHERIT
-.. autodata:: CONTEXT_I386
-.. autodata:: CONTEXT_AMD64
-.. autodata:: CONTEXT_ARM
-.. autodata:: CONTEXT_ARM64
-.. autodata:: CONTEXT_CONTROL
-.. autodata:: CONTEXT_INTEGER
-.. autodata:: CONTEXT_SEGMENTS
-.. autodata:: CONTEXT_FLOATING_POINT
-.. autodata:: CONTEXT_DEBUG_REGISTERS
-.. autodata:: CONTEXT_EXTENDED_REGISTERS
-.. autodata:: CONTEXT_FULL
-.. autodata:: CONTEXT_ALL
-.. autodata:: CONTEXT_XSTATE
 .. autodata:: PAGE_NOACCESS
 .. autodata:: PAGE_READONLY
 .. autodata:: PAGE_READWRITE
@@ -2922,6 +3031,7 @@ WinDef
 .. autodata:: IMAGE_FILE_MACHINE_M32R
 .. autodata:: IMAGE_FILE_MACHINE_CEE
 .. autodata:: IMAGE_FILE_MACHINE_ARM64
+.. autodata:: IMAGE_FILE_MACHINE_TARGET_HOST
 .. autodata:: CERT_QUERY_OBJECT_FILE
 .. autodata:: CERT_QUERY_OBJECT_BLOB
 .. autodata:: CERT_QUERY_CONTENT_CERT

docs/source/winfuncs_generated.rst

@@ -696,6 +696,10 @@ Functions
 
 .. function:: FreeLibrary(hLibModule)
 
+.. function:: GetProcessInformation(hProcess, ProcessInformationClass, ProcessInformation, ProcessInformationSize)
+
+.. function:: SetProcessInformation(hProcess, ProcessInformationClass, ProcessInformation, ProcessInformationSize)
+
 .. function:: RtlGetCurrentPeb()
 
 .. function:: RegQueryValueExA(hKey, lpValueName, lpReserved, lpType, lpData, lpcbData)
@@ -1214,6 +1218,42 @@ Functions
 
 .. function:: LookupAccountNameW(lpSystemName, lpAccountName, Sid, cbSid, ReferencedDomainName, cchReferencedDomainName, peUse)
 
+.. function:: GetNativeSystemInfo(lpSystemInfo)
+
+.. function:: GetSystemInfo(lpSystemInfo)
+
+.. function:: IsWow64Process(hProcess, Wow64Process)
+
+.. function:: IsWow64Process2(hProcess, pProcessMachine, pNativeMachine)
+
+.. function:: IsWow64GuestMachineSupported(WowGuestMachine, MachineIsSupported)
+
+.. function:: GetSystemWow64DirectoryA(lpBuffer, uSize)
+
+.. function:: GetSystemWow64DirectoryW(lpBuffer, uSize)
+
+.. function:: GetSystemWow64Directory2A(lpBuffer, uSize, ImageFileMachineType)
+
+.. function:: GetSystemWow64Directory2W(lpBuffer, uSize, ImageFileMachineType)
+
+.. function:: Wow64DisableWow64FsRedirection(OldValue)
+
+.. function:: Wow64EnableWow64FsRedirection(Wow64FsEnableRedirection)
+
+.. function:: Wow64RevertWow64FsRedirection(OlValue)
+
+.. function:: Wow64GetThreadContext(hThread, lpContext)
+
+.. function:: Wow64SetThreadContext(hThread, lpContext)
+
+.. function:: Wow64SetThreadDefaultGuestMachine(Machine)
+
+.. function:: Wow64SuspendThread(hThread)
+
+.. function:: NtWow64ReadVirtualMemory64(hProcess, lpBaseAddress, lpBuffer, nSize, lpNumberOfBytesRead)
+
+.. function:: NtWow64WriteVirtualMemory64(hProcess, lpBaseAddress, lpBuffer, nSize, lpNumberOfBytesWritten)
+
 .. function:: FileTimeToSystemTime(lpFileTime, lpSystemTime)
 
 .. function:: SystemTimeToFileTime(lpSystemTime, lpFileTime)
@@ -1350,6 +1390,8 @@ Functions
 
 .. function:: CreateRemoteThread(hProcess, lpThreadAttributes, dwStackSize, lpStartAddress, lpParameter, dwCreationFlags, lpThreadId)
 
+.. function:: CreateRemoteThreadEx(hProcess, lpThreadAttributes, dwStackSize, lpStartAddress, lpParameter, dwCreationFlags, lpAttributeList, lpThreadId)
+
 .. function:: CreateProcessA(lpApplicationName, lpCommandLine, lpProcessAttributes, lpThreadAttributes, bInheritHandles, dwCreationFlags, lpEnvironment, lpCurrentDirectory, lpStartupInfo, lpProcessInformation)
 
 .. function:: CreateProcessW(lpApplicationName, lpCommandLine, lpProcessAttributes, lpThreadAttributes, bInheritHandles, dwCreationFlags, lpEnvironment, lpCurrentDirectory, lpStartupInfo, lpProcessInformation)
@@ -1370,12 +1412,8 @@ Functions
 
 .. function:: ReadProcessMemory(hProcess, lpBaseAddress, lpBuffer, nSize, lpNumberOfBytesRead)
 
-.. function:: NtWow64ReadVirtualMemory64(hProcess, lpBaseAddress, lpBuffer, nSize, lpNumberOfBytesRead)
-
 .. function:: WriteProcessMemory(hProcess, lpBaseAddress, lpBuffer, nSize, lpNumberOfBytesWritten)
 
-.. function:: NtWow64WriteVirtualMemory64(hProcess, lpBaseAddress, lpBuffer, nSize, lpNumberOfBytesWritten)
-
 .. function:: GetCurrentProcess()
 
 .. function:: CreateFileA(lpFileName, dwDesiredAccess, dwShareMode, lpSecurityAttributes, dwCreationDisposition, dwFlagsAndAttributes, hTemplateFile)
@@ -1468,14 +1506,6 @@ Functions
 
 .. function:: DeviceIoControl(hDevice, dwIoControlCode, lpInBuffer, nInBufferSize, lpOutBuffer, nOutBufferSize, lpBytesReturned, lpOverlapped)
 
-.. function:: Wow64DisableWow64FsRedirection(OldValue)
-
-.. function:: Wow64RevertWow64FsRedirection(OldValue)
-
-.. function:: Wow64EnableWow64FsRedirection(Wow64FsEnableRedirection)
-
-.. function:: Wow64GetThreadContext(hThread, lpContext)
-
 .. function:: SetConsoleCtrlHandler(HandlerRoutine, Add)
 
 .. function:: GlobalAlloc(uFlags, dwBytes)
@@ -1530,8 +1560,6 @@ Functions
 
 .. function:: GetProcessId(Process)
 
-.. function:: Wow64SetThreadContext(hThread, lpContext)
-
 .. function:: GetMappedFileNameW(hProcess, lpv, lpFilename, nSize)
 
 .. function:: GetMappedFileNameA(hProcess, lpv, lpFilename, nSize)

samples/find_value.py

@@ -18,6 +18,11 @@ def search_name_in_enum(target):
     for name, enum in meta.enums_walker():
         if match(target, name):
             print(name, enum)
+        if not issubclass(enum, gdef.EnumType):
+                continue
+        for enumvalue in enum.values:
+            if match(target, enumvalue.name):
+                print("Enum <{0!r}>".format(enumvalue))
 
 def search_name_in_struct(target):
     for name, struct in meta.structs_walker():
@@ -78,6 +83,13 @@ def search_value(target):
         if target == windef:
             print(repr(windef))
 
+    for name, enum in meta.enums_walker():
+        if not issubclass(enum, gdef.EnumType):
+                continue
+        for enumvalue in enum.values:
+            if target == enumvalue:
+                print("Enum <{0!r}>".format(enumvalue))
+
 parser = argparse.ArgumentParser(prog=__file__)
 parser.add_argument('target', help='The name or value to research in PythonForWindows generated definition')
 res = parser.parse_args()

tests/conftest.py

@@ -30,8 +30,11 @@ else:
                 assert p.bitness == 64
                 return p
     else:
+        # Force creation of AMD64 process on arm system
+        # TODO: also pop an ARM64 process when code works better with it
+        machine = gdef.IMAGE_FILE_MACHINE_AMD64 if windows.system.architecture == gdef.PROCESSOR_ARCHITECTURE_ARM64 else None
         def pop_proc_64(dwCreationFlags=DEFAULT_CREATION_FLAGS):
-            p = windows.utils.create_process(r"C:\Windows\system32\{0}".format(test_binary_name).encode("ascii"), dwCreationFlags=dwCreationFlags, show_windows=True)
+            p = windows.utils.create_process(r"C:\Windows\system32\{0}".format(test_binary_name).encode("ascii"), dwCreationFlags=dwCreationFlags, show_windows=True, machine=machine)
             assert p.bitness == 64
             return p
 
@@ -44,6 +47,9 @@ def generate_pop_and_exit_fixtures(proc_popers, ids=[], dwCreationFlags=DEFAULT_
     def pop_and_exit_process(request):
         proc_poper = request.param
         proc = proc_poper(dwCreationFlags=dwCreationFlags)
+        # Apply manually the xfail marker for a test on x86_on_arm64 for pe64 target (cross-heaven gate)
+        if windows.current_process._is_x86_on_arm64 and proc.bitness == 64:
+            request.applymarker("xfail") # Cross Heaven gate
         time.sleep(0.2) # Give time to the process to load :)
         print("Created {0} ({1}bits) for test".format(proc, proc.bitness))
         yield weakref.proxy(proc)  # provide the fixture value
@@ -103,16 +109,14 @@ class HandleDebugger(object):
         print(self.handles_types(self.get_new_handle()))
 
 
-current_process_hdebugger = HandleDebugger(windows.current_process.pid)
-current_process_hdebugger.refresh_handles()
 
 class NoLeakAssert(AssertionError):
     pass
 
 
-
 @pytest.fixture()
 def check_for_handle_leak(request):
+    current_process_hdebugger = HandleDebugger(windows.current_process.pid)
     x = current_process_hdebugger.refresh_handles()
     yield None
     leaked_handles = current_process_hdebugger.get_new_handle(x)
@@ -161,11 +165,9 @@ def pytest_configure(config):
 @pytest.hookimpl(hookwrapper=True, trylast=True)
 def pytest_runtest_makereport(item, call):
     outcome = yield
-    # print("Make report {0} | {1}".format(item, call))
     if call.when == "teardown" and call.excinfo and type(call.excinfo.value) == NoLeakAssert:
         x = outcome.get_result()
         x.outcome = "failed"
-        # import pdb;pdb.set_trace()
         x.LEAK = call.excinfo.value.args[0]
 
 

tests/pfwtest.py

@@ -21,14 +21,36 @@ windows_64bit_only = pytest.mark.skipif(not is_windows_64_bits, reason="Test for
 
 process_32bit_only = pytest.mark.skipif(not is_process_32_bits, reason="Test for 32bits process only")
 process_64bit_only = pytest.mark.skipif(not is_process_64_bits, reason="Test for 64bits process only")
-process_syswow_only = pytest.mark.skipif(not is_process_syswow, reason="Test for syswow process only")
+process_syswow_only = pytest.mark.skipif((not is_process_syswow) or windows.current_process._is_x86_on_arm64, reason="Test for syswow process only (ARM64 computer not supported)")
 require_admin = pytest.mark.skipif(not is_admin, reason="Test must be launched as admin")
 
+def process_architecture_only(target_archi):
+    return pytest.mark.skipif(windows.current_process.architecture != target_archi,
+                                reason="Test for {0} architecture process only".format(target_archi))
+
+def system_architecture_only(target_archi):
+        return pytest.mark.skipif(windows.system.architecture != target_archi,
+                                reason="Test for {0} architecture system only".format(target_archi))
+
+@pytest.fixture(scope="function")
+def check_cross_heaven_gate_arm64_xfail(request):
+    """Mark test crossing the heaven gate as xfail on x86 to arm64"""
+    if windows.current_process._is_x86_on_arm64:
+        request.applymarker("xfail")
+
+def cross_heaven_gates(tstfunc):
+    tstfunc = pytest.mark.usefixtures("check_cross_heaven_gate_arm64_xfail")(tstfunc)
+    tstfunc = pytest.mark.cross_heaven_gate(tstfunc)
+    return tstfunc
 
 check_for_gc_garbage = pytest.mark.usefixtures("check_for_gc_garbage")
 check_for_handle_leak = pytest.mark.usefixtures("check_for_handle_leak")
 
-test_binary_name = "winver.exe"
+# msiexec.exe is new best choice:
+# - a real process (looking at calc.exe)
+# - GUI and wait for a click to close when no param
+# - Is ARM64CE on arm -> can be exec as AMD64 or ARM64 with `machine`` param
+test_binary_name = "msiexec.exe"
 DEFAULT_CREATION_FLAGS = gdef.CREATE_NEW_CONSOLE
 
 
@@ -57,8 +79,22 @@ def check_injected_python_installed(request):
         pytest.skip("Python {0}b not installed -> skipping test with python injection into {0}b process".format(proc.bitness))
     return None
 
+@pytest.fixture
+def check_dll_injection_target_architecture(request):
+    # Find the process parameter
+    procparams = [argname for argname in request.fixturenames if argname.startswith("proc")]
+    if len(procparams) != 1:
+        raise ValueError("Could not find the fixture name of the injected python")
+    procparam = procparams[0]
+    proc = request.getfixturevalue(procparam)
+    # xfail ARM64 injection as its not implemented
+    if proc.architecture == gdef.IMAGE_FILE_MACHINE_ARM64:
+        request.applymarker("xfail")
 
-python_injection =  pytest.mark.usefixtures("check_injected_python_installed")
+
+
+dll_injection =  pytest.mark.usefixtures("check_dll_injection_target_architecture", "check_cross_heaven_gate_arm64_xfail")
+python_injection =  pytest.mark.usefixtures("check_dll_injection_target_architecture", "check_injected_python_installed", "check_cross_heaven_gate_arm64_xfail")
 
 
 ## P2 VS PY3

tests/test_alpc.py

@@ -15,7 +15,7 @@ def generate_client_server_test(client_function, server_function):
         time.sleep(0.5)
         client_function()
         th.join()
-        return True
+        return
     return generated_test
 
 PORT_NAME = r"\RPC Control\PythonForWindowsTestPort"

tests/test_cpuid.py

@@ -1,6 +1,11 @@
+import pytest
+
 import windows
+import windows.generated_def as gdef
 import windows.native_exec.cpuid
 
 def test_native_exec_cpuid():
+    if windows.current_process.architecture == gdef.IMAGE_FILE_MACHINE_ARM64:
+        pytest.skip("CPUID not testable on ARM64")
     assert windows.native_exec.cpuid.do_cpuid(0)
     assert windows.native_exec.cpuid.get_proc_family_model()

tests/test_crypto.py

@@ -227,7 +227,7 @@ def test_crypt_obj():
     # TODO: Need some better ideas
 
 def test_certificate_from_store():
-    return windows.crypto.CertificateStore.from_system_store("Root")
+    assert windows.crypto.CertificateStore.from_system_store("Root")
 
 
 def test_sign_verify(rawcert, rawpfx):

tests/test_generated_def.py

@@ -156,6 +156,9 @@ def test_HRESULT_FACILITY_macro():
     # RPC_E_INVALID_HEADER(0x80010111)
     assert gdef.HRESULT_FACILITY(gdef.RPC_E_INVALID_HEADER) == gdef.FACILITY_RPC == 1
 
+def test_ProcThreadAttributeValue_results():
+    assert gdef.PROC_THREAD_ATTRIBUTE_PARENT_PROCESS == 0x20000
+    assert gdef.PROC_THREAD_ATTRIBUTE_MACHINE_TYPE   == 0x20019
 
 # typedef struct _DnsRecordFlags
 # {

tests/test_handle.py

@@ -1,13 +1,16 @@
 import windows
 import windows.pipe
 
+from .pfwtest import *
+
+@cross_heaven_gates # windows.system.handles
 def test_handle_process_id():
     handle_with_process = [h for h in windows.system.handles if h.dwProcessId]
     handle = handle_with_process[-1]
     proc = handle.process
     assert proc.pid == handle.dwProcessId == handle.pid
 
-
+@cross_heaven_gates # windows.current_process.handles
 def test_local_handle_type():
     t = windows.current_process.threads[0]
     th = t.handle
@@ -19,8 +22,8 @@ def test_local_handle_type():
 PIPE_NAME = "PFW_Test_handle_Pipe"
 TEST_FILE_FOR_HANDLE = r"C:\Windows\explorer.exe"
 
+@python_injection
 def test_remote_handle_type_and_name(proc32_64):
-    # tmpfile
     proc32_64.execute_python("import windows; import windows.pipe")
     # A filename that a normal process should not have a handle on (to be sur)
     proc32_64.execute_python(r"""f = open(r"{filename}")""".format(filename=TEST_FILE_FOR_HANDLE))

tests/test_injection.py

@@ -10,7 +10,7 @@ import windows
 import windows.generated_def as gdef
 
 from .conftest import pop_proc_32, pop_proc_64
-from .pfwtest import DEFAULT_CREATION_FLAGS
+from .pfwtest import *
 
 @pytest.fixture(params=
     [(pop_proc_32, DEFAULT_CREATION_FLAGS),
@@ -34,17 +34,20 @@ def proc_3264_runsus(request):
     del proc
 
 # Its really the same test as test_process.test_load_library but with suspended process as well
+@dll_injection
 def test_dll_injection(proc_3264_runsus):
     assert (not proc_3264_runsus.peb.Ldr) or ("wintrust.dll" not in [mod.name for mod in proc_3264_runsus.peb.modules])
     modaddr = windows.injection.load_dll_in_remote_process(proc_3264_runsus, "wintrust.dll")
     wintrustmod = [mod for mod in proc_3264_runsus.peb.modules if mod.name == "wintrust.dll"][0]
     assert wintrustmod.baseaddr == modaddr
 
+@dll_injection
 def test_dll_injection_error_reporting(proc_3264_runsus):
     with pytest.raises(windows.injection.InjectionFailedError) as excinfo:
         windows.injection.load_dll_in_remote_process(proc_3264_runsus, "NO_A_DLL.dll")
     assert excinfo.value.__cause__.winerror == gdef.ERROR_MOD_NOT_FOUND
 
+@dll_injection
 def test_dll_injection_access_denied(proc_3264_runsus, tmpdir):
         """Emulate injection of MsStore python, were its DLL are not executable by any other append
         See: https://github.com/hakril/PythonForWindows/issues/72

tests/test_native_utils.py

@@ -8,21 +8,23 @@ from windows.pycompat import basestring, int_types
 
 from .pfwtest import *
 
+
+
 @check_for_gc_garbage
 class TestNativeUtils(object):
-    @process_64bit_only
+    @process_architecture_only(gdef.IMAGE_FILE_MACHINE_AMD64)
     def test_strlenw64(self):
         strlenw64 = windows.native_exec.create_function(nativeutils.StrlenW64.get_code(), [gdef.UINT, gdef.LPCWSTR])
         assert strlenw64("YOLO") == 4
         assert strlenw64("") == 0
 
-    @process_64bit_only
+    @process_architecture_only(gdef.IMAGE_FILE_MACHINE_AMD64)
     def test_strlena64(self):
         strlena64 = windows.native_exec.create_function(nativeutils.StrlenA64.get_code(), [gdef.UINT, gdef.LPCSTR])
         assert strlena64(b"YOLO") == 4
         assert strlena64(b"") == 0
 
-    @process_64bit_only
+    @process_architecture_only(gdef.IMAGE_FILE_MACHINE_AMD64)
     def test_getprocaddr64(self):
         getprocaddr64 = windows.native_exec.create_function(nativeutils.GetProcAddress64.get_code(), [gdef.ULONG64, gdef.LPCWSTR, gdef.LPCSTR])
         k32 = [mod for mod in windows.current_process.peb.modules if mod.name == "kernel32.dll"][0]
@@ -37,19 +39,19 @@ class TestNativeUtils(object):
         assert getprocaddr64("YOLO.DLL", b"whatever") == 0xfffffffffffffffe
         assert getprocaddr64("KERNEL32.DLL", b"YOLOAPI") == 0xffffffffffffffff
 
-    @process_32bit_only
+    @process_architecture_only(gdef.IMAGE_FILE_MACHINE_I386)
     def test_strlenw32(self):
         strlenw32 = windows.native_exec.create_function(nativeutils.StrlenW32.get_code(), [gdef.UINT, gdef.LPCWSTR])
         assert strlenw32("YOLO") == 4
         assert strlenw32("") == 0
 
-    @process_32bit_only
+    @process_architecture_only(gdef.IMAGE_FILE_MACHINE_I386)
     def test_strlena32(self):
         strlena32 = windows.native_exec.create_function(nativeutils.StrlenA32.get_code(), [gdef.UINT, gdef.LPCSTR])
         assert strlena32(b"YOLO") == 4
         assert strlena32(b"") == 0
 
-    @process_32bit_only
+    @process_architecture_only(gdef.IMAGE_FILE_MACHINE_I386)
     def test_getprocaddr32(self):
         getprocaddr32 = windows.native_exec.create_function(nativeutils.GetProcAddress32.get_code(), [gdef.UINT, gdef.LPCWSTR, gdef.LPCSTR])
         k32 = [mod for mod in windows.current_process.peb.modules if mod.name == "kernel32.dll"][0]

tests/test_parse_pe.py

@@ -9,15 +9,26 @@ from .pfwtest import *
 
 @pytest.fixture(params=[None, pop_proc_32, pop_proc_64], ids=["local-pe", "remote-pe32", "remote-pe64"])
 def pe(request):
-    # Pe will be kernelbase.dll
+    # Pe will be kernelbase.dll or kernel32.dll
+    # Cannot hardcode peb.modules[2] as it may be xtajitX.dll on arm64
     if request.param is None:
-        yield windows.current_process.peb.modules[2].pe
+        yield [mod for mod in windows.current_process.peb.modules if mod.name.lower().startswith("kernel")][0].pe
         return
 
     pop_proc = request.param
     proc = pop_proc()
-    time.sleep(0.01)
-    yield proc.peb.modules[2].pe
+
+    for i in range(10):
+        try:
+            time.sleep(0.1)
+            # Pe will be kernelbase.dll or kernel32.dll
+            yield [mod for mod in windows.current_process.peb.modules if mod.name.lower().startswith("kernel")][0].pe
+            break
+        except ValueError:
+            if i == 9:
+                # Last change failed
+                raise
+            continue # PEB.Ldr not ready yet
     proc.exit(0)
 
 PE_DOTNET32_DLL_NAME = "test_pe_dotnet32.dll"
@@ -83,10 +94,7 @@ def test_pe_parsing_strange_optional_header_size(tmp_path, proc32):
     # Also check that section retrieval works (as its position is based on OptionalHeader Size)
     assert set(s.name for s in mod.pe.sections) == {".text", ".data", ".l1"}
 
-
-
-
-#  Make a test from current_process parsing ?
+@dll_injection
 def test_pe_parsing_dotnet32_process_64(proc64, pe_dotnet32):
     # .NET pe32 loadable in 64bit process -> rewrite of the OptionalHeader
     mod = proc64.load_library(pe_dotnet32)
@@ -103,6 +111,7 @@ def test_pe_parsing_dotnet32_process_64(proc64, pe_dotnet32):
     assert mod.pe.sections
     assert ".text" in  set(s.name for s in mod.pe.sections)
 
+@dll_injection
 def test_pe_parsing_dotnet32_current_process_64(proc64, pe_dotnet32):
     # .NET pe32 loadable in 64bit process -> rewrite of the OptionalHeader
     # So we injecte python code in a the remote proc64 to test the parsing from itself
@@ -118,6 +127,27 @@ def test_pe_parsing_dotnet32_current_process_64(proc64, pe_dotnet32):
         assert imported_dlls == ['mscoree.dll']
         assert ".text" in  sections_names
 
+# PE header of Syschpe32\ntdll.dll with a 8 chars sections .hexpthk that broke the parseur
+# This PE as 8 bytes sections name + VirtualSize non aligned on 0x100 so there is a non-null non-ascii byte after the name
+PE_SECTION_8CHARS = b"""
+eJzzjZrAwMzAwMACxP//MzDsYIAABwbC4AMRagYbCHBlYPBhZEYRu8HAxMjNyMnAwMQAwSAgAMUK
+II4DhA2UY4VKw2hwQLFAmBBTFSBqQYQAwig4MECyg4ogAGiuMRZxvQgIuMDIAPcDAxuqGgUGhgS9
+SAjQhgqA1XGgqnNgYDigFwUBYHmYX7gwzHtAmW9GwSgYBfQAnU8b3zAAy4aMr/+BQNTGwIGht0aF
+IwMkF54BKg0yGBQcGAL+izoApTrfHJ4wvMAAB/+AA4/UnJx8hfL8opwUhbSi/FyFRIWAypKM/Dy3
+/KLwzLyU/PJihZLU4hIFUMU5CoYd0DBAsJuAbBsD7OpA7YsEIM4B4goD3GIMDO6pJcElKR6JeSk5
+qSB+eFFmSapbJpgTlJqYAmUyAFOXa0VqMkN2alFeao6xkV5KTg6NPDkKcAIAM7/CEw=="""
+
+def test_pe_parsing_section_8_chars(proc32, tmp_path):
+    pe_path = (tmp_path / "pe_parsing_8chars_section.exe")
+    pe_data = pe_data = zlib.decompress(b64decode(PE_SECTION_8CHARS))
+
+    with pe_path.open("wb") as f:
+        f.write(pe_data)
+
+    mod = proc32.load_library(str(pe_path))
+    # check that section retrieval works
+    assert set(s.name for s in mod.pe.sections) == {u".XXXXXXX", u".YYYYYYY", u".ZZZZZZZ"}
+
 # A "Portable Executable 32 .NET Assembly" DLL
 # Result of compiling a simple hello-world
 # Can be loaded into a 64b process to witness 32 -> 64b PE conversion at load time

tests/test_pipe.py

@@ -33,6 +33,8 @@ with windows.pipe.create("{pipe}") as np:
 
 @python_injection
 def test_pipe_echo_server(proc32_64):
+    # Verify that injection / load of Pfw in remote works with a first safe stub
+    proc32_64.execute_python("import windows")
     t = proc32_64.execute_python_unsafe(rcode_test_echo_pipe.format(pipe=PIPE_NAME))
     time.sleep(0.5)
     assert not t.is_exit
@@ -45,6 +47,8 @@ def test_pipe_echo_server(proc32_64):
 
 @python_injection
 def test_pipe_recv_object(proc32_64):
+    # Verify that injection / load of Pfw in remote works with a first safe stub
+    proc32_64.execute_python("import windows")
     # not the good way to do the exchange (race possible)
     # Just for the sake of the test
     proc32_64.execute_python_unsafe(rcode_test_ipc_pipe.format(pipe=PIPE_NAME))

tests/test_process.py

@@ -25,7 +25,7 @@ class TestCurrentProcessWithCheckGarbage(object):
         assert myself.ppid == windows.current_process.ppid
 
     def test_get_current_process_peb(self):
-        return windows.current_process.peb
+        assert windows.current_process.peb
 
     def test_get_current_process_modules(self):
         # Use module filename because this executable can be:
@@ -195,6 +195,7 @@ class TestProcessWithCheckGarbage(object):
 
     @windows_64bit_only
     def test_execute_to_64(self, proc64):
+        assert proc64.architecture == gdef.IMAGE_FILE_MACHINE_AMD64, "TODO: better machine fixture for ARM64"
         with proc64.allocated_memory(0x1000) as addr:
             shellcode = x64.MultipleInstr()
             shellcode += x64.Mov('RAX', 0x4242424243434343)
@@ -213,6 +214,7 @@ class TestProcessWithCheckGarbage(object):
             dword = proc32_64.read_dword(addr)
             assert dword == 0x42424242
 
+    @python_injection
     def test_execute_python_good_version(self, proc32_64):
         PIPE_NAME = "PFW_TEST_Pipe"
         rcode = r"""import sys; import windows; import windows.pipe; windows.pipe.send_object("{pipe}", list(sys.version_info))"""
@@ -292,6 +294,7 @@ class TestProcessWithCheckGarbage(object):
         # Check the RemotePythonError contains the remote exception text
         assert b"ValueError: EXCEPTION_MESSAGE" in ar.value.args[0]
 
+    @python_injection
     def test_execute_python_create_console(self, proc32_64):
         res = proc32_64.execute_python("import windows; windows.utils.create_console()")
 
@@ -351,6 +354,7 @@ class TestProcessWithCheckGarbage(object):
 
     @windows_64bit_only
     def test_set_thread_context_64(self, proc64):
+        assert proc64.architecture == gdef.IMAGE_FILE_MACHINE_AMD64, "TODO: better machine fixture for ARM64"
         code =  x64.MultipleInstr()
         code += x64.Label(":LOOP")
         code += x64.Jmp(":LOOP")
@@ -368,17 +372,19 @@ class TestProcessWithCheckGarbage(object):
         time.sleep(0.1)
         assert t.exit_code == 0x11223344
 
-
+    @dll_injection
     def test_load_library(self, proc32_64):
         DLL = "wintrust.dll"
         proc32_64.load_library(DLL)
         assert DLL in [m.name for m in proc32_64.peb.modules]
 
+    @dll_injection
     def test_load_library_suspended(self, proc32_64_suspended):
         DLL = "wintrust.dll"
         proc32_64_suspended.load_library(DLL)
         assert DLL in [m.name for m in proc32_64_suspended.peb.modules]
 
+    @dll_injection
     def test_load_library_unicode_name(self, proc32_64, tmpdir):
         mybitness = windows.current_process.bitness
         UNICODE_FILENAME = u'\u4e2d\u56fd\u94f6\u884c\u7f51\u94f6\u52a9\u624b.dll'
@@ -481,10 +487,12 @@ class TestProcessWithCheckGarbage(object):
         # Check type of teb.peb is the correct subclass (with modules & co)
         assert teb.peb.modules
 
+    @cross_heaven_gates
     def test_thread_teb_base(self, proc32_64):
         t = proc32_64.threads[0]
         assert t.teb_base != 0
 
+    @cross_heaven_gates
     def test_teb(self, proc32_64):
         teb = proc32_64.threads[0].teb
         if proc32_64.bitness == 32:
@@ -497,6 +505,7 @@ class TestProcessWithCheckGarbage(object):
         assert teb.peb.modules
 
     @windows_64bit_only
+    @cross_heaven_gates
     def test_thread_teb_syswow_base(self, proc32):
         t = proc32.threads[0]
         assert t.teb_base != 0
@@ -504,6 +513,7 @@ class TestProcessWithCheckGarbage(object):
         assert t.teb_base == t.teb_syswow_base + 0x2000
 
     @windows_64bit_only
+    @cross_heaven_gates
     def test_thread_teb_syswow(self, proc32):
         teb_syswow = proc32.threads[0].teb_syswow
         assert type(teb_syswow) == windows.winobject.process.RemoteTEB64

tests/test_rpc.py

@@ -114,3 +114,46 @@ def test_rpc_uac_call():
     assert proc.pid == pid
     proc.exit(0)
 
+
+class DbgRpcClient(windows.rpc.RPCClient):
+    def __init__(self, *args, **kwargs):
+        super(DbgRpcClient, self).__init__(*args, **kwargs)
+        self.last_response_was_view = False
+
+    def _get_response_effective_data(self, response):
+        self.last_response_was_view = response.view_is_valid
+        return super(DbgRpcClient, self)._get_response_effective_data(response)
+
+
+FIREWALL_RPC_IID = "2fb92682-6599-42dc-ae13-bd2ca89bd11c"
+
+Proc0_RPC_FWOpenPolicyStore = 0
+Proc9_RPC_FWEnumFirewallRules = 9
+
+def test_rpc_response_as_view():
+    """Check that parsing response as view in RPC Client works. Testing after a bug in 32b RPCCLient"""
+    # We test what by using a RPC endpoint that returns a lot of info : forcing a response in a view
+    # In this case we use the Firewall RPC and we list all Firerules.
+    # We use a custom RPCClient subclasse to track if last response was a view
+    client = windows.rpc.find_alpc_endpoint_and_connect(FIREWALL_RPC_IID, sid=gdef.WinLocalSid)
+    client.__class__ = DbgRpcClient
+    iid = client.bind(FIREWALL_RPC_IID)
+
+    # https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-fasp/230d1ae7-b42e-4d9c-b997-b1463aaa0ded
+    # !\x02\x02\x00\x01\x00\x00\x00\x00\x00\x00\x00
+    # Binaryversion : 0x022f
+    # FW_STORE_TYPE_LOCAL
+    # FW_POLICY_ACCESS_RIGHT_READ
+    # Flags = 0
+    resp1 = client.call(iid, Proc0_RPC_FWOpenPolicyStore, params=b"!\x02\x02\x00\x01\x00\x00\x00\x00\x00\x00\x00")
+    rawpolstore = resp1[:20]
+    assert not client.last_response_was_view
+
+    # Proc9_RPC_FWEnumFirewallRules
+    # \x00\x00\x03\x00\xff\xff\xff\x7f\x07\x00
+    # https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-fasp/36cddff4-c427-4863-a58d-3d913a12b221
+    # FW_PROFILE_TYPE_ALL : 0x7FFFFFFF
+    # FW_RULE_STATUS_CLASS_OK +  FW_RULE_STATUS_PARTIALLY_IGNORED = 0x00010000 + 0x00020000
+    # Flags = 7 ?
+    resp2 = client.call(iid, Proc9_RPC_FWEnumFirewallRules, params=rawpolstore + b"\x00\x00\x03\x00\xff\xff\xff\x7f\x07\x00")
+    assert client.last_response_was_view

tests/test_simple_arm64.py

@@ -0,0 +1,211 @@
+try:
+    import capstone
+except ImportError as e:
+    capstone = None
+import pytest
+
+import windows.native_exec.simple_arm64 as arm64
+from windows.native_exec.simple_arm64 import *
+
+from windows.pycompat import int_types
+
+if capstone:
+    disassembleur = capstone.Cs(capstone.CS_ARCH_ARM64, capstone.CS_MODE_ARM)
+    disassembleur.detail = True
+
+@pytest.fixture
+def need_capstone():
+    if capstone is None:
+        raise pytest.skip("Capstone is not installed")
+    return True
+
+pytestmark = pytest.mark.usefixtures("need_capstone")
+
+
+def disas(x):
+    return list(disassembleur.disasm(x, 0))
+
+
+class CheckInstr(object):
+    def __init__(self, instr_to_test, expected_result=None, immediat_accepted=None, must_fail=None, debug=False):
+        self.instr_to_test = instr_to_test
+        self.immediat_accepted = immediat_accepted
+        self.expected_result = expected_result
+        self.must_fail = must_fail
+        self.debug = debug
+        self.callargs = None
+
+
+    def __call__(self, *args):
+        assert args is not None
+        self.callargs = args
+        return self
+
+    def __repr__(self):
+        if self.must_fail:
+            return "MustFail:{0}{1}".format(self.instr_to_test.__name__, self.callargs)
+        return "{0}{1}".format(self.instr_to_test.__name__, self.callargs)
+
+    def dotest(self):
+        assert self.callargs is not None
+        args = self.callargs
+        try:
+            if self.debug:
+                import pdb;pdb.set_trace()
+                pdb.DONE = True
+            arm64.DEBUG = self.debug
+            res = bytes(self.instr_to_test(*args).get_code())
+            if self.debug:
+                print(repr(res))
+        except ValueError as e:
+            if self.must_fail == True:
+                return True
+            else:
+                raise
+        else:
+            if self.must_fail:
+                raise ValueError("Instruction did not failed as expected")
+        capres_list = disas(res)
+        if not capres_list:
+            raise AssertionError("Trying to disas an instruction resulted no disassembled instr")
+        if len(capres_list) != 1:
+            raise AssertionError("Trying to disas an instruction resulted in multiple disassembled instrs: {0}".format(capres_list))
+        capres = capres_list[0]
+        print("{0} {1}".format(capres.mnemonic, capres.op_str))
+        if self.expected_result is not None:
+            if "{0} {1}".format(capres.mnemonic, capres.op_str).strip() == self.expected_result:
+                return True
+            else:
+                raise AssertionError("Expected result <{0}> got <{1}>".format(self.expected_result, "{0} {1}".format(capres.mnemonic, capres.op_str)))
+        if len(res) != len(capres.bytes):
+            print("<{0}> vs <{1}>".format(repr(res), repr(capres.bytes)))
+            raise AssertionError("Not all bytes have been used by the disassembler")
+        self.compare_mnemo(capres)
+        self.compare_args(args, capres)
+        return True
+
+    def compare_mnemo(self, capres):
+        expected = self.instr_to_test.__name__.lower()
+        if expected != capres.mnemonic:
+            raise AssertionError("Expected menmo {0} got {1}".format(expected, str(capres.mnemonic)))
+        return True
+
+    def compare_args(self, args, capres):
+        capres_op = list(capres.operands)
+        # We may have != number of operand as shift are:
+        #    - arguments for simple_arm64
+        #    - atribute of immediat for capstone
+        if not len(capres_op) <= len(args):
+            raise AssertionError("Expected at most {0} operands got {1}".format(len(args), len(capres_op)))
+
+        opargit = iter(args) # allow manually using next() to get next simple_arm64 arg for shift compare
+        # capres_op must be first in zip (as its smaller) or last next(opargit) will be consommed by zip
+        for cap_op, op_args in zip(capres_op, opargit):
+            if isinstance(op_args, str):  # Register
+                if cap_op.type != capstone.arm64.ARM64_OP_REG:
+                    raise AssertionError("Expected args {0} operands got {1}".format(op_args, capres_op))
+                if op_args.lower() != capres.reg_name(cap_op.reg).lower():
+                    raise AssertionError("Expected register <{0}> got {1}".format(op_args.lower(), capres.reg_name(cap_op.reg).lower()))
+            elif isinstance(op_args, int_types):
+                if (op_args != cap_op.imm) and not (self.immediat_accepted and self.immediat_accepted == cap_op.imm):
+                    raise AssertionError("Expected Immediat <{0}> got {1}".format(op_args, cap_op.imm))
+                cap_shift = cap_op.shift
+                if not (cap_shift.type == cap_shift.value == 0):
+                    self.compare_shift(next(opargit), cap_shift)
+            else:
+                raise ValueError("Unknow argument {0} of type {1}".format(op_args, type(op_args)))
+
+        # Check that no argument were unused in args
+        # As args + shift should perfectly match the capres_op
+        sentinel = object()
+        nextarg = next(opargit, sentinel)
+        if nextarg != sentinel:
+            # Ignore a leading LSL #0 shift, as it should be authorized but not displayed by disassembler
+            shift = Shift.parse(nextarg)
+            if not (shift.type == "LSL" and shift.value == 0):
+                raise ValueError("Non consomated argument: {0} (probable non-encoded shift)".format(nextarg))
+
+    if capstone:
+        SHIFT_TYPE_TO_CAPSTONE = {
+            "LSL": capstone.arm64.ARM64_SFT_LSL,
+            "LSR": capstone.arm64.ARM64_SFT_LSR,
+            "ASR": capstone.arm64.ARM64_SFT_ASR,
+            "ROR": capstone.arm64.ARM64_SFT_ROR,
+            # "MSL": apstone.arm64.ARM64_SFT_MSL # Not yet used in PFW
+        }
+
+    def compare_shift(self, shiftstr, cap_shift):
+        shift = Shift.parse(shiftstr)
+        if not self.SHIFT_TYPE_TO_CAPSTONE[shift.type] == cap_shift.type:
+            raise ValueError("Shift type mismatch: expected {0} got {1}".format(shift.type, cap_shift.type))
+        if not shift.value == cap_shift.value:
+            raise ValueError("Shift value mismatch: expected {0} got {1}".format(shift.value, cap_shift.value))
+        return True
+
+
+def test_shift_parsing():
+    assert Shift.parse("LSL #0")
+    assert Shift.parse("LSL #12")
+    assert Shift.parse("LSL #1")
+    assert Shift.parse("LSR #1")
+
+    assert Shift.parse("ROR #0").type == "ROR"
+    assert Shift.parse("LSL #0").type == "LSL"
+    assert Shift.parse("LSL #0").value == 0
+    assert Shift.parse("LSL #1").type == "LSL"
+    assert Shift.parse("LSL #1").value == 1
+
+    assert not Shift.parse("LSX #1")
+    assert not Shift.parse("LSX ##1")
+    assert not Shift.parse("LSX #")
+
+@pytest.mark.parametrize("checkinstr", [
+    CheckInstr(Add)('W0', 'W0', 0),
+    CheckInstr(Add)('W1', 'W0', 0),
+    CheckInstr(Add)('W30', 'W12', 0),
+    CheckInstr(Add)('W0', 'W0', 1),
+    CheckInstr(Add)('X0', 'X0', 0),
+    CheckInstr(Add)('X30', 'X12', 0),
+    CheckInstr(Add)('X0', 'X0', 1),
+    CheckInstr(Add)('X11', 'X12', 0x123),
+    CheckInstr(Add)('X11', 'X12', 0x123, "LSL #0"),
+    CheckInstr(Add)('X11', 'X12', 0x123, "LSL #12"),
+    CheckInstr(Add, must_fail=True)('X11', 'W12', 0x123), # Bitness mismatch
+    CheckInstr(Add, must_fail=True)('BADREG', 'X12', 0),
+    CheckInstr(Add, must_fail=True)('X11', 'X12', 0x123, "LSL #1234"),
+    CheckInstr(Add, must_fail=True)('X11', 'X12', 0x12345678),
+
+    CheckInstr(Movz)('X0', 0),
+    CheckInstr(Movz)('X0', 0, "LSL #32"),
+    CheckInstr(Movz)('X18', 0, "LSL #48"),
+    CheckInstr(Movz)('W18', 0, "LSL #16"),
+    CheckInstr(Movz, must_fail=True)('X0', 0, "LSL #12"), # Invalid LSL for MovWideImmediat
+    CheckInstr(Movz, must_fail=True)('W0', 0, "LSL #32"),
+    CheckInstr(Movz, must_fail=True)('X0', 0, "ROR #32"),
+
+
+    CheckInstr(Orr)('X0', 'X18', 'XZR'),
+    # Official encoding for this in ARM64 ref
+    CheckInstr(Orr, expected_result="mov x0, x18")('X0', 'XZR', 'X18'),
+    CheckInstr(Orr, must_fail=True)('X0', 'WZR', 'X18'), # Size mismatch
+    CheckInstr(Orr, must_fail=True)('W0', 'XZR', 'W18'), # Size mismatch
+
+    CheckInstr(Movk)('X0', 0x1234, "LSL #32"),
+    CheckInstr(Movk)('X18', 0x5678, "LSL #48"),
+
+    CheckInstr(Ret)("X0"),
+    CheckInstr(Ret, expected_result="ret")("X30"),
+    CheckInstr(Ret)(),
+
+    # Virtual instruction that dispatch to something else:
+    # Ex: "mov reg1, re2" -> "orr reg1, xzr, reg2"
+
+    CheckInstr(Mov)('X0', 'X18'),
+    CheckInstr(Mov)('W0', 'W18'),
+    CheckInstr(Mov, must_fail=True)('X0', 'W18'),
+    CheckInstr(Mov, must_fail=True)('X0', 'X18', 'X12'),
+
+
+], ids=CheckInstr.__repr__)
+def test_instruction_assembling(checkinstr):
+    assert checkinstr.dotest()

tests/test_system.py

@@ -51,6 +51,7 @@ class TestSystemWithCheckGarbage(object):
     def test_wmi(self):
         assert windows.system.wmi is not None
 
+    @cross_heaven_gates
     def test_handles(self):
         assert windows.system.handles
 
@@ -66,6 +67,7 @@ class TestSystemWithCheckGarbage(object):
     def test_task_object_manager(self):
         assert windows.system.object_manager
 
+    @cross_heaven_gates
     def test_system_modules_ntosk(self):
         # NtQuerySystemInformation(gdef.SystemModuleInformation) returns CHAR so not unicode
         # Another Nt API that returns unicode ?
@@ -83,6 +85,7 @@ class TestSystemWithCheckGarbageAndHandleLeak(object):
         assert windows.current_process.pid in [p.pid for p in procs]
         assert is_unicode(windows.system.processes[0].name)
 
+    @cross_heaven_gates
     def test_system_modules(self):
         assert windows.system.modules
 

tests/test_system_modules.py

@@ -1,6 +1,9 @@
 import windows
 import ctypes
 
+from .pfwtest import *
+
+@cross_heaven_gates
 def test_system_module_gc():
     # Test for issue 12 (Py3)
     # https://github.com/hakril/PythonForWindows/issues/12

tests/test_syswow.py

@@ -1,6 +1,8 @@
-import pytest
+import time
 import textwrap
 
+import pytest
+
 import windows
 import windows.generated_def as gdef
 import windows.native_exec.simple_x86 as x86
@@ -8,8 +10,28 @@ import windows.native_exec.simple_x64 as x64
 
 from .pfwtest import *
 
-pytestmark = pytest.mark.usefixtures('check_for_gc_garbage')
+# pytestmark = pytest.mark.usefixtures('check_for_gc_garbage')
 
+def test_print_syswow_state():
+    import platform
+    print("")
+    env = windows.system.environ
+    print("platform.machine()={0}".format(platform.machine()))
+    print("platform.architecture()={0}".format(platform.architecture()))
+    print("windows.system.bitness={0}".format(windows.system.bitness))
+    print("windows.system.architecture={0}".format(windows.system.architecture))
+    print("windows.current_process.bitness={0}".format(windows.current_process.bitness))
+    print("windows.current_process.architecture={0}".format(windows.current_process.architecture))
+    print("env['PROCESSOR_ARCHITECTURE']={0}".format(env['PROCESSOR_ARCHITECTURE']))
+    print("env.get('PROCESSOR_ARCHITEW6432')={0}".format(env.get('PROCESSOR_ARCHITEW6432')))
+
+    print("")
+    print("IsWow64Process2")
+    processMachine = gdef.USHORT()
+    nativeMachine = gdef.USHORT()
+    windows.winproxy.IsWow64Process2(windows.current_process.handle, processMachine, nativeMachine)
+    print("hex(processMachine.value)={0}".format(hex(processMachine.value)))
+    print("hex(nativeMachine.value)={0}".format(hex(nativeMachine.value)))
 
 
 @process_syswow_only
@@ -30,6 +52,7 @@ class TestSyswowCurrentProcess(object):
 @python_injection
 @windows_64bit_only
 class TestSyswowRemoteProcess(object):
+    @cross_heaven_gates
     def test_remote_pebsyswow(self, proc32):
         peb64 = proc32.peb_syswow
         modules_names = [m.name for m in peb64.modules]
@@ -39,6 +62,7 @@ class TestSyswowRemoteProcess(object):
         assert "Wow64LdrpInitialize" in wow64.pe.exports
 
 
+    @system_architecture_only(gdef.PROCESSOR_ARCHITECTURE_AMD64)
     def test_getset_syswow_context(self, proc32):
         addr = proc32.virtual_alloc(0x1000)
         remote_python_code = """
@@ -49,6 +73,8 @@ class TestSyswowRemoteProcess(object):
         windows.current_process.write_qword({0},  res)
         """.format(addr)
 
+        # Execute the import safely so that the test will not hang if import fails
+        proc32.execute_python("import windows")
         t = proc32.execute_python_unsafe(textwrap.dedent(remote_python_code))
         # Wait for python execution
         while proc32.read_qword(addr) != 0x8877665544332211:
@@ -85,7 +111,6 @@ def loop_query_ppid(proc, target_ppid):
                 assert proc.read_memory(i.BaseAddress, 0x1000)
             # assert False, "LOL"
     except Exception as e:
-        # import traceback; traceback.print(
         threads_error[windows.current_thread.tid] = e
         raise
     return True
@@ -99,6 +124,7 @@ def test_syswow_call_multithread():
     # Old version of PFW did not handled that thus generating invalid result / crash
     for tnb in range(10):
         new_proc = windows.test.pop_proc_64()
+        time.sleep(0.1)
         new_proc_pid = new_proc.ppid
         all_procs.append(new_proc)
         t = threading.Thread(target=loop_query_ppid, args=(new_proc, new_proc_pid))

tests/test_wmi.py

@@ -75,6 +75,7 @@ def test_get_object(name, cls):
 # Todo: test
 #   - put_instance
 
+@cross_heaven_gates # proc.peb.commandline.str == cmdline
 @pytest.mark.parametrize("cmdline", [r"winver.exe test_string_pfw"])
 def test_exec_method_Win32_Process_create(cmdline):
     namespace = windows.system.wmi["root\\cimv2"]

windows/debug/symbols.py

@@ -177,6 +177,10 @@ class SymbolType(object):
             windows.winproxy.LocalFree(res)
         return newres
 
+    @property
+    def module(self):
+        return self.resolver.get_module(self.modbase)
+
     @property
     def name(self):
         return self._get_type_info(gdef.TI_GET_SYMNAME)

windows/generated_def/__init__.py

@@ -67,5 +67,57 @@ from .winfuncs import *
 from .windef import *
 from .interfaces import *
 
+# Define custom Flag mappers for define list that should be enums
 
+PROCESSOR_ARCHITECTURE_MAPPER = FlagMapper(
+    PROCESSOR_ARCHITECTURE_INTEL,
+    PROCESSOR_ARCHITECTURE_MIPS,
+    PROCESSOR_ARCHITECTURE_ALPHA,
+    PROCESSOR_ARCHITECTURE_PPC,
+    PROCESSOR_ARCHITECTURE_SHX,
+    PROCESSOR_ARCHITECTURE_ARM,
+    PROCESSOR_ARCHITECTURE_IA64,
+    PROCESSOR_ARCHITECTURE_ALPHA64,
+    PROCESSOR_ARCHITECTURE_MSIL,
+    PROCESSOR_ARCHITECTURE_AMD64,
+    PROCESSOR_ARCHITECTURE_IA32_ON_WIN64,
+    PROCESSOR_ARCHITECTURE_NEUTRAL,
+    PROCESSOR_ARCHITECTURE_ARM64,
+    PROCESSOR_ARCHITECTURE_ARM32_ON_WIN64,
+    PROCESSOR_ARCHITECTURE_UNKNOWN,
+    IMAGE_FILE_MACHINE_TARGET_HOST
+)
+
+IMAGE_FILE_MACHINE_MAPPER = FlagMapper(
+    IMAGE_FILE_MACHINE_UNKNOWN,
+    IMAGE_FILE_MACHINE_I386,
+    IMAGE_FILE_MACHINE_R3000,
+    IMAGE_FILE_MACHINE_R4000,
+    IMAGE_FILE_MACHINE_R10000,
+    IMAGE_FILE_MACHINE_WCEMIPSV2,
+    IMAGE_FILE_MACHINE_ALPHA,
+    IMAGE_FILE_MACHINE_SH3,
+    IMAGE_FILE_MACHINE_SH3DSP,
+    IMAGE_FILE_MACHINE_SH3E,
+    IMAGE_FILE_MACHINE_SH4,
+    IMAGE_FILE_MACHINE_SH5,
+    IMAGE_FILE_MACHINE_ARM,
+    IMAGE_FILE_MACHINE_THUMB,
+    IMAGE_FILE_MACHINE_ARMNT,
+    IMAGE_FILE_MACHINE_AM33,
+    IMAGE_FILE_MACHINE_POWERPC,
+    IMAGE_FILE_MACHINE_POWERPCFP,
+    IMAGE_FILE_MACHINE_IA64,
+    IMAGE_FILE_MACHINE_MIPS16,
+    IMAGE_FILE_MACHINE_ALPHA64,
+    IMAGE_FILE_MACHINE_MIPSFPU,
+    IMAGE_FILE_MACHINE_MIPSFPU16,
+    IMAGE_FILE_MACHINE_TRICORE,
+    IMAGE_FILE_MACHINE_CEF,
+    IMAGE_FILE_MACHINE_EBC,
+    IMAGE_FILE_MACHINE_AMD64,
+    IMAGE_FILE_MACHINE_M32R,
+    IMAGE_FILE_MACHINE_CEE,
+    IMAGE_FILE_MACHINE_ARM64
+)
 

windows/generated_def/meta.py

@@ -191,6 +191,8 @@ windef = {'ABOVE_NORMAL_PRIORITY_CLASS',
 'API_SET_SCHEMA_VERSION_V3',
 'API_SET_SCHEMA_VERSION_V4',
 'APPLICATION_ERROR_MASK',
+'ARM64_MAX_BREAKPOINTS',
+'ARM64_MAX_WATCHPOINTS',
 'ASYNC_MODE_COMPATIBILITY',
 'ASYNC_MODE_DEFAULT',
 'ATM_ADDR_SIZE',
@@ -661,6 +663,11 @@ windef = {'ABOVE_NORMAL_PRIORITY_CLASS',
 'CONTEXT_AMD64',
 'CONTEXT_ARM',
 'CONTEXT_ARM64',
+'CONTEXT_ARM64_CONTROL',
+'CONTEXT_ARM64_DEBUG_REGISTERS',
+'CONTEXT_ARM64_FLOATING_POINT',
+'CONTEXT_ARM64_INTEGER',
+'CONTEXT_ARM64_X18',
 'CONTEXT_CONTROL',
 'CONTEXT_DEBUG_REGISTERS',
 'CONTEXT_EXTENDED_REGISTERS',
@@ -668,8 +675,12 @@ windef = {'ABOVE_NORMAL_PRIORITY_CLASS',
 'CONTEXT_FULL',
 'CONTEXT_I386',
 'CONTEXT_INTEGER',
+'CONTEXT_RET_TO_GUEST',
 'CONTEXT_SEGMENTS',
+'CONTEXT_UNWOUND_TO_CALL',
 'CONTEXT_XSTATE',
+'CONTEXT_i386',
+'CONTEXT_i486',
 'CONTROL_C_EXIT',
 'CREATE_ALWAYS',
 'CREATE_BREAKAWAY_FROM_JOB',
@@ -1722,6 +1733,7 @@ windef = {'ABOVE_NORMAL_PRIORITY_CLASS',
 'IMAGE_FILE_MACHINE_SH3E',
 'IMAGE_FILE_MACHINE_SH4',
 'IMAGE_FILE_MACHINE_SH5',
+'IMAGE_FILE_MACHINE_TARGET_HOST',
 'IMAGE_FILE_MACHINE_THUMB',
 'IMAGE_FILE_MACHINE_TRICORE',
 'IMAGE_FILE_MACHINE_UNKNOWN',
@@ -2421,7 +2433,44 @@ windef = {'ABOVE_NORMAL_PRIORITY_CLASS',
 'PRIORITY_BIT',
 'PRIORITY_EQUAL_FIRST',
 'PRIORITY_EQUAL_LAST',
+'PROCESSOR_ALPHA_21064',
+'PROCESSOR_ARCHITECTURE_ALPHA',
+'PROCESSOR_ARCHITECTURE_ALPHA64',
+'PROCESSOR_ARCHITECTURE_AMD64',
+'PROCESSOR_ARCHITECTURE_ARM',
+'PROCESSOR_ARCHITECTURE_ARM32_ON_WIN64',
+'PROCESSOR_ARCHITECTURE_ARM64',
+'PROCESSOR_ARCHITECTURE_IA32_ON_WIN64',
+'PROCESSOR_ARCHITECTURE_IA64',
+'PROCESSOR_ARCHITECTURE_INTEL',
+'PROCESSOR_ARCHITECTURE_MIPS',
+'PROCESSOR_ARCHITECTURE_MSIL',
+'PROCESSOR_ARCHITECTURE_NEUTRAL',
+'PROCESSOR_ARCHITECTURE_PPC',
+'PROCESSOR_ARCHITECTURE_SHX',
+'PROCESSOR_ARCHITECTURE_UNKNOWN',
+'PROCESSOR_ARM720',
+'PROCESSOR_ARM820',
+'PROCESSOR_ARM920',
+'PROCESSOR_ARM_7TDMI',
 'PROCESSOR_FEATURE_MAX',
+'PROCESSOR_HITACHI_SH3',
+'PROCESSOR_HITACHI_SH3E',
+'PROCESSOR_HITACHI_SH4',
+'PROCESSOR_INTEL_386',
+'PROCESSOR_INTEL_486',
+'PROCESSOR_INTEL_IA64',
+'PROCESSOR_INTEL_PENTIUM',
+'PROCESSOR_MIPS_R4000',
+'PROCESSOR_MOTOROLA_821',
+'PROCESSOR_OPTIL',
+'PROCESSOR_PPC_601',
+'PROCESSOR_PPC_603',
+'PROCESSOR_PPC_604',
+'PROCESSOR_PPC_620',
+'PROCESSOR_SHx_SH3',
+'PROCESSOR_SHx_SH4',
+'PROCESSOR_STRONGARM',
 'PROCESS_ALL_ACCESS',
 'PROCESS_CREATE_PROCESS',
 'PROCESS_CREATE_THREAD',
@@ -2443,6 +2492,23 @@ windef = {'ABOVE_NORMAL_PRIORITY_CLASS',
 'PROCESS_VM_OPERATION',
 'PROCESS_VM_READ',
 'PROCESS_VM_WRITE',
+'PROC_THREAD_ATTRIBUTE_ADDITIVE',
+'PROC_THREAD_ATTRIBUTE_ENABLE_OPTIONAL_XSTATE_FEATURES',
+'PROC_THREAD_ATTRIBUTE_GROUP_AFFINITY',
+'PROC_THREAD_ATTRIBUTE_HANDLE_LIST',
+'PROC_THREAD_ATTRIBUTE_IDEAL_PROCESSOR',
+'PROC_THREAD_ATTRIBUTE_INPUT',
+'PROC_THREAD_ATTRIBUTE_MACHINE_TYPE',
+'PROC_THREAD_ATTRIBUTE_MITIGATION_POLICY',
+'PROC_THREAD_ATTRIBUTE_NUMBER',
+'PROC_THREAD_ATTRIBUTE_PARENT_PROCESS',
+'PROC_THREAD_ATTRIBUTE_PREFERRED_NODE',
+'PROC_THREAD_ATTRIBUTE_PROTECTION_LEVEL',
+'PROC_THREAD_ATTRIBUTE_PSEUDOCONSOLE',
+'PROC_THREAD_ATTRIBUTE_SECURITY_CAPABILITIES',
+'PROC_THREAD_ATTRIBUTE_SVE_VECTOR_LENGTH',
+'PROC_THREAD_ATTRIBUTE_THREAD',
+'PROC_THREAD_ATTRIBUTE_UMS_THREAD',
 'PRODUCT_BUSINESS',
 'PRODUCT_BUSINESS_N',
 'PRODUCT_CLUSTER_SERVER',
@@ -2552,6 +2618,35 @@ windef = {'ABOVE_NORMAL_PRIORITY_CLASS',
 'PROV_RSA_SIG',
 'PROV_SPYRUS_LYNKS',
 'PROV_SSL',
+'ProcThreadAttributeAllApplicationPackagesPolicy',
+'ProcThreadAttributeBnoIsolation',
+'ProcThreadAttributeChildProcessPolicy',
+'ProcThreadAttributeComponentFilter',
+'ProcThreadAttributeConsoleReference',
+'ProcThreadAttributeCreateStore',
+'ProcThreadAttributeDesktopAppPolicy',
+'ProcThreadAttributeEnableOptionalXStateFeatures',
+'ProcThreadAttributeExtendedFlags',
+'ProcThreadAttributeGroupAffinity',
+'ProcThreadAttributeHandleList',
+'ProcThreadAttributeIdealProcessor',
+'ProcThreadAttributeIsolationManifest',
+'ProcThreadAttributeJobList',
+'ProcThreadAttributeMachineType',
+'ProcThreadAttributeMitigationAuditPolicy',
+'ProcThreadAttributeMitigationPolicy',
+'ProcThreadAttributeOsMaxVersionTested',
+'ProcThreadAttributePackageFullName',
+'ProcThreadAttributeParentProcess',
+'ProcThreadAttributePreferredNode',
+'ProcThreadAttributeProtectionLevel',
+'ProcThreadAttributePseudoConsole',
+'ProcThreadAttributeSafeOpenPromptOriginClaim',
+'ProcThreadAttributeSecurityCapabilities',
+'ProcThreadAttributeSveVectorLength',
+'ProcThreadAttributeTrustedApp',
+'ProcThreadAttributeUmsThread',
+'ProcThreadAttributeWin32kFilter',
 'READ_CONTROL',
 'REALTIME_PRIORITY_CLASS',
 'REG_BINARY',
@@ -3197,6 +3292,21 @@ windef = {'ABOVE_NORMAL_PRIORITY_CLASS',
 'WIN_CERT_TYPE_RESERVED_1',
 'WIN_CERT_TYPE_TS_STACK_SIGNED',
 'WIN_CERT_TYPE_X509',
+'WOW64_CONTEXT_ALL',
+'WOW64_CONTEXT_CONTROL',
+'WOW64_CONTEXT_DEBUG_REGISTERS',
+'WOW64_CONTEXT_EXCEPTION_ACTIVE',
+'WOW64_CONTEXT_EXCEPTION_REPORTING',
+'WOW64_CONTEXT_EXCEPTION_REQUEST',
+'WOW64_CONTEXT_EXTENDED_REGISTERS',
+'WOW64_CONTEXT_FLOATING_POINT',
+'WOW64_CONTEXT_FULL',
+'WOW64_CONTEXT_INTEGER',
+'WOW64_CONTEXT_SEGMENTS',
+'WOW64_CONTEXT_SERVICE_ACTIVE',
+'WOW64_CONTEXT_XSTATE',
+'WOW64_CONTEXT_i386',
+'WOW64_CONTEXT_i486',
 'WOW64_MAXIMUM_SUPPORTED_EXTENSION',
 'WOW64_SIZE_OF_80387_REGISTERS',
 'WRITE_DAC',
@@ -12173,6 +12283,8 @@ structs = {'ACCESS_ALLOWED_ACE',
 'API_SET_VALUE_ARRAY_V4',
 'API_SET_VALUE_ENTRY',
 'API_SET_VALUE_ENTRY_V2',
+'ARM64_NT_CONTEXT',
+'ARM64_NT_NEON128',
 'ARRAYDESC',
 'ATTACH_VIRTUAL_DISK_PARAMETERS',
 'BG_AUTH_CREDENTIALS',
@@ -12641,6 +12753,7 @@ structs = {'ACCESS_ALLOWED_ACE',
 'LPSTARTUPINFOEXW',
 'LPSTARTUPINFOW',
 'LPSYSTEMTIME',
+'LPSYSTEM_INFO',
 'LPTHREADENTRY32',
 'LPTIME_ZONE_INFORMATION',
 'LPTLIBATTR',
@@ -12802,6 +12915,8 @@ structs = {'ACCESS_ALLOWED_ACE',
 'PAPI_SET_VALUE_ENTRY_V2',
 'PARAMDESC',
 'PARAMDESCEX',
+'PARM64_NT_CONTEXT',
+'PARM64_NT_NEON128',
 'PATTACH_VIRTUAL_DISK_PARAMETERS',
 'PBITMAP',
 'PBITMAPCOREHEADER',
@@ -13238,6 +13353,7 @@ structs = {'ACCESS_ALLOWED_ACE',
 'PROCESS_BASIC_INFORMATION',
 'PROCESS_INFORMATION',
 'PROCESS_INSTRUMENTATION_CALLBACK_INFORMATION',
+'PROCESS_MACHINE_INFORMATION',
 'PROCESS_MEMORY_COUNTERS',
 'PROCESS_MEMORY_COUNTERS_EX',
 'PROCESS_MITIGATION_ASLR_POLICY',
@@ -13459,6 +13575,7 @@ structs = {'ACCESS_ALLOWED_ACE',
 'SYSTEM_HANDLE64',
 'SYSTEM_HANDLE_INFORMATION',
 'SYSTEM_HANDLE_INFORMATION64',
+'SYSTEM_INFO',
 'SYSTEM_MANDATORY_LABEL_ACE',
 'SYSTEM_MODULE32',
 'SYSTEM_MODULE64',
@@ -13483,8 +13600,6 @@ structs = {'ACCESS_ALLOWED_ACE',
 'TMPUNION_CMSG_MAIL_LIST_RECIPIENT_ENCODE_INFO',
 'TMP_CERT_STRONG_SIGN_PARA_UNION_TYPE',
 'TMP_CMSG_RECIPIENT_ENCODE_INFO_UNION',
-'TMP_CONTEXT64_SUBUNION',
-'TMP_DUMMYSTRUCTNAME',
 'TMP_SPC_LINK_UNION',
 'TMP_TYPEDESC_UNION',
 'TMP_UNION_DEBUG_INFO',
@@ -13625,6 +13740,8 @@ structs = {'ACCESS_ALLOWED_ACE',
 '_API_SET_VALUE_ARRAY_V4',
 '_API_SET_VALUE_ENTRY',
 '_API_SET_VALUE_ENTRY_V2',
+'_ARM64_NT_CONTEXT',
+'_ARM64_NT_NEON128',
 '_ATTACH_VIRTUAL_DISK_PARAMETERS',
 '_BG_FILE_INFO',
 '_BG_FILE_PROGRESS',
@@ -13958,6 +14075,7 @@ structs = {'ACCESS_ALLOWED_ACE',
 '_PROCESS_BASIC_INFORMATION',
 '_PROCESS_INFORMATION',
 '_PROCESS_INSTRUMENTATION_CALLBACK_INFORMATION',
+'_PROCESS_MACHINE_INFORMATION',
 '_PROCESS_MEMORY_COUNTERS',
 '_PROCESS_MEMORY_COUNTERS_EX',
 '_PROCESS_MITIGATION_ASLR_POLICY',
@@ -14038,6 +14156,7 @@ structs = {'ACCESS_ALLOWED_ACE',
 '_SYSTEM_HANDLE64',
 '_SYSTEM_HANDLE_INFORMATION',
 '_SYSTEM_HANDLE_INFORMATION64',
+'_SYSTEM_INFO',
 '_SYSTEM_MANDATORY_LABEL_ACE',
 '_SYSTEM_MODULE32',
 '_SYSTEM_MODULE64',
@@ -14059,8 +14178,6 @@ structs = {'ACCESS_ALLOWED_ACE',
 '_TMPUNION_CMSG_KEY_AGREE_RECIPIENT_ENCODE_INFO',
 '_TMPUNION_CMSG_MAIL_LIST_RECIPIENT_ENCODE_INFO',
 '_TMP_CMSG_RECIPIENT_ENCODE_INFO_UNION',
-'_TMP_CONTEXT64_SUBUNION',
-'_TMP_DUMMYSTRUCTNAME',
 '_TMP_SPC_LINK_UNION',
 '_TMP_TYPEDESC_UNION',
 '_TMP_UNION_DEBUG_INFO',
@@ -14261,6 +14378,7 @@ enums = {'ACCESS_MODE',
 'KEY_INFORMATION_CLASS',
 'KEY_VALUE_INFORMATION_CLASS',
 'LocalServerType',
+'MACHINE_ATTRIBUTES',
 'MEMORY_INFORMATION_CLASS',
 'MEM_EXTENDED_PARAMETER_TYPE',
 'MIB_TCP_STATE',
@@ -14295,7 +14413,9 @@ enums = {'ACCESS_MODE',
 'PPROCESS_MITIGATION_POLICY',
 'PREAD_DIRECTORY_NOTIFY_INFORMATION_CLASS',
 'PROCESSINFOCLASS',
+'PROCESS_INFORMATION_CLASS',
 'PROCESS_MITIGATION_POLICY',
+'PROC_THREAD_ATTRIBUTE_NUM',
 'PSECURITY_IMPERSONATION_LEVEL',
 'PSID_NAME_USE',
 'PTHREAD_INFORMATION_CLASS',
@@ -14394,6 +14514,7 @@ enums = {'ACCESS_MODE',
 '_IO_PRIORITY_HINT',
 '_KEY_INFORMATION_CLASS',
 '_KEY_VALUE_INFORMATION_CLASS',
+'_MACHINE_ATTRIBUTES',
 '_MEMORY_INFORMATION_CLASS',
 '_MIB_TCP_STATE',
 '_MULTIPLE_TRUSTEE_OPERATION',
@@ -14404,7 +14525,9 @@ enums = {'ACCESS_MODE',
 '_POLICY_INFORMATION_CLASS',
 '_POLICY_LSA_SERVER_ROLE',
 '_PROCESSINFOCLASS',
+'_PROCESS_INFORMATION_CLASS',
 '_PROCESS_MITIGATION_POLICY',
+'_PROC_THREAD_ATTRIBUTE_NUM',
 '_READ_DIRECTORY_NOTIFY_INFORMATION_CLASS',
 '_RTL_PATH_TYPE',
 '_SC_ENUM_TYPE',
@@ -14585,6 +14708,7 @@ functions = {'AccessCheck',
 'CreateProcessAsUserW',
 'CreateProcessW',
 'CreateRemoteThread',
+'CreateRemoteThreadEx',
 'CreateServiceA',
 'CreateServiceW',
 'CreateStreamOnHGlobal',
@@ -14803,6 +14927,7 @@ functions = {'AccessCheck',
 'GetModuleHandleW',
 'GetNamedSecurityInfoA',
 'GetNamedSecurityInfoW',
+'GetNativeSystemInfo',
 'GetNumberOfEventLogRecords',
 'GetOverlappedResult',
 'GetParent',
@@ -14813,6 +14938,7 @@ functions = {'AccessCheck',
 'GetProcessId',
 'GetProcessImageFileNameA',
 'GetProcessImageFileNameW',
+'GetProcessInformation',
 'GetProcessMemoryInfo',
 'GetProcessMitigationPolicy',
 'GetProcessTimes',
@@ -14839,10 +14965,15 @@ functions = {'AccessCheck',
 'GetSidSubAuthorityCount',
 'GetStdHandle',
 'GetStringConditionFromBinary',
+'GetSystemInfo',
 'GetSystemMetrics',
 'GetSystemTime',
 'GetSystemTimeAsFileTime',
 'GetSystemTimes',
+'GetSystemWow64Directory2A',
+'GetSystemWow64Directory2W',
+'GetSystemWow64DirectoryA',
+'GetSystemWow64DirectoryW',
 'GetThreadContext',
 'GetThreadId',
 'GetTickCount',
@@ -14901,6 +15032,9 @@ functions = {'AccessCheck',
 'IsDebuggerPresent',
 'IsOS',
 'IsValidSecurityDescriptor',
+'IsWow64GuestMachineSupported',
+'IsWow64Process',
+'IsWow64Process2',
 'LdrLoadDll',
 'LoadLibraryA',
 'LoadLibraryExA',
@@ -15150,6 +15284,7 @@ functions = {'AccessCheck',
 'SetNamedSecurityInfoA',
 'SetNamedSecurityInfoW',
 'SetPriorityClass',
+'SetProcessInformation',
 'SetProcessMitigationPolicy',
 'SetSecurityDescriptorDacl',
 'SetSecurityDescriptorOwner',
@@ -15304,6 +15439,8 @@ functions = {'AccessCheck',
 'Wow64GetThreadContext',
 'Wow64RevertWow64FsRedirection',
 'Wow64SetThreadContext',
+'Wow64SetThreadDefaultGuestMachine',
+'Wow64SuspendThread',
 'WriteFile',
 'WriteProcessMemory',
 'ZwDuplicateObject',

windows/generated_def/windef.py

@@ -24,6 +24,22 @@ def CTL_CODE(DeviceType, Function, Method, Access):
 
 def HRESULT_FACILITY(hr):
     return (((hr) >> 16) & 0x1fff)
+
+# https://github.com/microsoft/win32metadata/blob/6af96d8470751e13a4e3f579f84b7b8b3ca398e1/generation/WinSDK/RecompiledIdlHeaders/um/WinBase.h#L3562
+# Original MACRO:
+
+#define ProcThreadAttributeValue(Number, Thread, Input, Additive) \
+#      (((Number) & PROC_THREAD_ATTRIBUTE_NUMBER) | \
+#       ((Thread != FALSE) ? PROC_THREAD_ATTRIBUTE_THREAD : 0) | \
+#       ((Input != FALSE) ? PROC_THREAD_ATTRIBUTE_INPUT : 0) | \
+#       ((Additive != FALSE) ? PROC_THREAD_ATTRIBUTE_ADDITIVE : 0))
+
+def ProcThreadAttributeValue(Number, Thread, Input, Additive):
+    return ((Number & PROC_THREAD_ATTRIBUTE_NUMBER) |
+             (Thread and PROC_THREAD_ATTRIBUTE_THREAD) |
+             (Input and PROC_THREAD_ATTRIBUTE_INPUT) |
+             (Additive and PROC_THREAD_ATTRIBUTE_ADDITIVE))
+
 from .ntstatus import *
 from .winerror import *
 BG_JOB_ENUM_ALL_USERS = make_flag("BG_JOB_ENUM_ALL_USERS", 0x0001)
@@ -1169,6 +1185,89 @@ PIPE_UNLIMITED_INSTANCES = make_flag("PIPE_UNLIMITED_INSTANCES", 255)
 NMPWAIT_WAIT_FOREVER = make_flag("NMPWAIT_WAIT_FOREVER", 0xffffffff)
 NMPWAIT_NOWAIT = make_flag("NMPWAIT_NOWAIT", 0x00000001)
 NMPWAIT_USE_DEFAULT_WAIT = make_flag("NMPWAIT_USE_DEFAULT_WAIT", 0x00000000)
+ProcThreadAttributeParentProcess = make_flag("ProcThreadAttributeParentProcess", 0)
+ProcThreadAttributeExtendedFlags = make_flag("ProcThreadAttributeExtendedFlags", 1)
+ProcThreadAttributeHandleList = make_flag("ProcThreadAttributeHandleList", 2)
+ProcThreadAttributeGroupAffinity = make_flag("ProcThreadAttributeGroupAffinity", 3)
+ProcThreadAttributePreferredNode = make_flag("ProcThreadAttributePreferredNode", 4)
+ProcThreadAttributeIdealProcessor = make_flag("ProcThreadAttributeIdealProcessor", 5)
+ProcThreadAttributeUmsThread = make_flag("ProcThreadAttributeUmsThread", 6)
+ProcThreadAttributeMitigationPolicy = make_flag("ProcThreadAttributeMitigationPolicy", 7)
+ProcThreadAttributePackageFullName = make_flag("ProcThreadAttributePackageFullName", 8)
+ProcThreadAttributeSecurityCapabilities = make_flag("ProcThreadAttributeSecurityCapabilities", 9)
+ProcThreadAttributeConsoleReference = make_flag("ProcThreadAttributeConsoleReference", 10)
+ProcThreadAttributeProtectionLevel = make_flag("ProcThreadAttributeProtectionLevel", 11)
+ProcThreadAttributeOsMaxVersionTested = make_flag("ProcThreadAttributeOsMaxVersionTested", 12)
+ProcThreadAttributeJobList = make_flag("ProcThreadAttributeJobList", 13)
+ProcThreadAttributeChildProcessPolicy = make_flag("ProcThreadAttributeChildProcessPolicy", 14)
+ProcThreadAttributeAllApplicationPackagesPolicy = make_flag("ProcThreadAttributeAllApplicationPackagesPolicy", 15)
+ProcThreadAttributeWin32kFilter = make_flag("ProcThreadAttributeWin32kFilter", 16)
+ProcThreadAttributeSafeOpenPromptOriginClaim = make_flag("ProcThreadAttributeSafeOpenPromptOriginClaim", 17)
+ProcThreadAttributeDesktopAppPolicy = make_flag("ProcThreadAttributeDesktopAppPolicy", 18)
+ProcThreadAttributeBnoIsolation = make_flag("ProcThreadAttributeBnoIsolation", 19)
+ProcThreadAttributePseudoConsole = make_flag("ProcThreadAttributePseudoConsole", 22)
+ProcThreadAttributeIsolationManifest = make_flag("ProcThreadAttributeIsolationManifest", 23)
+ProcThreadAttributeMitigationAuditPolicy = make_flag("ProcThreadAttributeMitigationAuditPolicy", 24)
+ProcThreadAttributeMachineType = make_flag("ProcThreadAttributeMachineType", 25)
+ProcThreadAttributeComponentFilter = make_flag("ProcThreadAttributeComponentFilter", 26)
+ProcThreadAttributeEnableOptionalXStateFeatures = make_flag("ProcThreadAttributeEnableOptionalXStateFeatures", 27)
+ProcThreadAttributeCreateStore = make_flag("ProcThreadAttributeCreateStore", 28)
+ProcThreadAttributeTrustedApp = make_flag("ProcThreadAttributeTrustedApp", 29)
+ProcThreadAttributeSveVectorLength = make_flag("ProcThreadAttributeSveVectorLength", 30)
+PROC_THREAD_ATTRIBUTE_NUMBER = make_flag("PROC_THREAD_ATTRIBUTE_NUMBER", 0x0000FFFF)
+PROC_THREAD_ATTRIBUTE_THREAD = make_flag("PROC_THREAD_ATTRIBUTE_THREAD", 0x00010000)
+PROC_THREAD_ATTRIBUTE_INPUT = make_flag("PROC_THREAD_ATTRIBUTE_INPUT", 0x00020000)
+PROC_THREAD_ATTRIBUTE_ADDITIVE = make_flag("PROC_THREAD_ATTRIBUTE_ADDITIVE", 0x00040000)
+PROC_THREAD_ATTRIBUTE_PARENT_PROCESS = make_flag("PROC_THREAD_ATTRIBUTE_PARENT_PROCESS", ProcThreadAttributeValue ( ProcThreadAttributeParentProcess , False , True , False ))
+PROC_THREAD_ATTRIBUTE_HANDLE_LIST = make_flag("PROC_THREAD_ATTRIBUTE_HANDLE_LIST", ProcThreadAttributeValue ( ProcThreadAttributeHandleList , False , True , False ))
+PROC_THREAD_ATTRIBUTE_GROUP_AFFINITY = make_flag("PROC_THREAD_ATTRIBUTE_GROUP_AFFINITY", ProcThreadAttributeValue ( ProcThreadAttributeGroupAffinity , True , True , False ))
+PROC_THREAD_ATTRIBUTE_PREFERRED_NODE = make_flag("PROC_THREAD_ATTRIBUTE_PREFERRED_NODE", ProcThreadAttributeValue ( ProcThreadAttributePreferredNode , False , True , False ))
+PROC_THREAD_ATTRIBUTE_IDEAL_PROCESSOR = make_flag("PROC_THREAD_ATTRIBUTE_IDEAL_PROCESSOR", ProcThreadAttributeValue ( ProcThreadAttributeIdealProcessor , True , True , False ))
+PROC_THREAD_ATTRIBUTE_UMS_THREAD = make_flag("PROC_THREAD_ATTRIBUTE_UMS_THREAD", ProcThreadAttributeValue ( ProcThreadAttributeUmsThread , True , True , False ))
+PROC_THREAD_ATTRIBUTE_MITIGATION_POLICY = make_flag("PROC_THREAD_ATTRIBUTE_MITIGATION_POLICY", ProcThreadAttributeValue ( ProcThreadAttributeMitigationPolicy , False , True , False ))
+PROC_THREAD_ATTRIBUTE_SECURITY_CAPABILITIES = make_flag("PROC_THREAD_ATTRIBUTE_SECURITY_CAPABILITIES", ProcThreadAttributeValue ( ProcThreadAttributeSecurityCapabilities , False , True , False ))
+PROC_THREAD_ATTRIBUTE_PROTECTION_LEVEL = make_flag("PROC_THREAD_ATTRIBUTE_PROTECTION_LEVEL", ProcThreadAttributeValue ( ProcThreadAttributeProtectionLevel , False , True , False ))
+PROC_THREAD_ATTRIBUTE_PSEUDOCONSOLE = make_flag("PROC_THREAD_ATTRIBUTE_PSEUDOCONSOLE", ProcThreadAttributeValue ( ProcThreadAttributePseudoConsole , False , True , False ))
+PROC_THREAD_ATTRIBUTE_MACHINE_TYPE = make_flag("PROC_THREAD_ATTRIBUTE_MACHINE_TYPE", ProcThreadAttributeValue ( ProcThreadAttributeMachineType , False , True , False ))
+PROC_THREAD_ATTRIBUTE_ENABLE_OPTIONAL_XSTATE_FEATURES = make_flag("PROC_THREAD_ATTRIBUTE_ENABLE_OPTIONAL_XSTATE_FEATURES", ProcThreadAttributeValue ( ProcThreadAttributeEnableOptionalXStateFeatures , True , True , False ))
+PROC_THREAD_ATTRIBUTE_SVE_VECTOR_LENGTH = make_flag("PROC_THREAD_ATTRIBUTE_SVE_VECTOR_LENGTH", ProcThreadAttributeValue ( ProcThreadAttributeSveVectorLength , False , True , False ))
+PROCESSOR_INTEL_386 = make_flag("PROCESSOR_INTEL_386", 386)
+PROCESSOR_INTEL_486 = make_flag("PROCESSOR_INTEL_486", 486)
+PROCESSOR_INTEL_PENTIUM = make_flag("PROCESSOR_INTEL_PENTIUM", 586)
+PROCESSOR_INTEL_IA64 = make_flag("PROCESSOR_INTEL_IA64", 2200)
+PROCESSOR_MIPS_R4000 = make_flag("PROCESSOR_MIPS_R4000", 4000)
+PROCESSOR_ALPHA_21064 = make_flag("PROCESSOR_ALPHA_21064", 21064)
+PROCESSOR_PPC_601 = make_flag("PROCESSOR_PPC_601", 601)
+PROCESSOR_PPC_603 = make_flag("PROCESSOR_PPC_603", 603)
+PROCESSOR_PPC_604 = make_flag("PROCESSOR_PPC_604", 604)
+PROCESSOR_PPC_620 = make_flag("PROCESSOR_PPC_620", 620)
+PROCESSOR_HITACHI_SH3 = make_flag("PROCESSOR_HITACHI_SH3", 10003)
+PROCESSOR_HITACHI_SH3E = make_flag("PROCESSOR_HITACHI_SH3E", 10004)
+PROCESSOR_HITACHI_SH4 = make_flag("PROCESSOR_HITACHI_SH4", 10005)
+PROCESSOR_MOTOROLA_821 = make_flag("PROCESSOR_MOTOROLA_821", 821)
+PROCESSOR_SHx_SH3 = make_flag("PROCESSOR_SHx_SH3", 103)
+PROCESSOR_SHx_SH4 = make_flag("PROCESSOR_SHx_SH4", 104)
+PROCESSOR_STRONGARM = make_flag("PROCESSOR_STRONGARM", 2577)
+PROCESSOR_ARM720 = make_flag("PROCESSOR_ARM720", 1824)
+PROCESSOR_ARM820 = make_flag("PROCESSOR_ARM820", 2080)
+PROCESSOR_ARM920 = make_flag("PROCESSOR_ARM920", 2336)
+PROCESSOR_ARM_7TDMI = make_flag("PROCESSOR_ARM_7TDMI", 70001)
+PROCESSOR_OPTIL = make_flag("PROCESSOR_OPTIL", 0x494f)
+PROCESSOR_ARCHITECTURE_INTEL = make_flag("PROCESSOR_ARCHITECTURE_INTEL", 0)
+PROCESSOR_ARCHITECTURE_MIPS = make_flag("PROCESSOR_ARCHITECTURE_MIPS", 1)
+PROCESSOR_ARCHITECTURE_ALPHA = make_flag("PROCESSOR_ARCHITECTURE_ALPHA", 2)
+PROCESSOR_ARCHITECTURE_PPC = make_flag("PROCESSOR_ARCHITECTURE_PPC", 3)
+PROCESSOR_ARCHITECTURE_SHX = make_flag("PROCESSOR_ARCHITECTURE_SHX", 4)
+PROCESSOR_ARCHITECTURE_ARM = make_flag("PROCESSOR_ARCHITECTURE_ARM", 5)
+PROCESSOR_ARCHITECTURE_IA64 = make_flag("PROCESSOR_ARCHITECTURE_IA64", 6)
+PROCESSOR_ARCHITECTURE_ALPHA64 = make_flag("PROCESSOR_ARCHITECTURE_ALPHA64", 7)
+PROCESSOR_ARCHITECTURE_MSIL = make_flag("PROCESSOR_ARCHITECTURE_MSIL", 8)
+PROCESSOR_ARCHITECTURE_AMD64 = make_flag("PROCESSOR_ARCHITECTURE_AMD64", 9)
+PROCESSOR_ARCHITECTURE_IA32_ON_WIN64 = make_flag("PROCESSOR_ARCHITECTURE_IA32_ON_WIN64", 10)
+PROCESSOR_ARCHITECTURE_NEUTRAL = make_flag("PROCESSOR_ARCHITECTURE_NEUTRAL", 11)
+PROCESSOR_ARCHITECTURE_ARM64 = make_flag("PROCESSOR_ARCHITECTURE_ARM64", 12)
+PROCESSOR_ARCHITECTURE_ARM32_ON_WIN64 = make_flag("PROCESSOR_ARCHITECTURE_ARM32_ON_WIN64", 13)
+PROCESSOR_ARCHITECTURE_UNKNOWN = make_flag("PROCESSOR_ARCHITECTURE_UNKNOWN", 0xFFFF)
 HKEY_CLASSES_ROOT = make_flag("HKEY_CLASSES_ROOT", ( 0x80000000 ))
 HKEY_CURRENT_USER = make_flag("HKEY_CURRENT_USER", ( 0x80000001 ))
 HKEY_LOCAL_MACHINE = make_flag("HKEY_LOCAL_MACHINE", ( 0x80000002 ))
@@ -1790,6 +1889,45 @@ SPC_MINIMAL_CRITERIA_OBJID = make_flag("SPC_MINIMAL_CRITERIA_OBJID", "1.3.6.1.4.
 SPC_FINANCIAL_CRITERIA_OBJID = make_flag("SPC_FINANCIAL_CRITERIA_OBJID", "1.3.6.1.4.1.311.2.1.27")
 SPC_LINK_OBJID = make_flag("SPC_LINK_OBJID", "1.3.6.1.4.1.311.2.1.28")
 SPC_SIGINFO_OBJID = make_flag("SPC_SIGINFO_OBJID", "1.3.6.1.4.1.311.2.1.30")
+CONTEXT_I386 = make_flag("CONTEXT_I386", 0x00010000)
+CONTEXT_AMD64 = make_flag("CONTEXT_AMD64", 0x00100000)
+CONTEXT_ARM = make_flag("CONTEXT_ARM", 0x00200000)
+CONTEXT_ARM64 = make_flag("CONTEXT_ARM64", 0x00400000)
+CONTEXT_i386 = make_flag("CONTEXT_i386", 0x00010000)
+CONTEXT_i486 = make_flag("CONTEXT_i486", 0x00010000)
+WOW64_CONTEXT_i386 = make_flag("WOW64_CONTEXT_i386", 0x00010000)
+WOW64_CONTEXT_i486 = make_flag("WOW64_CONTEXT_i486", 0x00010000)
+CONTEXT_CONTROL = make_flag("CONTEXT_CONTROL", 0x00000001)
+CONTEXT_INTEGER = make_flag("CONTEXT_INTEGER", 0x00000002)
+CONTEXT_SEGMENTS = make_flag("CONTEXT_SEGMENTS", 0x00000004)
+CONTEXT_FLOATING_POINT = make_flag("CONTEXT_FLOATING_POINT", 0x00000008)
+CONTEXT_DEBUG_REGISTERS = make_flag("CONTEXT_DEBUG_REGISTERS", 0x00000010)
+CONTEXT_EXTENDED_REGISTERS = make_flag("CONTEXT_EXTENDED_REGISTERS", 0x00000020)
+CONTEXT_FULL = make_flag("CONTEXT_FULL", ( CONTEXT_CONTROL | CONTEXT_INTEGER | CONTEXT_SEGMENTS ))
+CONTEXT_ALL = make_flag("CONTEXT_ALL", ( CONTEXT_FULL | CONTEXT_FLOATING_POINT | CONTEXT_DEBUG_REGISTERS | CONTEXT_EXTENDED_REGISTERS ))
+CONTEXT_XSTATE = make_flag("CONTEXT_XSTATE", ( CONTEXT_I386 | 0x00000040 ))
+WOW64_CONTEXT_CONTROL = make_flag("WOW64_CONTEXT_CONTROL", ( WOW64_CONTEXT_i386 | 0x00000001 ))
+WOW64_CONTEXT_INTEGER = make_flag("WOW64_CONTEXT_INTEGER", ( WOW64_CONTEXT_i386 | 0x00000002 ))
+WOW64_CONTEXT_SEGMENTS = make_flag("WOW64_CONTEXT_SEGMENTS", ( WOW64_CONTEXT_i386 | 0x00000004 ))
+WOW64_CONTEXT_FLOATING_POINT = make_flag("WOW64_CONTEXT_FLOATING_POINT", ( WOW64_CONTEXT_i386 | 0x00000008 ))
+WOW64_CONTEXT_DEBUG_REGISTERS = make_flag("WOW64_CONTEXT_DEBUG_REGISTERS", ( WOW64_CONTEXT_i386 | 0x00000010 ))
+WOW64_CONTEXT_EXTENDED_REGISTERS = make_flag("WOW64_CONTEXT_EXTENDED_REGISTERS", ( WOW64_CONTEXT_i386 | 0x00000020 ))
+WOW64_CONTEXT_FULL = make_flag("WOW64_CONTEXT_FULL", ( WOW64_CONTEXT_CONTROL | WOW64_CONTEXT_INTEGER | WOW64_CONTEXT_SEGMENTS ))
+WOW64_CONTEXT_ALL = make_flag("WOW64_CONTEXT_ALL", ( WOW64_CONTEXT_CONTROL | WOW64_CONTEXT_INTEGER | WOW64_CONTEXT_SEGMENTS | WOW64_CONTEXT_FLOATING_POINT | WOW64_CONTEXT_DEBUG_REGISTERS | WOW64_CONTEXT_EXTENDED_REGISTERS ))
+WOW64_CONTEXT_XSTATE = make_flag("WOW64_CONTEXT_XSTATE", ( WOW64_CONTEXT_i386 | 0x00000040 ))
+WOW64_CONTEXT_EXCEPTION_ACTIVE = make_flag("WOW64_CONTEXT_EXCEPTION_ACTIVE", 0x08000000)
+WOW64_CONTEXT_SERVICE_ACTIVE = make_flag("WOW64_CONTEXT_SERVICE_ACTIVE", 0x10000000)
+WOW64_CONTEXT_EXCEPTION_REQUEST = make_flag("WOW64_CONTEXT_EXCEPTION_REQUEST", 0x40000000)
+WOW64_CONTEXT_EXCEPTION_REPORTING = make_flag("WOW64_CONTEXT_EXCEPTION_REPORTING", 0x80000000)
+CONTEXT_ARM64_CONTROL = make_flag("CONTEXT_ARM64_CONTROL", ( CONTEXT_ARM64 | 0x1 ))
+CONTEXT_ARM64_INTEGER = make_flag("CONTEXT_ARM64_INTEGER", ( CONTEXT_ARM64 | 0x2 ))
+CONTEXT_ARM64_FLOATING_POINT = make_flag("CONTEXT_ARM64_FLOATING_POINT", ( CONTEXT_ARM64 | 0x4 ))
+CONTEXT_ARM64_DEBUG_REGISTERS = make_flag("CONTEXT_ARM64_DEBUG_REGISTERS", ( CONTEXT_ARM64 | 0x8 ))
+CONTEXT_ARM64_X18 = make_flag("CONTEXT_ARM64_X18", ( CONTEXT_ARM64 | 0x10 ))
+CONTEXT_UNWOUND_TO_CALL = make_flag("CONTEXT_UNWOUND_TO_CALL", 0x20000000)
+CONTEXT_RET_TO_GUEST = make_flag("CONTEXT_RET_TO_GUEST", 0x04000000)
+ARM64_MAX_BREAKPOINTS = make_flag("ARM64_MAX_BREAKPOINTS", 8)
+ARM64_MAX_WATCHPOINTS = make_flag("ARM64_MAX_WATCHPOINTS", 2)
 FILE_VER_GET_LOCALISED = make_flag("FILE_VER_GET_LOCALISED", 0x01)
 FILE_VER_GET_NEUTRAL = make_flag("FILE_VER_GET_NEUTRAL", 0x02)
 FILE_VER_GET_PREFETCHED = make_flag("FILE_VER_GET_PREFETCHED", 0x04)
@@ -1901,19 +2039,6 @@ TH32CS_SNAPMODULE = make_flag("TH32CS_SNAPMODULE", 0x00000008)
 TH32CS_SNAPMODULE32 = make_flag("TH32CS_SNAPMODULE32", 0x00000010)
 TH32CS_SNAPALL = make_flag("TH32CS_SNAPALL", ( TH32CS_SNAPHEAPLIST | TH32CS_SNAPPROCESS | TH32CS_SNAPTHREAD | TH32CS_SNAPMODULE ))
 TH32CS_INHERIT = make_flag("TH32CS_INHERIT", 0x80000000)
-CONTEXT_I386 = make_flag("CONTEXT_I386", 0x00010000)
-CONTEXT_AMD64 = make_flag("CONTEXT_AMD64", 0x00100000)
-CONTEXT_ARM = make_flag("CONTEXT_ARM", 0x00200000)
-CONTEXT_ARM64 = make_flag("CONTEXT_ARM64", 0x00400000)
-CONTEXT_CONTROL = make_flag("CONTEXT_CONTROL", 0x00000001)
-CONTEXT_INTEGER = make_flag("CONTEXT_INTEGER", 0x00000002)
-CONTEXT_SEGMENTS = make_flag("CONTEXT_SEGMENTS", 0x00000004)
-CONTEXT_FLOATING_POINT = make_flag("CONTEXT_FLOATING_POINT", 0x00000008)
-CONTEXT_DEBUG_REGISTERS = make_flag("CONTEXT_DEBUG_REGISTERS", 0x00000010)
-CONTEXT_EXTENDED_REGISTERS = make_flag("CONTEXT_EXTENDED_REGISTERS", 0x00000020)
-CONTEXT_FULL = make_flag("CONTEXT_FULL", ( CONTEXT_CONTROL | CONTEXT_INTEGER | CONTEXT_SEGMENTS ))
-CONTEXT_ALL = make_flag("CONTEXT_ALL", ( CONTEXT_FULL | CONTEXT_FLOATING_POINT | CONTEXT_DEBUG_REGISTERS | CONTEXT_EXTENDED_REGISTERS ))
-CONTEXT_XSTATE = make_flag("CONTEXT_XSTATE", ( CONTEXT_I386 | 0x00000040 ))
 PAGE_NOACCESS = make_flag("PAGE_NOACCESS", 0x01)
 PAGE_READONLY = make_flag("PAGE_READONLY", 0x02)
 PAGE_READWRITE = make_flag("PAGE_READWRITE", 0x04)
@@ -2946,6 +3071,7 @@ IMAGE_FILE_MACHINE_AMD64 = make_flag("IMAGE_FILE_MACHINE_AMD64", 0x8664)
 IMAGE_FILE_MACHINE_M32R = make_flag("IMAGE_FILE_MACHINE_M32R", 0x9041)
 IMAGE_FILE_MACHINE_CEE = make_flag("IMAGE_FILE_MACHINE_CEE", 0xC0EE)
 IMAGE_FILE_MACHINE_ARM64 = make_flag("IMAGE_FILE_MACHINE_ARM64", 0xAA64)
+IMAGE_FILE_MACHINE_TARGET_HOST = make_flag("IMAGE_FILE_MACHINE_TARGET_HOST", 0x0001)
 CERT_QUERY_OBJECT_FILE = make_flag("CERT_QUERY_OBJECT_FILE", 0x00000001)
 CERT_QUERY_OBJECT_BLOB = make_flag("CERT_QUERY_OBJECT_BLOB", 0x00000002)
 CERT_QUERY_CONTENT_CERT = make_flag("CERT_QUERY_CONTENT_CERT", 1)

windows/generated_def/winfuncs.py

@@ -1735,6 +1735,16 @@ LoadLibraryExWParams = ((1, 'lpLibFileName'), (1, 'hFile'), (1, 'dwFlags'))
 FreeLibraryPrototype = WINFUNCTYPE(BOOL, HMODULE)
 FreeLibraryParams = ((1, 'hLibModule'),)
 
+#def GetProcessInformation(hProcess, ProcessInformationClass, ProcessInformation, ProcessInformationSize):
+#    return GetProcessInformation.ctypes_function(hProcess, ProcessInformationClass, ProcessInformation, ProcessInformationSize)
+GetProcessInformationPrototype = WINFUNCTYPE(BOOL, HANDLE, PROCESS_INFORMATION_CLASS, LPVOID, DWORD)
+GetProcessInformationParams = ((1, 'hProcess'), (1, 'ProcessInformationClass'), (1, 'ProcessInformation'), (1, 'ProcessInformationSize'))
+
+#def SetProcessInformation(hProcess, ProcessInformationClass, ProcessInformation, ProcessInformationSize):
+#    return SetProcessInformation.ctypes_function(hProcess, ProcessInformationClass, ProcessInformation, ProcessInformationSize)
+SetProcessInformationPrototype = WINFUNCTYPE(BOOL, HANDLE, PROCESS_INFORMATION_CLASS, LPVOID, DWORD)
+SetProcessInformationParams = ((1, 'hProcess'), (1, 'ProcessInformationClass'), (1, 'ProcessInformation'), (1, 'ProcessInformationSize'))
+
 #def RtlGetCurrentPeb():
 #    return RtlGetCurrentPeb.ctypes_function()
 RtlGetCurrentPebPrototype = WINFUNCTYPE(PVOID)
@@ -3030,6 +3040,96 @@ LookupAccountNameAParams = ((1, 'lpSystemName'), (1, 'lpAccountName'), (1, 'Sid'
 LookupAccountNameWPrototype = WINFUNCTYPE(BOOL, LPCWSTR, LPCWSTR, PSID, LPDWORD, LPWSTR, LPDWORD, PSID_NAME_USE)
 LookupAccountNameWParams = ((1, 'lpSystemName'), (1, 'lpAccountName'), (1, 'Sid'), (1, 'cbSid'), (1, 'ReferencedDomainName'), (1, 'cchReferencedDomainName'), (1, 'peUse'))
 
+#def GetNativeSystemInfo(lpSystemInfo):
+#    return GetNativeSystemInfo.ctypes_function(lpSystemInfo)
+GetNativeSystemInfoPrototype = WINFUNCTYPE(PVOID, LPSYSTEM_INFO)
+GetNativeSystemInfoParams = ((1, 'lpSystemInfo'),)
+
+#def GetSystemInfo(lpSystemInfo):
+#    return GetSystemInfo.ctypes_function(lpSystemInfo)
+GetSystemInfoPrototype = WINFUNCTYPE(PVOID, LPSYSTEM_INFO)
+GetSystemInfoParams = ((1, 'lpSystemInfo'),)
+
+#def IsWow64Process(hProcess, Wow64Process):
+#    return IsWow64Process.ctypes_function(hProcess, Wow64Process)
+IsWow64ProcessPrototype = WINFUNCTYPE(BOOL, HANDLE, PBOOL)
+IsWow64ProcessParams = ((1, 'hProcess'), (1, 'Wow64Process'))
+
+#def IsWow64Process2(hProcess, pProcessMachine, pNativeMachine):
+#    return IsWow64Process2.ctypes_function(hProcess, pProcessMachine, pNativeMachine)
+IsWow64Process2Prototype = WINFUNCTYPE(BOOL, HANDLE, POINTER(USHORT), POINTER(USHORT))
+IsWow64Process2Params = ((1, 'hProcess'), (1, 'pProcessMachine'), (1, 'pNativeMachine'))
+
+#def IsWow64GuestMachineSupported(WowGuestMachine, MachineIsSupported):
+#    return IsWow64GuestMachineSupported.ctypes_function(WowGuestMachine, MachineIsSupported)
+IsWow64GuestMachineSupportedPrototype = WINFUNCTYPE(HRESULT, USHORT, POINTER(BOOL))
+IsWow64GuestMachineSupportedParams = ((1, 'WowGuestMachine'), (1, 'MachineIsSupported'))
+
+#def GetSystemWow64DirectoryA(lpBuffer, uSize):
+#    return GetSystemWow64DirectoryA.ctypes_function(lpBuffer, uSize)
+GetSystemWow64DirectoryAPrototype = WINFUNCTYPE(UINT, LPSTR, UINT)
+GetSystemWow64DirectoryAParams = ((1, 'lpBuffer'), (1, 'uSize'))
+
+#def GetSystemWow64DirectoryW(lpBuffer, uSize):
+#    return GetSystemWow64DirectoryW.ctypes_function(lpBuffer, uSize)
+GetSystemWow64DirectoryWPrototype = WINFUNCTYPE(UINT, LPWSTR, UINT)
+GetSystemWow64DirectoryWParams = ((1, 'lpBuffer'), (1, 'uSize'))
+
+#def GetSystemWow64Directory2A(lpBuffer, uSize, ImageFileMachineType):
+#    return GetSystemWow64Directory2A.ctypes_function(lpBuffer, uSize, ImageFileMachineType)
+GetSystemWow64Directory2APrototype = WINFUNCTYPE(UINT, LPSTR, UINT, WORD)
+GetSystemWow64Directory2AParams = ((1, 'lpBuffer'), (1, 'uSize'), (1, 'ImageFileMachineType'))
+
+#def GetSystemWow64Directory2W(lpBuffer, uSize, ImageFileMachineType):
+#    return GetSystemWow64Directory2W.ctypes_function(lpBuffer, uSize, ImageFileMachineType)
+GetSystemWow64Directory2WPrototype = WINFUNCTYPE(UINT, LPWSTR, UINT, WORD)
+GetSystemWow64Directory2WParams = ((1, 'lpBuffer'), (1, 'uSize'), (1, 'ImageFileMachineType'))
+
+#def Wow64DisableWow64FsRedirection(OldValue):
+#    return Wow64DisableWow64FsRedirection.ctypes_function(OldValue)
+Wow64DisableWow64FsRedirectionPrototype = WINFUNCTYPE(BOOL, POINTER(PVOID))
+Wow64DisableWow64FsRedirectionParams = ((1, 'OldValue'),)
+
+#def Wow64EnableWow64FsRedirection(Wow64FsEnableRedirection):
+#    return Wow64EnableWow64FsRedirection.ctypes_function(Wow64FsEnableRedirection)
+Wow64EnableWow64FsRedirectionPrototype = WINFUNCTYPE(BOOLEAN, BOOLEAN)
+Wow64EnableWow64FsRedirectionParams = ((1, 'Wow64FsEnableRedirection'),)
+
+#def Wow64RevertWow64FsRedirection(OlValue):
+#    return Wow64RevertWow64FsRedirection.ctypes_function(OlValue)
+Wow64RevertWow64FsRedirectionPrototype = WINFUNCTYPE(BOOL, PVOID)
+Wow64RevertWow64FsRedirectionParams = ((1, 'OlValue'),)
+
+#def Wow64GetThreadContext(hThread, lpContext):
+#    return Wow64GetThreadContext.ctypes_function(hThread, lpContext)
+Wow64GetThreadContextPrototype = WINFUNCTYPE(BOOL, HANDLE, PWOW64_CONTEXT)
+Wow64GetThreadContextParams = ((1, 'hThread'), (1, 'lpContext'))
+
+#def Wow64SetThreadContext(hThread, lpContext):
+#    return Wow64SetThreadContext.ctypes_function(hThread, lpContext)
+Wow64SetThreadContextPrototype = WINFUNCTYPE(BOOL, HANDLE, POINTER(WOW64_CONTEXT))
+Wow64SetThreadContextParams = ((1, 'hThread'), (1, 'lpContext'))
+
+#def Wow64SetThreadDefaultGuestMachine(Machine):
+#    return Wow64SetThreadDefaultGuestMachine.ctypes_function(Machine)
+Wow64SetThreadDefaultGuestMachinePrototype = WINFUNCTYPE(USHORT, USHORT)
+Wow64SetThreadDefaultGuestMachineParams = ((1, 'Machine'),)
+
+#def Wow64SuspendThread(hThread):
+#    return Wow64SuspendThread.ctypes_function(hThread)
+Wow64SuspendThreadPrototype = WINFUNCTYPE(DWORD, HANDLE)
+Wow64SuspendThreadParams = ((1, 'hThread'),)
+
+#def NtWow64ReadVirtualMemory64(hProcess, lpBaseAddress, lpBuffer, nSize, lpNumberOfBytesRead):
+#    return NtWow64ReadVirtualMemory64.ctypes_function(hProcess, lpBaseAddress, lpBuffer, nSize, lpNumberOfBytesRead)
+NtWow64ReadVirtualMemory64Prototype = WINFUNCTYPE(NTSTATUS, HANDLE, ULONG64, LPVOID, ULONG64, PULONG64)
+NtWow64ReadVirtualMemory64Params = ((1, 'hProcess'), (1, 'lpBaseAddress'), (1, 'lpBuffer'), (1, 'nSize'), (1, 'lpNumberOfBytesRead'))
+
+#def NtWow64WriteVirtualMemory64(hProcess, lpBaseAddress, lpBuffer, nSize, lpNumberOfBytesWritten):
+#    return NtWow64WriteVirtualMemory64.ctypes_function(hProcess, lpBaseAddress, lpBuffer, nSize, lpNumberOfBytesWritten)
+NtWow64WriteVirtualMemory64Prototype = WINFUNCTYPE(NTSTATUS, HANDLE, ULONG64, LPVOID, ULONG64, PULONG64)
+NtWow64WriteVirtualMemory64Params = ((1, 'hProcess'), (1, 'lpBaseAddress'), (1, 'lpBuffer'), (1, 'nSize'), (1, 'lpNumberOfBytesWritten'))
+
 #def FileTimeToSystemTime(lpFileTime, lpSystemTime):
 #    return FileTimeToSystemTime.ctypes_function(lpFileTime, lpSystemTime)
 FileTimeToSystemTimePrototype = WINFUNCTYPE(BOOL, POINTER(FILETIME), LPSYSTEMTIME)
@@ -3370,6 +3470,11 @@ CreateThreadParams = ((1, 'lpThreadAttributes'), (1, 'dwStackSize'), (1, 'lpStar
 CreateRemoteThreadPrototype = WINFUNCTYPE(HANDLE, HANDLE, LPSECURITY_ATTRIBUTES, SIZE_T, LPTHREAD_START_ROUTINE, LPVOID, DWORD, LPDWORD)
 CreateRemoteThreadParams = ((1, 'hProcess'), (1, 'lpThreadAttributes'), (1, 'dwStackSize'), (1, 'lpStartAddress'), (1, 'lpParameter'), (1, 'dwCreationFlags'), (1, 'lpThreadId'))
 
+#def CreateRemoteThreadEx(hProcess, lpThreadAttributes, dwStackSize, lpStartAddress, lpParameter, dwCreationFlags, lpAttributeList, lpThreadId):
+#    return CreateRemoteThreadEx.ctypes_function(hProcess, lpThreadAttributes, dwStackSize, lpStartAddress, lpParameter, dwCreationFlags, lpAttributeList, lpThreadId)
+CreateRemoteThreadExPrototype = WINFUNCTYPE(HANDLE, HANDLE, LPSECURITY_ATTRIBUTES, SIZE_T, LPTHREAD_START_ROUTINE, LPVOID, DWORD, LPPROC_THREAD_ATTRIBUTE_LIST, LPDWORD)
+CreateRemoteThreadExParams = ((1, 'hProcess'), (1, 'lpThreadAttributes'), (1, 'dwStackSize'), (1, 'lpStartAddress'), (1, 'lpParameter'), (1, 'dwCreationFlags'), (1, 'lpAttributeList'), (1, 'lpThreadId'))
+
 #def CreateProcessA(lpApplicationName, lpCommandLine, lpProcessAttributes, lpThreadAttributes, bInheritHandles, dwCreationFlags, lpEnvironment, lpCurrentDirectory, lpStartupInfo, lpProcessInformation):
 #    return CreateProcessA.ctypes_function(lpApplicationName, lpCommandLine, lpProcessAttributes, lpThreadAttributes, bInheritHandles, dwCreationFlags, lpEnvironment, lpCurrentDirectory, lpStartupInfo, lpProcessInformation)
 CreateProcessAPrototype = WINFUNCTYPE(BOOL, LPCSTR, LPSTR, LPSECURITY_ATTRIBUTES, LPSECURITY_ATTRIBUTES, BOOL, DWORD, LPVOID, LPCSTR, LPSTARTUPINFOA, LPPROCESS_INFORMATION)
@@ -3420,21 +3525,11 @@ CloseHandleParams = ((1, 'hObject'),)
 ReadProcessMemoryPrototype = WINFUNCTYPE(BOOL, HANDLE, LPCVOID, LPVOID, SIZE_T, POINTER(SIZE_T))
 ReadProcessMemoryParams = ((1, 'hProcess'), (1, 'lpBaseAddress'), (1, 'lpBuffer'), (1, 'nSize'), (1, 'lpNumberOfBytesRead'))
 
-#def NtWow64ReadVirtualMemory64(hProcess, lpBaseAddress, lpBuffer, nSize, lpNumberOfBytesRead):
-#    return NtWow64ReadVirtualMemory64.ctypes_function(hProcess, lpBaseAddress, lpBuffer, nSize, lpNumberOfBytesRead)
-NtWow64ReadVirtualMemory64Prototype = WINFUNCTYPE(NTSTATUS, HANDLE, ULONG64, LPVOID, ULONG64, PULONG64)
-NtWow64ReadVirtualMemory64Params = ((1, 'hProcess'), (1, 'lpBaseAddress'), (1, 'lpBuffer'), (1, 'nSize'), (1, 'lpNumberOfBytesRead'))
-
 #def WriteProcessMemory(hProcess, lpBaseAddress, lpBuffer, nSize, lpNumberOfBytesWritten):
 #    return WriteProcessMemory.ctypes_function(hProcess, lpBaseAddress, lpBuffer, nSize, lpNumberOfBytesWritten)
 WriteProcessMemoryPrototype = WINFUNCTYPE(BOOL, HANDLE, LPVOID, LPCVOID, SIZE_T, POINTER(SIZE_T))
 WriteProcessMemoryParams = ((1, 'hProcess'), (1, 'lpBaseAddress'), (1, 'lpBuffer'), (1, 'nSize'), (1, 'lpNumberOfBytesWritten'))
 
-#def NtWow64WriteVirtualMemory64(hProcess, lpBaseAddress, lpBuffer, nSize, lpNumberOfBytesWritten):
-#    return NtWow64WriteVirtualMemory64.ctypes_function(hProcess, lpBaseAddress, lpBuffer, nSize, lpNumberOfBytesWritten)
-NtWow64WriteVirtualMemory64Prototype = WINFUNCTYPE(NTSTATUS, HANDLE, ULONG64, LPVOID, ULONG64, PULONG64)
-NtWow64WriteVirtualMemory64Params = ((1, 'hProcess'), (1, 'lpBaseAddress'), (1, 'lpBuffer'), (1, 'nSize'), (1, 'lpNumberOfBytesWritten'))
-
 #def GetCurrentProcess():
 #    return GetCurrentProcess.ctypes_function()
 GetCurrentProcessPrototype = WINFUNCTYPE(HANDLE)
@@ -3665,26 +3760,6 @@ GetThreadIdParams = ((1, 'Thread'),)
 DeviceIoControlPrototype = WINFUNCTYPE(BOOL, HANDLE, DWORD, LPVOID, DWORD, LPVOID, DWORD, LPDWORD, LPOVERLAPPED)
 DeviceIoControlParams = ((1, 'hDevice'), (1, 'dwIoControlCode'), (1, 'lpInBuffer'), (1, 'nInBufferSize'), (1, 'lpOutBuffer'), (1, 'nOutBufferSize'), (1, 'lpBytesReturned'), (1, 'lpOverlapped'))
 
-#def Wow64DisableWow64FsRedirection(OldValue):
-#    return Wow64DisableWow64FsRedirection.ctypes_function(OldValue)
-Wow64DisableWow64FsRedirectionPrototype = WINFUNCTYPE(BOOL, POINTER(PVOID))
-Wow64DisableWow64FsRedirectionParams = ((1, 'OldValue'),)
-
-#def Wow64RevertWow64FsRedirection(OldValue):
-#    return Wow64RevertWow64FsRedirection.ctypes_function(OldValue)
-Wow64RevertWow64FsRedirectionPrototype = WINFUNCTYPE(BOOL, PVOID)
-Wow64RevertWow64FsRedirectionParams = ((1, 'OldValue'),)
-
-#def Wow64EnableWow64FsRedirection(Wow64FsEnableRedirection):
-#    return Wow64EnableWow64FsRedirection.ctypes_function(Wow64FsEnableRedirection)
-Wow64EnableWow64FsRedirectionPrototype = WINFUNCTYPE(BOOLEAN, BOOLEAN)
-Wow64EnableWow64FsRedirectionParams = ((1, 'Wow64FsEnableRedirection'),)
-
-#def Wow64GetThreadContext(hThread, lpContext):
-#    return Wow64GetThreadContext.ctypes_function(hThread, lpContext)
-Wow64GetThreadContextPrototype = WINFUNCTYPE(BOOL, HANDLE, PWOW64_CONTEXT)
-Wow64GetThreadContextParams = ((1, 'hThread'), (1, 'lpContext'))
-
 #def SetConsoleCtrlHandler(HandlerRoutine, Add):
 #    return SetConsoleCtrlHandler.ctypes_function(HandlerRoutine, Add)
 SetConsoleCtrlHandlerPrototype = WINFUNCTYPE(BOOL, PHANDLER_ROUTINE, BOOL)
@@ -3820,11 +3895,6 @@ DebugBreakProcessParams = ((1, 'Process'),)
 GetProcessIdPrototype = WINFUNCTYPE(DWORD, HANDLE)
 GetProcessIdParams = ((1, 'Process'),)
 
-#def Wow64SetThreadContext(hThread, lpContext):
-#    return Wow64SetThreadContext.ctypes_function(hThread, lpContext)
-Wow64SetThreadContextPrototype = WINFUNCTYPE(BOOL, HANDLE, POINTER(WOW64_CONTEXT))
-Wow64SetThreadContextParams = ((1, 'hThread'), (1, 'lpContext'))
-
 #def GetMappedFileNameW(hProcess, lpv, lpFilename, nSize):
 #    return GetMappedFileNameW.ctypes_function(hProcess, lpv, lpFilename, nSize)
 GetMappedFileNameWPrototype = WINFUNCTYPE(DWORD, HANDLE, LPVOID, PVOID, DWORD)

windows/generated_def/winstructs.py

@@ -3595,6 +3595,187 @@ class _IMAGE_LOAD_CONFIG_DIRECTORY64(Structure):
 IMAGE_LOAD_CONFIG_DIRECTORY64 = _IMAGE_LOAD_CONFIG_DIRECTORY64
 PIMAGE_LOAD_CONFIG_DIRECTORY64 = POINTER(_IMAGE_LOAD_CONFIG_DIRECTORY64)
 
+ProcThreadAttributeParentProcess = EnumValue("_PROC_THREAD_ATTRIBUTE_NUM", "ProcThreadAttributeParentProcess", 0x0)
+ProcThreadAttributeHandleList = EnumValue("_PROC_THREAD_ATTRIBUTE_NUM", "ProcThreadAttributeHandleList", 0x2)
+ProcThreadAttributeGroupAffinity = EnumValue("_PROC_THREAD_ATTRIBUTE_NUM", "ProcThreadAttributeGroupAffinity", 0x3)
+ProcThreadAttributePreferredNode = EnumValue("_PROC_THREAD_ATTRIBUTE_NUM", "ProcThreadAttributePreferredNode", 0x4)
+ProcThreadAttributeIdealProcessor = EnumValue("_PROC_THREAD_ATTRIBUTE_NUM", "ProcThreadAttributeIdealProcessor", 0x5)
+ProcThreadAttributeUmsThread = EnumValue("_PROC_THREAD_ATTRIBUTE_NUM", "ProcThreadAttributeUmsThread", 0x6)
+ProcThreadAttributeMitigationPolicy = EnumValue("_PROC_THREAD_ATTRIBUTE_NUM", "ProcThreadAttributeMitigationPolicy", 0x7)
+ProcThreadAttributeSecurityCapabilities = EnumValue("_PROC_THREAD_ATTRIBUTE_NUM", "ProcThreadAttributeSecurityCapabilities", 0x9)
+ProcThreadAttributeProtectionLevel = EnumValue("_PROC_THREAD_ATTRIBUTE_NUM", "ProcThreadAttributeProtectionLevel", 0xb)
+ProcThreadAttributeJobList = EnumValue("_PROC_THREAD_ATTRIBUTE_NUM", "ProcThreadAttributeJobList", 0xd)
+ProcThreadAttributeChildProcessPolicy = EnumValue("_PROC_THREAD_ATTRIBUTE_NUM", "ProcThreadAttributeChildProcessPolicy", 0xe)
+ProcThreadAttributeAllApplicationPackagesPolicy = EnumValue("_PROC_THREAD_ATTRIBUTE_NUM", "ProcThreadAttributeAllApplicationPackagesPolicy", 0xf)
+ProcThreadAttributeWin32kFilter = EnumValue("_PROC_THREAD_ATTRIBUTE_NUM", "ProcThreadAttributeWin32kFilter", 0x10)
+ProcThreadAttributeSafeOpenPromptOriginClaim = EnumValue("_PROC_THREAD_ATTRIBUTE_NUM", "ProcThreadAttributeSafeOpenPromptOriginClaim", 0x11)
+ProcThreadAttributeDesktopAppPolicy = EnumValue("_PROC_THREAD_ATTRIBUTE_NUM", "ProcThreadAttributeDesktopAppPolicy", 0x12)
+ProcThreadAttributePseudoConsole = EnumValue("_PROC_THREAD_ATTRIBUTE_NUM", "ProcThreadAttributePseudoConsole", 0x16)
+ProcThreadAttributeMitigationAuditPolicy = EnumValue("_PROC_THREAD_ATTRIBUTE_NUM", "ProcThreadAttributeMitigationAuditPolicy", 0x18)
+ProcThreadAttributeMachineType = EnumValue("_PROC_THREAD_ATTRIBUTE_NUM", "ProcThreadAttributeMachineType", 0x19)
+ProcThreadAttributeComponentFilter = EnumValue("_PROC_THREAD_ATTRIBUTE_NUM", "ProcThreadAttributeComponentFilter", 0x1a)
+ProcThreadAttributeEnableOptionalXStateFeatures = EnumValue("_PROC_THREAD_ATTRIBUTE_NUM", "ProcThreadAttributeEnableOptionalXStateFeatures", 0x1b)
+ProcThreadAttributeTrustedApp = EnumValue("_PROC_THREAD_ATTRIBUTE_NUM", "ProcThreadAttributeTrustedApp", 0x1d)
+ProcThreadAttributeSveVectorLength = EnumValue("_PROC_THREAD_ATTRIBUTE_NUM", "ProcThreadAttributeSveVectorLength", 0x1e)
+class _PROC_THREAD_ATTRIBUTE_NUM(EnumType):
+    values = [ProcThreadAttributeParentProcess, ProcThreadAttributeHandleList, ProcThreadAttributeGroupAffinity, ProcThreadAttributePreferredNode, ProcThreadAttributeIdealProcessor, ProcThreadAttributeUmsThread, ProcThreadAttributeMitigationPolicy, ProcThreadAttributeSecurityCapabilities, ProcThreadAttributeProtectionLevel, ProcThreadAttributeJobList, ProcThreadAttributeChildProcessPolicy, ProcThreadAttributeAllApplicationPackagesPolicy, ProcThreadAttributeWin32kFilter, ProcThreadAttributeSafeOpenPromptOriginClaim, ProcThreadAttributeDesktopAppPolicy, ProcThreadAttributePseudoConsole, ProcThreadAttributeMitigationAuditPolicy, ProcThreadAttributeMachineType, ProcThreadAttributeComponentFilter, ProcThreadAttributeEnableOptionalXStateFeatures, ProcThreadAttributeTrustedApp, ProcThreadAttributeSveVectorLength]
+    mapper = FlagMapper(*values)
+PROC_THREAD_ATTRIBUTE_NUM = _PROC_THREAD_ATTRIBUTE_NUM
+
+
+MemoryBasicInformation = EnumValue("_MEMORY_INFORMATION_CLASS", "MemoryBasicInformation", 0x0)
+MemoryWorkingSetList = EnumValue("_MEMORY_INFORMATION_CLASS", "MemoryWorkingSetList", 0x1)
+MemorySectionName = EnumValue("_MEMORY_INFORMATION_CLASS", "MemorySectionName", 0x2)
+MemoryBasicVlmInformation = EnumValue("_MEMORY_INFORMATION_CLASS", "MemoryBasicVlmInformation", 0x3)
+MemoryWorkingSetListEx = EnumValue("_MEMORY_INFORMATION_CLASS", "MemoryWorkingSetListEx", 0x4)
+class _MEMORY_INFORMATION_CLASS(EnumType):
+    values = [MemoryBasicInformation, MemoryWorkingSetList, MemorySectionName, MemoryBasicVlmInformation, MemoryWorkingSetListEx]
+    mapper = FlagMapper(*values)
+MEMORY_INFORMATION_CLASS = _MEMORY_INFORMATION_CLASS
+
+
+ThreadBasicInformation = EnumValue("_THREAD_INFORMATION_CLASS", "ThreadBasicInformation", 0x0)
+ThreadTimes = EnumValue("_THREAD_INFORMATION_CLASS", "ThreadTimes", 0x1)
+ThreadPriority = EnumValue("_THREAD_INFORMATION_CLASS", "ThreadPriority", 0x2)
+ThreadBasePriority = EnumValue("_THREAD_INFORMATION_CLASS", "ThreadBasePriority", 0x3)
+ThreadAffinityMask = EnumValue("_THREAD_INFORMATION_CLASS", "ThreadAffinityMask", 0x4)
+ThreadImpersonationToken = EnumValue("_THREAD_INFORMATION_CLASS", "ThreadImpersonationToken", 0x5)
+ThreadDescriptorTableEntry = EnumValue("_THREAD_INFORMATION_CLASS", "ThreadDescriptorTableEntry", 0x6)
+ThreadEnableAlignmentFaultFixup = EnumValue("_THREAD_INFORMATION_CLASS", "ThreadEnableAlignmentFaultFixup", 0x7)
+ThreadEventPair = EnumValue("_THREAD_INFORMATION_CLASS", "ThreadEventPair", 0x8)
+ThreadQuerySetWin32StartAddress = EnumValue("_THREAD_INFORMATION_CLASS", "ThreadQuerySetWin32StartAddress", 0x9)
+ThreadZeroTlsCell = EnumValue("_THREAD_INFORMATION_CLASS", "ThreadZeroTlsCell", 0xa)
+ThreadPerformanceCount = EnumValue("_THREAD_INFORMATION_CLASS", "ThreadPerformanceCount", 0xb)
+ThreadAmILastThread = EnumValue("_THREAD_INFORMATION_CLASS", "ThreadAmILastThread", 0xc)
+ThreadIdealProcessor = EnumValue("_THREAD_INFORMATION_CLASS", "ThreadIdealProcessor", 0xd)
+ThreadPriorityBoost = EnumValue("_THREAD_INFORMATION_CLASS", "ThreadPriorityBoost", 0xe)
+ThreadSetTlsArrayAddress = EnumValue("_THREAD_INFORMATION_CLASS", "ThreadSetTlsArrayAddress", 0xf)
+ThreadIsIoPending = EnumValue("_THREAD_INFORMATION_CLASS", "ThreadIsIoPending", 0x10)
+ThreadHideFromDebugger = EnumValue("_THREAD_INFORMATION_CLASS", "ThreadHideFromDebugger", 0x11)
+class _THREAD_INFORMATION_CLASS(EnumType):
+    values = [ThreadBasicInformation, ThreadTimes, ThreadPriority, ThreadBasePriority, ThreadAffinityMask, ThreadImpersonationToken, ThreadDescriptorTableEntry, ThreadEnableAlignmentFaultFixup, ThreadEventPair, ThreadQuerySetWin32StartAddress, ThreadZeroTlsCell, ThreadPerformanceCount, ThreadAmILastThread, ThreadIdealProcessor, ThreadPriorityBoost, ThreadSetTlsArrayAddress, ThreadIsIoPending, ThreadHideFromDebugger]
+    mapper = FlagMapper(*values)
+PTHREAD_INFORMATION_CLASS = POINTER(_THREAD_INFORMATION_CLASS)
+THREAD_INFORMATION_CLASS = _THREAD_INFORMATION_CLASS
+
+
+ProcessBasicInformation = EnumValue("_PROCESSINFOCLASS", "ProcessBasicInformation", 0x0)
+ProcessQuotaLimits = EnumValue("_PROCESSINFOCLASS", "ProcessQuotaLimits", 0x1)
+ProcessIoCounters = EnumValue("_PROCESSINFOCLASS", "ProcessIoCounters", 0x2)
+ProcessVmCounters = EnumValue("_PROCESSINFOCLASS", "ProcessVmCounters", 0x3)
+ProcessTimes = EnumValue("_PROCESSINFOCLASS", "ProcessTimes", 0x4)
+ProcessBasePriority = EnumValue("_PROCESSINFOCLASS", "ProcessBasePriority", 0x5)
+ProcessRaisePriority = EnumValue("_PROCESSINFOCLASS", "ProcessRaisePriority", 0x6)
+ProcessDebugPort = EnumValue("_PROCESSINFOCLASS", "ProcessDebugPort", 0x7)
+ProcessExceptionPort = EnumValue("_PROCESSINFOCLASS", "ProcessExceptionPort", 0x8)
+ProcessAccessToken = EnumValue("_PROCESSINFOCLASS", "ProcessAccessToken", 0x9)
+ProcessLdtInformation = EnumValue("_PROCESSINFOCLASS", "ProcessLdtInformation", 0xa)
+ProcessLdtSize = EnumValue("_PROCESSINFOCLASS", "ProcessLdtSize", 0xb)
+ProcessDefaultHardErrorMode = EnumValue("_PROCESSINFOCLASS", "ProcessDefaultHardErrorMode", 0xc)
+ProcessIoPortHandlers = EnumValue("_PROCESSINFOCLASS", "ProcessIoPortHandlers", 0xd)
+ProcessPooledUsageAndLimits = EnumValue("_PROCESSINFOCLASS", "ProcessPooledUsageAndLimits", 0xe)
+ProcessWorkingSetWatch = EnumValue("_PROCESSINFOCLASS", "ProcessWorkingSetWatch", 0xf)
+ProcessUserModeIOPL = EnumValue("_PROCESSINFOCLASS", "ProcessUserModeIOPL", 0x10)
+ProcessEnableAlignmentFaultFixup = EnumValue("_PROCESSINFOCLASS", "ProcessEnableAlignmentFaultFixup", 0x11)
+ProcessPriorityClass = EnumValue("_PROCESSINFOCLASS", "ProcessPriorityClass", 0x12)
+ProcessWx86Information = EnumValue("_PROCESSINFOCLASS", "ProcessWx86Information", 0x13)
+ProcessHandleCount = EnumValue("_PROCESSINFOCLASS", "ProcessHandleCount", 0x14)
+ProcessAffinityMask = EnumValue("_PROCESSINFOCLASS", "ProcessAffinityMask", 0x15)
+ProcessPriorityBoost = EnumValue("_PROCESSINFOCLASS", "ProcessPriorityBoost", 0x16)
+ProcessDeviceMap = EnumValue("_PROCESSINFOCLASS", "ProcessDeviceMap", 0x17)
+ProcessSessionInformation = EnumValue("_PROCESSINFOCLASS", "ProcessSessionInformation", 0x18)
+ProcessForegroundInformation = EnumValue("_PROCESSINFOCLASS", "ProcessForegroundInformation", 0x19)
+ProcessWow64Information = EnumValue("_PROCESSINFOCLASS", "ProcessWow64Information", 0x1a)
+ProcessImageFileName = EnumValue("_PROCESSINFOCLASS", "ProcessImageFileName", 0x1b)
+ProcessLUIDDeviceMapsEnabled = EnumValue("_PROCESSINFOCLASS", "ProcessLUIDDeviceMapsEnabled", 0x1c)
+ProcessBreakOnTermination = EnumValue("_PROCESSINFOCLASS", "ProcessBreakOnTermination", 0x1d)
+ProcessDebugObjectHandle = EnumValue("_PROCESSINFOCLASS", "ProcessDebugObjectHandle", 0x1e)
+ProcessDebugFlags = EnumValue("_PROCESSINFOCLASS", "ProcessDebugFlags", 0x1f)
+ProcessHandleTracing = EnumValue("_PROCESSINFOCLASS", "ProcessHandleTracing", 0x20)
+ProcessIoPriority = EnumValue("_PROCESSINFOCLASS", "ProcessIoPriority", 0x21)
+ProcessExecuteFlags = EnumValue("_PROCESSINFOCLASS", "ProcessExecuteFlags", 0x22)
+ProcessTlsInformation = EnumValue("_PROCESSINFOCLASS", "ProcessTlsInformation", 0x23)
+ProcessCookie = EnumValue("_PROCESSINFOCLASS", "ProcessCookie", 0x24)
+ProcessImageInformation = EnumValue("_PROCESSINFOCLASS", "ProcessImageInformation", 0x25)
+ProcessCycleTime = EnumValue("_PROCESSINFOCLASS", "ProcessCycleTime", 0x26)
+ProcessPagePriority = EnumValue("_PROCESSINFOCLASS", "ProcessPagePriority", 0x27)
+ProcessInstrumentationCallback = EnumValue("_PROCESSINFOCLASS", "ProcessInstrumentationCallback", 0x28)
+ProcessThreadStackAllocation = EnumValue("_PROCESSINFOCLASS", "ProcessThreadStackAllocation", 0x29)
+ProcessWorkingSetWatchEx = EnumValue("_PROCESSINFOCLASS", "ProcessWorkingSetWatchEx", 0x2a)
+ProcessImageFileNameWin32 = EnumValue("_PROCESSINFOCLASS", "ProcessImageFileNameWin32", 0x2b)
+ProcessImageFileMapping = EnumValue("_PROCESSINFOCLASS", "ProcessImageFileMapping", 0x2c)
+ProcessAffinityUpdateMode = EnumValue("_PROCESSINFOCLASS", "ProcessAffinityUpdateMode", 0x2d)
+ProcessMemoryAllocationMode = EnumValue("_PROCESSINFOCLASS", "ProcessMemoryAllocationMode", 0x2e)
+ProcessGroupInformation = EnumValue("_PROCESSINFOCLASS", "ProcessGroupInformation", 0x2f)
+ProcessTokenVirtualizationEnabled = EnumValue("_PROCESSINFOCLASS", "ProcessTokenVirtualizationEnabled", 0x30)
+ProcessOwnerInformation = EnumValue("_PROCESSINFOCLASS", "ProcessOwnerInformation", 0x31)
+ProcessWindowInformation = EnumValue("_PROCESSINFOCLASS", "ProcessWindowInformation", 0x32)
+ProcessHandleInformation = EnumValue("_PROCESSINFOCLASS", "ProcessHandleInformation", 0x33)
+ProcessMitigationPolicy = EnumValue("_PROCESSINFOCLASS", "ProcessMitigationPolicy", 0x34)
+ProcessDynamicFunctionTableInformation = EnumValue("_PROCESSINFOCLASS", "ProcessDynamicFunctionTableInformation", 0x35)
+ProcessHandleCheckingMode = EnumValue("_PROCESSINFOCLASS", "ProcessHandleCheckingMode", 0x36)
+ProcessKeepAliveCount = EnumValue("_PROCESSINFOCLASS", "ProcessKeepAliveCount", 0x37)
+ProcessRevokeFileHandles = EnumValue("_PROCESSINFOCLASS", "ProcessRevokeFileHandles", 0x38)
+ProcessWorkingSetControl = EnumValue("_PROCESSINFOCLASS", "ProcessWorkingSetControl", 0x39)
+ProcessHandleTable = EnumValue("_PROCESSINFOCLASS", "ProcessHandleTable", 0x3a)
+ProcessCheckStackExtentsMode = EnumValue("_PROCESSINFOCLASS", "ProcessCheckStackExtentsMode", 0x3b)
+ProcessCommandLineInformation = EnumValue("_PROCESSINFOCLASS", "ProcessCommandLineInformation", 0x3c)
+ProcessProtectionInformation = EnumValue("_PROCESSINFOCLASS", "ProcessProtectionInformation", 0x3d)
+ProcessMemoryExhaustion = EnumValue("_PROCESSINFOCLASS", "ProcessMemoryExhaustion", 0x3e)
+ProcessFaultInformation = EnumValue("_PROCESSINFOCLASS", "ProcessFaultInformation", 0x3f)
+ProcessTelemetryIdInformation = EnumValue("_PROCESSINFOCLASS", "ProcessTelemetryIdInformation", 0x40)
+ProcessCommitReleaseInformation = EnumValue("_PROCESSINFOCLASS", "ProcessCommitReleaseInformation", 0x41)
+ProcessReserved1Information = EnumValue("_PROCESSINFOCLASS", "ProcessReserved1Information", 0x42)
+ProcessReserved2Information = EnumValue("_PROCESSINFOCLASS", "ProcessReserved2Information", 0x43)
+ProcessSubsystemProcess = EnumValue("_PROCESSINFOCLASS", "ProcessSubsystemProcess", 0x44)
+ProcessInPrivate = EnumValue("_PROCESSINFOCLASS", "ProcessInPrivate", 0x46)
+ProcessRaiseUMExceptionOnInvalidHandleClose = EnumValue("_PROCESSINFOCLASS", "ProcessRaiseUMExceptionOnInvalidHandleClose", 0x47)
+ProcessSubsystemInformation = EnumValue("_PROCESSINFOCLASS", "ProcessSubsystemInformation", 0x4b)
+ProcessWin32kSyscallFilterInformation = EnumValue("_PROCESSINFOCLASS", "ProcessWin32kSyscallFilterInformation", 0x4f)
+ProcessEnergyTrackingState = EnumValue("_PROCESSINFOCLASS", "ProcessEnergyTrackingState", 0x52)
+MaxProcessInfoClass = EnumValue("_PROCESSINFOCLASS", "MaxProcessInfoClass", 0x53)
+class _PROCESSINFOCLASS(EnumType):
+    values = [ProcessBasicInformation, ProcessQuotaLimits, ProcessIoCounters, ProcessVmCounters, ProcessTimes, ProcessBasePriority, ProcessRaisePriority, ProcessDebugPort, ProcessExceptionPort, ProcessAccessToken, ProcessLdtInformation, ProcessLdtSize, ProcessDefaultHardErrorMode, ProcessIoPortHandlers, ProcessPooledUsageAndLimits, ProcessWorkingSetWatch, ProcessUserModeIOPL, ProcessEnableAlignmentFaultFixup, ProcessPriorityClass, ProcessWx86Information, ProcessHandleCount, ProcessAffinityMask, ProcessPriorityBoost, ProcessDeviceMap, ProcessSessionInformation, ProcessForegroundInformation, ProcessWow64Information, ProcessImageFileName, ProcessLUIDDeviceMapsEnabled, ProcessBreakOnTermination, ProcessDebugObjectHandle, ProcessDebugFlags, ProcessHandleTracing, ProcessIoPriority, ProcessExecuteFlags, ProcessTlsInformation, ProcessCookie, ProcessImageInformation, ProcessCycleTime, ProcessPagePriority, ProcessInstrumentationCallback, ProcessThreadStackAllocation, ProcessWorkingSetWatchEx, ProcessImageFileNameWin32, ProcessImageFileMapping, ProcessAffinityUpdateMode, ProcessMemoryAllocationMode, ProcessGroupInformation, ProcessTokenVirtualizationEnabled, ProcessOwnerInformation, ProcessWindowInformation, ProcessHandleInformation, ProcessMitigationPolicy, ProcessDynamicFunctionTableInformation, ProcessHandleCheckingMode, ProcessKeepAliveCount, ProcessRevokeFileHandles, ProcessWorkingSetControl, ProcessHandleTable, ProcessCheckStackExtentsMode, ProcessCommandLineInformation, ProcessProtectionInformation, ProcessMemoryExhaustion, ProcessFaultInformation, ProcessTelemetryIdInformation, ProcessCommitReleaseInformation, ProcessReserved1Information, ProcessReserved2Information, ProcessSubsystemProcess, ProcessInPrivate, ProcessRaiseUMExceptionOnInvalidHandleClose, ProcessSubsystemInformation, ProcessWin32kSyscallFilterInformation, ProcessEnergyTrackingState, MaxProcessInfoClass]
+    mapper = FlagMapper(*values)
+PROCESSINFOCLASS = _PROCESSINFOCLASS
+
+
+ProcessMemoryPriority = EnumValue("_PROCESS_INFORMATION_CLASS", "ProcessMemoryPriority", 0x0)
+ProcessMemoryExhaustionInfo = EnumValue("_PROCESS_INFORMATION_CLASS", "ProcessMemoryExhaustionInfo", 0x1)
+ProcessAppMemoryInfo = EnumValue("_PROCESS_INFORMATION_CLASS", "ProcessAppMemoryInfo", 0x2)
+ProcessInPrivateInfo = EnumValue("_PROCESS_INFORMATION_CLASS", "ProcessInPrivateInfo", 0x3)
+ProcessPowerThrottling = EnumValue("_PROCESS_INFORMATION_CLASS", "ProcessPowerThrottling", 0x4)
+ProcessReservedValue1 = EnumValue("_PROCESS_INFORMATION_CLASS", "ProcessReservedValue1", 0x5)
+ProcessTelemetryCoverageInfo = EnumValue("_PROCESS_INFORMATION_CLASS", "ProcessTelemetryCoverageInfo", 0x6)
+ProcessProtectionLevelInfo = EnumValue("_PROCESS_INFORMATION_CLASS", "ProcessProtectionLevelInfo", 0x7)
+ProcessLeapSecondInfo = EnumValue("_PROCESS_INFORMATION_CLASS", "ProcessLeapSecondInfo", 0x8)
+ProcessMachineTypeInfo = EnumValue("_PROCESS_INFORMATION_CLASS", "ProcessMachineTypeInfo", 0x9)
+ProcessOverrideSubsequentPrefetchParameter = EnumValue("_PROCESS_INFORMATION_CLASS", "ProcessOverrideSubsequentPrefetchParameter", 0xa)
+ProcessMaxOverridePrefetchParameter = EnumValue("_PROCESS_INFORMATION_CLASS", "ProcessMaxOverridePrefetchParameter", 0xb)
+ProcessInformationClassMax = EnumValue("_PROCESS_INFORMATION_CLASS", "ProcessInformationClassMax", 0xc)
+class _PROCESS_INFORMATION_CLASS(EnumType):
+    values = [ProcessMemoryPriority, ProcessMemoryExhaustionInfo, ProcessAppMemoryInfo, ProcessInPrivateInfo, ProcessPowerThrottling, ProcessReservedValue1, ProcessTelemetryCoverageInfo, ProcessProtectionLevelInfo, ProcessLeapSecondInfo, ProcessMachineTypeInfo, ProcessOverrideSubsequentPrefetchParameter, ProcessMaxOverridePrefetchParameter, ProcessInformationClassMax]
+    mapper = FlagMapper(*values)
+PROCESS_INFORMATION_CLASS = _PROCESS_INFORMATION_CLASS
+
+
+UserEnabled = EnumValue("_MACHINE_ATTRIBUTES", "UserEnabled", 0x1)
+KernelEnabled = EnumValue("_MACHINE_ATTRIBUTES", "KernelEnabled", 0x2)
+Wow64Container = EnumValue("_MACHINE_ATTRIBUTES", "Wow64Container", 0x4)
+class _MACHINE_ATTRIBUTES(EnumType):
+    values = [UserEnabled, KernelEnabled, Wow64Container]
+    mapper = FlagMapper(*values)
+MACHINE_ATTRIBUTES = _MACHINE_ATTRIBUTES
+
+
+class _PROCESS_MACHINE_INFORMATION(Structure):
+    _fields_ = [
+        ("ProcessMachine", USHORT),
+        ("Res0", USHORT),
+        ("MachineAttributes", MACHINE_ATTRIBUTES),
+    ]
+PROCESS_MACHINE_INFORMATION = _PROCESS_MACHINE_INFORMATION
+
 MemExtendedParameterInvalidType = EnumValue("MEM_EXTENDED_PARAMETER_TYPE", "MemExtendedParameterInvalidType", 0x0)
 MemExtendedParameterAddressRequirements = EnumValue("MEM_EXTENDED_PARAMETER_TYPE", "MemExtendedParameterAddressRequirements", 0x1)
 MemExtendedParameterNumaNode = EnumValue("MEM_EXTENDED_PARAMETER_TYPE", "MemExtendedParameterNumaNode", 0x2)
@@ -4630,6 +4811,36 @@ class _SYSTEM_BASIC_INFORMATION(Structure):
 PSYSTEM_BASIC_INFORMATION = POINTER(_SYSTEM_BASIC_INFORMATION)
 SYSTEM_BASIC_INFORMATION = _SYSTEM_BASIC_INFORMATION
 
+class _ANON__ANON__SYSTEM_INFO_SUB_UNION_1_SUB_STRUCTURE_1(Structure):
+    _fields_ = [
+        ("wProcessorArchitecture", WORD),
+        ("wReserved", WORD),
+    ]
+
+class _ANON__SYSTEM_INFO_SUB_UNION_1(Union):
+    _anonymous_ = ("DUMMYSTRUCTNAME",)
+    _fields_ = [
+        ("dwOemId", DWORD),
+        ("DUMMYSTRUCTNAME", _ANON__ANON__SYSTEM_INFO_SUB_UNION_1_SUB_STRUCTURE_1),
+    ]
+
+class _SYSTEM_INFO(Structure):
+    _anonymous_ = ("DUMMYUNIONNAME",)
+    _fields_ = [
+        ("DUMMYUNIONNAME", _ANON__SYSTEM_INFO_SUB_UNION_1),
+        ("dwPageSize", DWORD),
+        ("lpMinimumApplicationAddress", LPVOID),
+        ("lpMaximumApplicationAddress", LPVOID),
+        ("dwActiveProcessorMask", DWORD_PTR),
+        ("dwNumberOfProcessors", DWORD),
+        ("dwProcessorType", DWORD),
+        ("dwAllocationGranularity", DWORD),
+        ("wProcessorLevel", WORD),
+        ("wProcessorRevision", WORD),
+    ]
+LPSYSTEM_INFO = POINTER(_SYSTEM_INFO)
+SYSTEM_INFO = _SYSTEM_INFO
+
 TASK_ACTION_EXEC = EnumValue("_TASK_ACTION_TYPE", "TASK_ACTION_EXEC", 0x0)
 TASK_ACTION_COM_HANDLER = EnumValue("_TASK_ACTION_TYPE", "TASK_ACTION_COM_HANDLER", 0x5)
 TASK_ACTION_SEND_EMAIL = EnumValue("_TASK_ACTION_TYPE", "TASK_ACTION_SEND_EMAIL", 0x6)
@@ -5001,6 +5212,313 @@ class _TEB(Structure):
     ]
 TEB = _TEB
 
+class _ANON__ARM64_NT_NEON128_SUB_STRUCTURE_1(Structure):
+    _fields_ = [
+        ("Low", ULONGLONG),
+        ("High", LONGLONG),
+    ]
+
+class _ARM64_NT_NEON128(Union):
+    _anonymous_ = ("DUMMYSTRUCTNAME",)
+    _fields_ = [
+        ("DUMMYSTRUCTNAME", _ANON__ARM64_NT_NEON128_SUB_STRUCTURE_1),
+        ("D", DOUBLE * (2)),
+        ("S", FLOAT * (4)),
+        ("H", WORD * (8)),
+        ("B", BYTE * (16)),
+    ]
+ARM64_NT_NEON128 = _ARM64_NT_NEON128
+PARM64_NT_NEON128 = POINTER(_ARM64_NT_NEON128)
+
+class _ANON__ANON__ARM64_NT_CONTEXT_SUB_UNION_1_SUB_STRUCTURE_1(Structure):
+    _fields_ = [
+        ("X0", DWORD64),
+        ("X1", DWORD64),
+        ("X2", DWORD64),
+        ("X3", DWORD64),
+        ("X4", DWORD64),
+        ("X5", DWORD64),
+        ("X6", DWORD64),
+        ("X7", DWORD64),
+        ("X8", DWORD64),
+        ("X9", DWORD64),
+        ("X10", DWORD64),
+        ("X11", DWORD64),
+        ("X12", DWORD64),
+        ("X13", DWORD64),
+        ("X14", DWORD64),
+        ("X15", DWORD64),
+        ("X16", DWORD64),
+        ("X17", DWORD64),
+        ("X18", DWORD64),
+        ("X19", DWORD64),
+        ("X20", DWORD64),
+        ("X21", DWORD64),
+        ("X22", DWORD64),
+        ("X23", DWORD64),
+        ("X24", DWORD64),
+        ("X25", DWORD64),
+        ("X26", DWORD64),
+        ("X27", DWORD64),
+        ("X28", DWORD64),
+        ("Fp", DWORD64),
+        ("Lr", DWORD64),
+    ]
+
+class _ANON__ARM64_NT_CONTEXT_SUB_UNION_1(Union):
+    _anonymous_ = ("DUMMYSTRUCTNAME",)
+    _fields_ = [
+        ("DUMMYSTRUCTNAME", _ANON__ANON__ARM64_NT_CONTEXT_SUB_UNION_1_SUB_STRUCTURE_1),
+        ("X", DWORD64 * (31)),
+    ]
+
+class _ARM64_NT_CONTEXT(Structure):
+    _anonymous_ = ("DUMMYUNIONNAME",)
+    _fields_ = [
+        ("ContextFlags", DWORD),
+        ("Cpsr", DWORD),
+        ("DUMMYUNIONNAME", _ANON__ARM64_NT_CONTEXT_SUB_UNION_1),
+        ("Sp", DWORD64),
+        ("Pc", DWORD64),
+        ("V", ARM64_NT_NEON128 * (32)),
+        ("Fpcr", DWORD),
+        ("Fpsr", DWORD),
+        ("Bcr", DWORD * (ARM64_MAX_BREAKPOINTS)),
+        ("Bvr", DWORD64 * (ARM64_MAX_BREAKPOINTS)),
+        ("Wcr", DWORD * (ARM64_MAX_WATCHPOINTS)),
+        ("Wvr", DWORD64 * (ARM64_MAX_WATCHPOINTS)),
+    ]
+ARM64_NT_CONTEXT = _ARM64_NT_CONTEXT
+PARM64_NT_CONTEXT = POINTER(_ARM64_NT_CONTEXT)
+
+class _FLOATING_SAVE_AREA(Structure):
+    _fields_ = [
+        ("ControlWord", DWORD),
+        ("StatusWord", DWORD),
+        ("TagWord", DWORD),
+        ("ErrorOffset", DWORD),
+        ("ErrorSelector", DWORD),
+        ("DataOffset", DWORD),
+        ("DataSelector", DWORD),
+        ("RegisterArea", BYTE * (80)),
+        ("Cr0NpxState", DWORD),
+    ]
+FLOATING_SAVE_AREA = _FLOATING_SAVE_AREA
+
+class _CONTEXT32(Structure):
+    _fields_ = [
+        ("ContextFlags", DWORD),
+        ("Dr0", DWORD),
+        ("Dr1", DWORD),
+        ("Dr2", DWORD),
+        ("Dr3", DWORD),
+        ("Dr6", DWORD),
+        ("Dr7", DWORD),
+        ("FloatSave", FLOATING_SAVE_AREA),
+        ("SegGs", DWORD),
+        ("SegFs", DWORD),
+        ("SegEs", DWORD),
+        ("SegDs", DWORD),
+        ("Edi", DWORD),
+        ("Esi", DWORD),
+        ("Ebx", DWORD),
+        ("Edx", DWORD),
+        ("Ecx", DWORD),
+        ("Eax", DWORD),
+        ("Ebp", DWORD),
+        ("Eip", DWORD),
+        ("SegCs", DWORD),
+        ("EFlags", DWORD),
+        ("Esp", DWORD),
+        ("SegSs", DWORD),
+        ("ExtendedRegisters", BYTE * (512)),
+    ]
+CONTEXT32 = _CONTEXT32
+LPCONTEXT32 = POINTER(_CONTEXT32)
+PCONTEXT32 = POINTER(_CONTEXT32)
+
+class _WOW64_FLOATING_SAVE_AREA(Structure):
+    _fields_ = [
+        ("ControlWord", DWORD),
+        ("StatusWord", DWORD),
+        ("TagWord", DWORD),
+        ("ErrorOffset", DWORD),
+        ("ErrorSelector", DWORD),
+        ("DataOffset", DWORD),
+        ("DataSelector", DWORD),
+        ("RegisterArea", BYTE * (WOW64_SIZE_OF_80387_REGISTERS)),
+        ("Cr0NpxState", DWORD),
+    ]
+WOW64_FLOATING_SAVE_AREA = _WOW64_FLOATING_SAVE_AREA
+
+class _WOW64_CONTEXT(Structure):
+    _fields_ = [
+        ("ContextFlags", DWORD),
+        ("Dr0", DWORD),
+        ("Dr1", DWORD),
+        ("Dr2", DWORD),
+        ("Dr3", DWORD),
+        ("Dr6", DWORD),
+        ("Dr7", DWORD),
+        ("FloatSave", WOW64_FLOATING_SAVE_AREA),
+        ("SegGs", DWORD),
+        ("SegFs", DWORD),
+        ("SegEs", DWORD),
+        ("SegDs", DWORD),
+        ("Edi", DWORD),
+        ("Esi", DWORD),
+        ("Ebx", DWORD),
+        ("Edx", DWORD),
+        ("Ecx", DWORD),
+        ("Eax", DWORD),
+        ("Ebp", DWORD),
+        ("Eip", DWORD),
+        ("SegCs", DWORD),
+        ("EFlags", DWORD),
+        ("Esp", DWORD),
+        ("SegSs", DWORD),
+        ("ExtendedRegisters", BYTE * (WOW64_MAXIMUM_SUPPORTED_EXTENSION)),
+    ]
+PWOW64_CONTEXT = POINTER(_WOW64_CONTEXT)
+WOW64_CONTEXT = _WOW64_CONTEXT
+
+class _M128A(Structure):
+    _fields_ = [
+        ("Low", ULONGLONG),
+        ("High", LONGLONG),
+    ]
+M128A = _M128A
+PM128A = POINTER(_M128A)
+
+class _XSAVE_FORMAT_64(Structure):
+    _fields_ = [
+        ("ControlWord", WORD),
+        ("StatusWord", WORD),
+        ("TagWord", BYTE),
+        ("Reserved1", BYTE),
+        ("ErrorOpcode", WORD),
+        ("ErrorOffset", DWORD),
+        ("ErrorSelector", WORD),
+        ("Reserved2", WORD),
+        ("DataOffset", DWORD),
+        ("DataSelector", WORD),
+        ("Reserved3", WORD),
+        ("MxCsr", DWORD),
+        ("MxCsr_Mask", DWORD),
+        ("FloatRegisters", M128A * (8)),
+        ("XmmRegisters", M128A * (16)),
+        ("Reserved4", BYTE * (96)),
+    ]
+PXSAVE_FORMAT_64 = POINTER(_XSAVE_FORMAT_64)
+XSAVE_FORMAT_64 = _XSAVE_FORMAT_64
+
+class _XSAVE_FORMAT_32(Structure):
+    _fields_ = [
+        ("ControlWord", WORD),
+        ("StatusWord", WORD),
+        ("TagWord", BYTE),
+        ("Reserved1", BYTE),
+        ("ErrorOpcode", WORD),
+        ("ErrorOffset", DWORD),
+        ("ErrorSelector", WORD),
+        ("Reserved2", WORD),
+        ("DataOffset", DWORD),
+        ("DataSelector", WORD),
+        ("Reserved3", WORD),
+        ("MxCsr", DWORD),
+        ("MxCsr_Mask", DWORD),
+        ("FloatRegisters", M128A * (8)),
+        ("XmmRegisters", M128A * (8)),
+        ("Reserved4", BYTE * (192)),
+        ("StackControl", DWORD * (7)),
+        ("Cr0NpxState", DWORD),
+    ]
+PXSAVE_FORMAT_32 = POINTER(_XSAVE_FORMAT_32)
+XSAVE_FORMAT_32 = _XSAVE_FORMAT_32
+
+class _ANON__ANON__CONTEXT64_SUB_UNION_1_SUB_STRUCTURE_1(Structure):
+    _fields_ = [
+        ("Header", M128A * (2)),
+        ("Legacy", M128A * (8)),
+        ("Xmm0", M128A),
+        ("Xmm1", M128A),
+        ("Xmm2", M128A),
+        ("Xmm3", M128A),
+        ("Xmm4", M128A),
+        ("Xmm5", M128A),
+        ("Xmm6", M128A),
+        ("Xmm7", M128A),
+        ("Xmm8", M128A),
+        ("Xmm9", M128A),
+        ("Xmm10", M128A),
+        ("Xmm11", M128A),
+        ("Xmm12", M128A),
+        ("Xmm13", M128A),
+        ("Xmm14", M128A),
+        ("Xmm15", M128A),
+    ]
+
+class _ANON__CONTEXT64_SUB_UNION_1(Union):
+    _anonymous_ = ("DUMMYSTRUCTNAME",)
+    _fields_ = [
+        ("FltSave", XSAVE_FORMAT_64),
+        ("DUMMYSTRUCTNAME", _ANON__ANON__CONTEXT64_SUB_UNION_1_SUB_STRUCTURE_1),
+    ]
+
+class _CONTEXT64(Structure):
+    _anonymous_ = ("DUMMYUNIONNAME",)
+    _fields_ = [
+        ("P1Home", DWORD64),
+        ("P2Home", DWORD64),
+        ("P3Home", DWORD64),
+        ("P4Home", DWORD64),
+        ("P5Home", DWORD64),
+        ("P6Home", DWORD64),
+        ("ContextFlags", DWORD),
+        ("MxCsr", DWORD),
+        ("SegCs", WORD),
+        ("SegDs", WORD),
+        ("SegEs", WORD),
+        ("SegFs", WORD),
+        ("SegGs", WORD),
+        ("SegSs", WORD),
+        ("EFlags", DWORD),
+        ("Dr0", DWORD64),
+        ("Dr1", DWORD64),
+        ("Dr2", DWORD64),
+        ("Dr3", DWORD64),
+        ("Dr6", DWORD64),
+        ("Dr7", DWORD64),
+        ("Rax", DWORD64),
+        ("Rcx", DWORD64),
+        ("Rdx", DWORD64),
+        ("Rbx", DWORD64),
+        ("Rsp", DWORD64),
+        ("Rbp", DWORD64),
+        ("Rsi", DWORD64),
+        ("Rdi", DWORD64),
+        ("R8", DWORD64),
+        ("R9", DWORD64),
+        ("R10", DWORD64),
+        ("R11", DWORD64),
+        ("R12", DWORD64),
+        ("R13", DWORD64),
+        ("R14", DWORD64),
+        ("R15", DWORD64),
+        ("Rip", DWORD64),
+        ("DUMMYUNIONNAME", _ANON__CONTEXT64_SUB_UNION_1),
+        ("VectorRegister", M128A * (26)),
+        ("VectorControl", DWORD64),
+        ("DebugControl", DWORD64),
+        ("LastBranchToRip", DWORD64),
+        ("LastBranchFromRip", DWORD64),
+        ("LastExceptionToRip", DWORD64),
+        ("LastExceptionFromRip", DWORD64),
+    ]
+CONTEXT64 = _CONTEXT64
+LPCONTEXT64 = POINTER(_CONTEXT64)
+PCONTEXT64 = POINTER(_CONTEXT64)
+
 class _TRACE_PROVIDER_INFO(Structure):
     _fields_ = [
         ("ProviderGuid", GUID),
@@ -5495,123 +6013,6 @@ class _SECTION_INHERIT(EnumType):
 SECTION_INHERIT = _SECTION_INHERIT
 
 
-ProcessBasicInformation = EnumValue("_PROCESSINFOCLASS", "ProcessBasicInformation", 0x0)
-ProcessQuotaLimits = EnumValue("_PROCESSINFOCLASS", "ProcessQuotaLimits", 0x1)
-ProcessIoCounters = EnumValue("_PROCESSINFOCLASS", "ProcessIoCounters", 0x2)
-ProcessVmCounters = EnumValue("_PROCESSINFOCLASS", "ProcessVmCounters", 0x3)
-ProcessTimes = EnumValue("_PROCESSINFOCLASS", "ProcessTimes", 0x4)
-ProcessBasePriority = EnumValue("_PROCESSINFOCLASS", "ProcessBasePriority", 0x5)
-ProcessRaisePriority = EnumValue("_PROCESSINFOCLASS", "ProcessRaisePriority", 0x6)
-ProcessDebugPort = EnumValue("_PROCESSINFOCLASS", "ProcessDebugPort", 0x7)
-ProcessExceptionPort = EnumValue("_PROCESSINFOCLASS", "ProcessExceptionPort", 0x8)
-ProcessAccessToken = EnumValue("_PROCESSINFOCLASS", "ProcessAccessToken", 0x9)
-ProcessLdtInformation = EnumValue("_PROCESSINFOCLASS", "ProcessLdtInformation", 0xa)
-ProcessLdtSize = EnumValue("_PROCESSINFOCLASS", "ProcessLdtSize", 0xb)
-ProcessDefaultHardErrorMode = EnumValue("_PROCESSINFOCLASS", "ProcessDefaultHardErrorMode", 0xc)
-ProcessIoPortHandlers = EnumValue("_PROCESSINFOCLASS", "ProcessIoPortHandlers", 0xd)
-ProcessPooledUsageAndLimits = EnumValue("_PROCESSINFOCLASS", "ProcessPooledUsageAndLimits", 0xe)
-ProcessWorkingSetWatch = EnumValue("_PROCESSINFOCLASS", "ProcessWorkingSetWatch", 0xf)
-ProcessUserModeIOPL = EnumValue("_PROCESSINFOCLASS", "ProcessUserModeIOPL", 0x10)
-ProcessEnableAlignmentFaultFixup = EnumValue("_PROCESSINFOCLASS", "ProcessEnableAlignmentFaultFixup", 0x11)
-ProcessPriorityClass = EnumValue("_PROCESSINFOCLASS", "ProcessPriorityClass", 0x12)
-ProcessWx86Information = EnumValue("_PROCESSINFOCLASS", "ProcessWx86Information", 0x13)
-ProcessHandleCount = EnumValue("_PROCESSINFOCLASS", "ProcessHandleCount", 0x14)
-ProcessAffinityMask = EnumValue("_PROCESSINFOCLASS", "ProcessAffinityMask", 0x15)
-ProcessPriorityBoost = EnumValue("_PROCESSINFOCLASS", "ProcessPriorityBoost", 0x16)
-ProcessDeviceMap = EnumValue("_PROCESSINFOCLASS", "ProcessDeviceMap", 0x17)
-ProcessSessionInformation = EnumValue("_PROCESSINFOCLASS", "ProcessSessionInformation", 0x18)
-ProcessForegroundInformation = EnumValue("_PROCESSINFOCLASS", "ProcessForegroundInformation", 0x19)
-ProcessWow64Information = EnumValue("_PROCESSINFOCLASS", "ProcessWow64Information", 0x1a)
-ProcessImageFileName = EnumValue("_PROCESSINFOCLASS", "ProcessImageFileName", 0x1b)
-ProcessLUIDDeviceMapsEnabled = EnumValue("_PROCESSINFOCLASS", "ProcessLUIDDeviceMapsEnabled", 0x1c)
-ProcessBreakOnTermination = EnumValue("_PROCESSINFOCLASS", "ProcessBreakOnTermination", 0x1d)
-ProcessDebugObjectHandle = EnumValue("_PROCESSINFOCLASS", "ProcessDebugObjectHandle", 0x1e)
-ProcessDebugFlags = EnumValue("_PROCESSINFOCLASS", "ProcessDebugFlags", 0x1f)
-ProcessHandleTracing = EnumValue("_PROCESSINFOCLASS", "ProcessHandleTracing", 0x20)
-ProcessIoPriority = EnumValue("_PROCESSINFOCLASS", "ProcessIoPriority", 0x21)
-ProcessExecuteFlags = EnumValue("_PROCESSINFOCLASS", "ProcessExecuteFlags", 0x22)
-ProcessTlsInformation = EnumValue("_PROCESSINFOCLASS", "ProcessTlsInformation", 0x23)
-ProcessCookie = EnumValue("_PROCESSINFOCLASS", "ProcessCookie", 0x24)
-ProcessImageInformation = EnumValue("_PROCESSINFOCLASS", "ProcessImageInformation", 0x25)
-ProcessCycleTime = EnumValue("_PROCESSINFOCLASS", "ProcessCycleTime", 0x26)
-ProcessPagePriority = EnumValue("_PROCESSINFOCLASS", "ProcessPagePriority", 0x27)
-ProcessInstrumentationCallback = EnumValue("_PROCESSINFOCLASS", "ProcessInstrumentationCallback", 0x28)
-ProcessThreadStackAllocation = EnumValue("_PROCESSINFOCLASS", "ProcessThreadStackAllocation", 0x29)
-ProcessWorkingSetWatchEx = EnumValue("_PROCESSINFOCLASS", "ProcessWorkingSetWatchEx", 0x2a)
-ProcessImageFileNameWin32 = EnumValue("_PROCESSINFOCLASS", "ProcessImageFileNameWin32", 0x2b)
-ProcessImageFileMapping = EnumValue("_PROCESSINFOCLASS", "ProcessImageFileMapping", 0x2c)
-ProcessAffinityUpdateMode = EnumValue("_PROCESSINFOCLASS", "ProcessAffinityUpdateMode", 0x2d)
-ProcessMemoryAllocationMode = EnumValue("_PROCESSINFOCLASS", "ProcessMemoryAllocationMode", 0x2e)
-ProcessGroupInformation = EnumValue("_PROCESSINFOCLASS", "ProcessGroupInformation", 0x2f)
-ProcessTokenVirtualizationEnabled = EnumValue("_PROCESSINFOCLASS", "ProcessTokenVirtualizationEnabled", 0x30)
-ProcessOwnerInformation = EnumValue("_PROCESSINFOCLASS", "ProcessOwnerInformation", 0x31)
-ProcessWindowInformation = EnumValue("_PROCESSINFOCLASS", "ProcessWindowInformation", 0x32)
-ProcessHandleInformation = EnumValue("_PROCESSINFOCLASS", "ProcessHandleInformation", 0x33)
-ProcessMitigationPolicy = EnumValue("_PROCESSINFOCLASS", "ProcessMitigationPolicy", 0x34)
-ProcessDynamicFunctionTableInformation = EnumValue("_PROCESSINFOCLASS", "ProcessDynamicFunctionTableInformation", 0x35)
-ProcessHandleCheckingMode = EnumValue("_PROCESSINFOCLASS", "ProcessHandleCheckingMode", 0x36)
-ProcessKeepAliveCount = EnumValue("_PROCESSINFOCLASS", "ProcessKeepAliveCount", 0x37)
-ProcessRevokeFileHandles = EnumValue("_PROCESSINFOCLASS", "ProcessRevokeFileHandles", 0x38)
-ProcessWorkingSetControl = EnumValue("_PROCESSINFOCLASS", "ProcessWorkingSetControl", 0x39)
-ProcessHandleTable = EnumValue("_PROCESSINFOCLASS", "ProcessHandleTable", 0x3a)
-ProcessCheckStackExtentsMode = EnumValue("_PROCESSINFOCLASS", "ProcessCheckStackExtentsMode", 0x3b)
-ProcessCommandLineInformation = EnumValue("_PROCESSINFOCLASS", "ProcessCommandLineInformation", 0x3c)
-ProcessProtectionInformation = EnumValue("_PROCESSINFOCLASS", "ProcessProtectionInformation", 0x3d)
-ProcessMemoryExhaustion = EnumValue("_PROCESSINFOCLASS", "ProcessMemoryExhaustion", 0x3e)
-ProcessFaultInformation = EnumValue("_PROCESSINFOCLASS", "ProcessFaultInformation", 0x3f)
-ProcessTelemetryIdInformation = EnumValue("_PROCESSINFOCLASS", "ProcessTelemetryIdInformation", 0x40)
-ProcessCommitReleaseInformation = EnumValue("_PROCESSINFOCLASS", "ProcessCommitReleaseInformation", 0x41)
-ProcessReserved1Information = EnumValue("_PROCESSINFOCLASS", "ProcessReserved1Information", 0x42)
-ProcessReserved2Information = EnumValue("_PROCESSINFOCLASS", "ProcessReserved2Information", 0x43)
-ProcessSubsystemProcess = EnumValue("_PROCESSINFOCLASS", "ProcessSubsystemProcess", 0x44)
-ProcessInPrivate = EnumValue("_PROCESSINFOCLASS", "ProcessInPrivate", 0x46)
-ProcessRaiseUMExceptionOnInvalidHandleClose = EnumValue("_PROCESSINFOCLASS", "ProcessRaiseUMExceptionOnInvalidHandleClose", 0x47)
-ProcessSubsystemInformation = EnumValue("_PROCESSINFOCLASS", "ProcessSubsystemInformation", 0x4b)
-ProcessWin32kSyscallFilterInformation = EnumValue("_PROCESSINFOCLASS", "ProcessWin32kSyscallFilterInformation", 0x4f)
-ProcessEnergyTrackingState = EnumValue("_PROCESSINFOCLASS", "ProcessEnergyTrackingState", 0x52)
-MaxProcessInfoClass = EnumValue("_PROCESSINFOCLASS", "MaxProcessInfoClass", 0x53)
-class _PROCESSINFOCLASS(EnumType):
-    values = [ProcessBasicInformation, ProcessQuotaLimits, ProcessIoCounters, ProcessVmCounters, ProcessTimes, ProcessBasePriority, ProcessRaisePriority, ProcessDebugPort, ProcessExceptionPort, ProcessAccessToken, ProcessLdtInformation, ProcessLdtSize, ProcessDefaultHardErrorMode, ProcessIoPortHandlers, ProcessPooledUsageAndLimits, ProcessWorkingSetWatch, ProcessUserModeIOPL, ProcessEnableAlignmentFaultFixup, ProcessPriorityClass, ProcessWx86Information, ProcessHandleCount, ProcessAffinityMask, ProcessPriorityBoost, ProcessDeviceMap, ProcessSessionInformation, ProcessForegroundInformation, ProcessWow64Information, ProcessImageFileName, ProcessLUIDDeviceMapsEnabled, ProcessBreakOnTermination, ProcessDebugObjectHandle, ProcessDebugFlags, ProcessHandleTracing, ProcessIoPriority, ProcessExecuteFlags, ProcessTlsInformation, ProcessCookie, ProcessImageInformation, ProcessCycleTime, ProcessPagePriority, ProcessInstrumentationCallback, ProcessThreadStackAllocation, ProcessWorkingSetWatchEx, ProcessImageFileNameWin32, ProcessImageFileMapping, ProcessAffinityUpdateMode, ProcessMemoryAllocationMode, ProcessGroupInformation, ProcessTokenVirtualizationEnabled, ProcessOwnerInformation, ProcessWindowInformation, ProcessHandleInformation, ProcessMitigationPolicy, ProcessDynamicFunctionTableInformation, ProcessHandleCheckingMode, ProcessKeepAliveCount, ProcessRevokeFileHandles, ProcessWorkingSetControl, ProcessHandleTable, ProcessCheckStackExtentsMode, ProcessCommandLineInformation, ProcessProtectionInformation, ProcessMemoryExhaustion, ProcessFaultInformation, ProcessTelemetryIdInformation, ProcessCommitReleaseInformation, ProcessReserved1Information, ProcessReserved2Information, ProcessSubsystemProcess, ProcessInPrivate, ProcessRaiseUMExceptionOnInvalidHandleClose, ProcessSubsystemInformation, ProcessWin32kSyscallFilterInformation, ProcessEnergyTrackingState, MaxProcessInfoClass]
-    mapper = FlagMapper(*values)
-PROCESSINFOCLASS = _PROCESSINFOCLASS
-
-
-MemoryBasicInformation = EnumValue("_MEMORY_INFORMATION_CLASS", "MemoryBasicInformation", 0x0)
-MemoryWorkingSetList = EnumValue("_MEMORY_INFORMATION_CLASS", "MemoryWorkingSetList", 0x1)
-MemorySectionName = EnumValue("_MEMORY_INFORMATION_CLASS", "MemorySectionName", 0x2)
-MemoryBasicVlmInformation = EnumValue("_MEMORY_INFORMATION_CLASS", "MemoryBasicVlmInformation", 0x3)
-MemoryWorkingSetListEx = EnumValue("_MEMORY_INFORMATION_CLASS", "MemoryWorkingSetListEx", 0x4)
-class _MEMORY_INFORMATION_CLASS(EnumType):
-    values = [MemoryBasicInformation, MemoryWorkingSetList, MemorySectionName, MemoryBasicVlmInformation, MemoryWorkingSetListEx]
-    mapper = FlagMapper(*values)
-MEMORY_INFORMATION_CLASS = _MEMORY_INFORMATION_CLASS
-
-
-ThreadBasicInformation = EnumValue("_THREAD_INFORMATION_CLASS", "ThreadBasicInformation", 0x0)
-ThreadTimes = EnumValue("_THREAD_INFORMATION_CLASS", "ThreadTimes", 0x1)
-ThreadPriority = EnumValue("_THREAD_INFORMATION_CLASS", "ThreadPriority", 0x2)
-ThreadBasePriority = EnumValue("_THREAD_INFORMATION_CLASS", "ThreadBasePriority", 0x3)
-ThreadAffinityMask = EnumValue("_THREAD_INFORMATION_CLASS", "ThreadAffinityMask", 0x4)
-ThreadImpersonationToken = EnumValue("_THREAD_INFORMATION_CLASS", "ThreadImpersonationToken", 0x5)
-ThreadDescriptorTableEntry = EnumValue("_THREAD_INFORMATION_CLASS", "ThreadDescriptorTableEntry", 0x6)
-ThreadEnableAlignmentFaultFixup = EnumValue("_THREAD_INFORMATION_CLASS", "ThreadEnableAlignmentFaultFixup", 0x7)
-ThreadEventPair = EnumValue("_THREAD_INFORMATION_CLASS", "ThreadEventPair", 0x8)
-ThreadQuerySetWin32StartAddress = EnumValue("_THREAD_INFORMATION_CLASS", "ThreadQuerySetWin32StartAddress", 0x9)
-ThreadZeroTlsCell = EnumValue("_THREAD_INFORMATION_CLASS", "ThreadZeroTlsCell", 0xa)
-ThreadPerformanceCount = EnumValue("_THREAD_INFORMATION_CLASS", "ThreadPerformanceCount", 0xb)
-ThreadAmILastThread = EnumValue("_THREAD_INFORMATION_CLASS", "ThreadAmILastThread", 0xc)
-ThreadIdealProcessor = EnumValue("_THREAD_INFORMATION_CLASS", "ThreadIdealProcessor", 0xd)
-ThreadPriorityBoost = EnumValue("_THREAD_INFORMATION_CLASS", "ThreadPriorityBoost", 0xe)
-ThreadSetTlsArrayAddress = EnumValue("_THREAD_INFORMATION_CLASS", "ThreadSetTlsArrayAddress", 0xf)
-ThreadIsIoPending = EnumValue("_THREAD_INFORMATION_CLASS", "ThreadIsIoPending", 0x10)
-ThreadHideFromDebugger = EnumValue("_THREAD_INFORMATION_CLASS", "ThreadHideFromDebugger", 0x11)
-class _THREAD_INFORMATION_CLASS(EnumType):
-    values = [ThreadBasicInformation, ThreadTimes, ThreadPriority, ThreadBasePriority, ThreadAffinityMask, ThreadImpersonationToken, ThreadDescriptorTableEntry, ThreadEnableAlignmentFaultFixup, ThreadEventPair, ThreadQuerySetWin32StartAddress, ThreadZeroTlsCell, ThreadPerformanceCount, ThreadAmILastThread, ThreadIdealProcessor, ThreadPriorityBoost, ThreadSetTlsArrayAddress, ThreadIsIoPending, ThreadHideFromDebugger]
-    mapper = FlagMapper(*values)
-PTHREAD_INFORMATION_CLASS = POINTER(_THREAD_INFORMATION_CLASS)
-THREAD_INFORMATION_CLASS = _THREAD_INFORMATION_CLASS
-
-
 VT_EMPTY = EnumValue("_VARENUM", "VT_EMPTY", 0x0)
 VT_NULL = EnumValue("_VARENUM", "VT_NULL", 0x1)
 VT_I2 = EnumValue("_VARENUM", "VT_I2", 0x2)
@@ -6227,234 +6628,6 @@ LPPROCESS_INFORMATION = POINTER(_PROCESS_INFORMATION)
 PPROCESS_INFORMATION = POINTER(_PROCESS_INFORMATION)
 PROCESS_INFORMATION = _PROCESS_INFORMATION
 
-class _FLOATING_SAVE_AREA(Structure):
-    _fields_ = [
-        ("ControlWord", DWORD),
-        ("StatusWord", DWORD),
-        ("TagWord", DWORD),
-        ("ErrorOffset", DWORD),
-        ("ErrorSelector", DWORD),
-        ("DataOffset", DWORD),
-        ("DataSelector", DWORD),
-        ("RegisterArea", BYTE * (80)),
-        ("Cr0NpxState", DWORD),
-    ]
-FLOATING_SAVE_AREA = _FLOATING_SAVE_AREA
-
-class _CONTEXT32(Structure):
-    _fields_ = [
-        ("ContextFlags", DWORD),
-        ("Dr0", DWORD),
-        ("Dr1", DWORD),
-        ("Dr2", DWORD),
-        ("Dr3", DWORD),
-        ("Dr6", DWORD),
-        ("Dr7", DWORD),
-        ("FloatSave", FLOATING_SAVE_AREA),
-        ("SegGs", DWORD),
-        ("SegFs", DWORD),
-        ("SegEs", DWORD),
-        ("SegDs", DWORD),
-        ("Edi", DWORD),
-        ("Esi", DWORD),
-        ("Ebx", DWORD),
-        ("Edx", DWORD),
-        ("Ecx", DWORD),
-        ("Eax", DWORD),
-        ("Ebp", DWORD),
-        ("Eip", DWORD),
-        ("SegCs", DWORD),
-        ("EFlags", DWORD),
-        ("Esp", DWORD),
-        ("SegSs", DWORD),
-        ("ExtendedRegisters", BYTE * (512)),
-    ]
-CONTEXT32 = _CONTEXT32
-LPCONTEXT32 = POINTER(_CONTEXT32)
-PCONTEXT32 = POINTER(_CONTEXT32)
-
-class _WOW64_FLOATING_SAVE_AREA(Structure):
-    _fields_ = [
-        ("ControlWord", DWORD),
-        ("StatusWord", DWORD),
-        ("TagWord", DWORD),
-        ("ErrorOffset", DWORD),
-        ("ErrorSelector", DWORD),
-        ("DataOffset", DWORD),
-        ("DataSelector", DWORD),
-        ("RegisterArea", BYTE * (WOW64_SIZE_OF_80387_REGISTERS)),
-        ("Cr0NpxState", DWORD),
-    ]
-WOW64_FLOATING_SAVE_AREA = _WOW64_FLOATING_SAVE_AREA
-
-class _WOW64_CONTEXT(Structure):
-    _fields_ = [
-        ("ContextFlags", DWORD),
-        ("Dr0", DWORD),
-        ("Dr1", DWORD),
-        ("Dr2", DWORD),
-        ("Dr3", DWORD),
-        ("Dr6", DWORD),
-        ("Dr7", DWORD),
-        ("FloatSave", WOW64_FLOATING_SAVE_AREA),
-        ("SegGs", DWORD),
-        ("SegFs", DWORD),
-        ("SegEs", DWORD),
-        ("SegDs", DWORD),
-        ("Edi", DWORD),
-        ("Esi", DWORD),
-        ("Ebx", DWORD),
-        ("Edx", DWORD),
-        ("Ecx", DWORD),
-        ("Eax", DWORD),
-        ("Ebp", DWORD),
-        ("Eip", DWORD),
-        ("SegCs", DWORD),
-        ("EFlags", DWORD),
-        ("Esp", DWORD),
-        ("SegSs", DWORD),
-        ("ExtendedRegisters", BYTE * (WOW64_MAXIMUM_SUPPORTED_EXTENSION)),
-    ]
-PWOW64_CONTEXT = POINTER(_WOW64_CONTEXT)
-WOW64_CONTEXT = _WOW64_CONTEXT
-
-class _M128A(Structure):
-    _fields_ = [
-        ("Low", ULONGLONG),
-        ("High", LONGLONG),
-    ]
-M128A = _M128A
-PM128A = POINTER(_M128A)
-
-class _XSAVE_FORMAT_64(Structure):
-    _fields_ = [
-        ("ControlWord", WORD),
-        ("StatusWord", WORD),
-        ("TagWord", BYTE),
-        ("Reserved1", BYTE),
-        ("ErrorOpcode", WORD),
-        ("ErrorOffset", DWORD),
-        ("ErrorSelector", WORD),
-        ("Reserved2", WORD),
-        ("DataOffset", DWORD),
-        ("DataSelector", WORD),
-        ("Reserved3", WORD),
-        ("MxCsr", DWORD),
-        ("MxCsr_Mask", DWORD),
-        ("FloatRegisters", M128A * (8)),
-        ("XmmRegisters", M128A * (16)),
-        ("Reserved4", BYTE * (96)),
-    ]
-PXSAVE_FORMAT_64 = POINTER(_XSAVE_FORMAT_64)
-XSAVE_FORMAT_64 = _XSAVE_FORMAT_64
-
-class _XSAVE_FORMAT_32(Structure):
-    _fields_ = [
-        ("ControlWord", WORD),
-        ("StatusWord", WORD),
-        ("TagWord", BYTE),
-        ("Reserved1", BYTE),
-        ("ErrorOpcode", WORD),
-        ("ErrorOffset", DWORD),
-        ("ErrorSelector", WORD),
-        ("Reserved2", WORD),
-        ("DataOffset", DWORD),
-        ("DataSelector", WORD),
-        ("Reserved3", WORD),
-        ("MxCsr", DWORD),
-        ("MxCsr_Mask", DWORD),
-        ("FloatRegisters", M128A * (8)),
-        ("XmmRegisters", M128A * (8)),
-        ("Reserved4", BYTE * (192)),
-        ("StackControl", DWORD * (7)),
-        ("Cr0NpxState", DWORD),
-    ]
-PXSAVE_FORMAT_32 = POINTER(_XSAVE_FORMAT_32)
-XSAVE_FORMAT_32 = _XSAVE_FORMAT_32
-
-class _TMP_DUMMYSTRUCTNAME(Structure):
-    _fields_ = [
-        ("Header", M128A * (2)),
-        ("Legacy", M128A * (8)),
-        ("Xmm0", M128A),
-        ("Xmm1", M128A),
-        ("Xmm2", M128A),
-        ("Xmm3", M128A),
-        ("Xmm4", M128A),
-        ("Xmm5", M128A),
-        ("Xmm6", M128A),
-        ("Xmm7", M128A),
-        ("Xmm8", M128A),
-        ("Xmm9", M128A),
-        ("Xmm10", M128A),
-        ("Xmm11", M128A),
-        ("Xmm12", M128A),
-        ("Xmm13", M128A),
-        ("Xmm14", M128A),
-        ("Xmm15", M128A),
-    ]
-TMP_DUMMYSTRUCTNAME = _TMP_DUMMYSTRUCTNAME
-
-class _TMP_CONTEXT64_SUBUNION(Union):
-    _fields_ = [
-        ("FltSave", XSAVE_FORMAT_64),
-        ("DUMMYSTRUCTNAME", TMP_DUMMYSTRUCTNAME),
-    ]
-TMP_CONTEXT64_SUBUNION = _TMP_CONTEXT64_SUBUNION
-
-class _CONTEXT64(Structure):
-    _fields_ = [
-        ("P1Home", DWORD64),
-        ("P2Home", DWORD64),
-        ("P3Home", DWORD64),
-        ("P4Home", DWORD64),
-        ("P5Home", DWORD64),
-        ("P6Home", DWORD64),
-        ("ContextFlags", DWORD),
-        ("MxCsr", DWORD),
-        ("SegCs", WORD),
-        ("SegDs", WORD),
-        ("SegEs", WORD),
-        ("SegFs", WORD),
-        ("SegGs", WORD),
-        ("SegSs", WORD),
-        ("EFlags", DWORD),
-        ("Dr0", DWORD64),
-        ("Dr1", DWORD64),
-        ("Dr2", DWORD64),
-        ("Dr3", DWORD64),
-        ("Dr6", DWORD64),
-        ("Dr7", DWORD64),
-        ("Rax", DWORD64),
-        ("Rcx", DWORD64),
-        ("Rdx", DWORD64),
-        ("Rbx", DWORD64),
-        ("Rsp", DWORD64),
-        ("Rbp", DWORD64),
-        ("Rsi", DWORD64),
-        ("Rdi", DWORD64),
-        ("R8", DWORD64),
-        ("R9", DWORD64),
-        ("R10", DWORD64),
-        ("R11", DWORD64),
-        ("R12", DWORD64),
-        ("R13", DWORD64),
-        ("R14", DWORD64),
-        ("R15", DWORD64),
-        ("Rip", DWORD64),
-        ("DUMMYUNIONNAME", TMP_CONTEXT64_SUBUNION),
-        ("VectorRegister", M128A * (26)),
-        ("VectorControl", DWORD64),
-        ("DebugControl", DWORD64),
-        ("LastBranchToRip", DWORD64),
-        ("LastBranchFromRip", DWORD64),
-        ("LastExceptionToRip", DWORD64),
-        ("LastExceptionFromRip", DWORD64),
-    ]
-CONTEXT64 = _CONTEXT64
-LPCONTEXT64 = POINTER(_CONTEXT64)
-PCONTEXT64 = POINTER(_CONTEXT64)
-
 class tagPROCESSENTRY32W(Structure):
     _fields_ = [
         ("dwSize", DWORD),

windows/injection.py

@@ -184,6 +184,8 @@ def perform_manual_getproc_loadlib(target, *args, **kwargs):
 
 
 def load_dll_in_remote_process(target, dll_path):
+    if target.architecture == gdef.IMAGE_FILE_MACHINE_ARM64:
+        raise NotImplementedError("Injection in ARM64 target process is not implemented")
     rpeb = target.peb
     if rpeb.Ldr:
         # LDR est parcourable, ca va etre deja plus simple..
@@ -372,6 +374,8 @@ def generate_python_exec_shellcode_64(target, PyDll):
 
 def inject_python_command(target, code_injected, PYDLL):
     """Postulate: PYDLL is already loaded in target process"""
+    if target.architecture == gdef.IMAGE_FILE_MACHINE_ARM64:
+        raise NotImplementedError("Injection in ARM64 target process is not implemented")
     PYCODE = code_injected + "\x00"
     # TODO: free this (how ? when ?)
     remote_python_code_addr = target.virtual_alloc(len(PYCODE))

windows/native_exec/simple_arm64.py

@@ -0,0 +1,627 @@
+# -*- coding: utf-8 -*-
+import sys
+import collections
+import struct
+import binascii
+import operator
+
+
+# py3
+is_py3 = (sys.version_info.major >= 3)
+if is_py3:
+    basestring = str
+    int_types = int
+else:
+    int_types = (int, long)
+
+# https://documentation-service.arm.com/static/67581b3355451e3c38d97c22
+# Chapter C4: A64 Instruction Set Encoding: :
+
+## C2.1.3
+# 32-bit variant (sf = 0).
+# 64-bit variant (sf = 1).
+
+## C2.1.5
+# The following symbol conventions are used:
+# <Xn> The 64-bit name of a general-purpose register (X0-X30) or the zero register (XZR).
+# <Wn> The 32-bit name of a general-purpose register (W0-W30) or the zero register (WZR).
+# <Xn|SP> The 64-bit name of a general-purpose register (X0-X30) or the current stack pointer (SP).
+# <Wn|WSP> The 32-bit name of a general-purpose register (W0-W30) or the current stack pointer (WSP).
+# <Bn>, <Hn>, <Sn>, <Dn>, <Qn>
+# The 8, 16, 32, 64, or 128-bit name of a SIMD and floating-point register in a scalar context, as
+# described in Register names.
+# <Vn> The name of a SIMD and floating-point register in a vector context, as described in Register names.
+# <Zn> The name of an SVE scalable vector register, as described in Treatment of SVE scalable vector
+# registers.
+# <Pn> The name of an SVE scalable predicate register, as described in Vector predication
+
+
+# Make a special memoryview that match what is show in the ARM Chapter C4 ?
+
+# A lot of hardcoded bits are filled this way:
+
+## self.bits[24:32] = reversed(bytearray(XXX))
+
+# This allow to write the bits in the same order as the ARM manual which is describe with most significant bit first
+# Whereas our internal structure is reverse for simplicity of mapping it on list index
+
+XREGISTER = {'X0', 'X1', 'X2', 'X3', 'X4', 'X5', 'X6', 'X7', 'X8', 'X9', 'X10', 'X11', 'X12', 'X13', 'X14', 'X15', 'X16', 'X17', 'X18', 'X19', 'X20', 'X21', 'X22', 'X23', 'X24', 'X25', 'X26', 'X27', 'X28', 'X29', 'X30'}
+WREGISTER = {'W0', 'W1', 'W2', 'W3', 'W4', 'W5', 'W6', 'W7', 'W8', 'W9', 'W10', 'W11', 'W12', 'W13', 'W14', 'W15', 'W16', 'W17', 'W18', 'W19', 'W20', 'W21', 'W22', 'W23', 'W24', 'W25', 'W26', 'W27', 'W28', 'W29', 'W30'}
+ALL_REGISTER = XREGISTER | WREGISTER
+
+SP = "SP"
+WSP = "WSP"
+
+ZR = "XZR"
+WZR = "WZR"
+# Special register name for simple_arm64 that do not setup bitness
+# Bitness will depends on others registers in the instruction
+ZERO = "ZERO"
+
+SPECIAL_X31 = set((SP, WSP, ZR, WZR, ZERO))
+
+# Argument class
+class Shift(object):
+    """Represent a shift parameter of an instruction.
+    Allow to JIT shift at instruction crafting time without string manipulation for the #XXX"""
+    def __init__(self, type, value):
+        assert isinstance(type, str)
+        assert isinstance(value, int)
+        type = type.upper()
+        assert type in ("LSL", "LSR", "ASR", "ROR")
+        self.type = type
+        self.value = value
+
+    def __eq__(self, other):
+        if not isinstance(other, Shift): # Allow compare to tuple & iterable
+            return ((len(other) == 2) and
+                    (self.type == other[0]) and
+                    (self.value == other[1]))
+        return (self.type == other.type) and (self.value == other.value)
+
+    def __repr__(self):
+        return """{0}(type={1}, value={2})""".format(type(self).__name__, self.type, self.value)
+
+    @classmethod
+    def parse(cls, shiftstr):
+        if not isinstance(shiftstr, str):
+            return None
+        if not shiftstr.count(" ") == 1:
+            return None
+        stype, svalue = shiftstr.split(" ", 1)
+        stype = stype.upper()
+        if stype not in ("LSL", "LSR", "ASR", "ROR"):
+            return None
+        if len(svalue) <= 1:
+            return None
+        if not svalue.startswith("#"):
+            return None
+        try:
+            intvalue = int(svalue[1:])
+        except ValueError:
+            return None
+        return cls(stype, intvalue)
+# instruction Encoding
+
+class InstructionEncoding(object):
+    # Sub classes can force 32/64 only instrs by setting this to 32 or 64
+    BITNESS = None
+
+    def __init__(self):
+        super(InstructionEncoding, self).__init__()
+        # Bits are in
+        # 0 1 2 3 4 ... 31
+        # Translation to real little-endian is done last
+        self.bytearray = bytearray(32)
+        self.bits = memoryview(self.bytearray)
+
+        self.bitness = self.BITNESS
+
+    @classmethod
+    def is_register(self, arg, accept_sp=False):
+        arg = arg.upper()
+        return (arg in ALL_REGISTER or
+                (accept_sp and (arg in [SP, WSP])) or
+                (not accept_sp and (arg in [ZR, WZR, ZERO])))
+
+    @classmethod
+    def is_imm(self, arg):
+        try:
+            value = int(arg)
+        except (ValueError, TypeError):
+            return False
+        return True # Check size max ?
+
+    @classmethod
+    def is_shift(self, arg):
+        return (arg is None) or isinstance(arg, Shift) or Shift.parse(arg)
+
+
+    @classmethod
+    def gen(cls, **encoding_array):
+        class GeneratedEncodingCls(cls):
+            ENCODING_VALUES = encoding_array
+        return GeneratedEncodingCls
+
+    # Instruction filing at instanciation
+
+    def setup_fixed_values(self):
+        # Setup the values registered by InstructionEncoding.gen(x=1, y=2)
+        for name, value in self.ENCODING_VALUES.items():
+            assert isinstance(value, int)
+            self.setup_immediat(getattr(self, name), value)
+
+    def binencode_imm(self, immediat, outsize):
+        binstr = "{:0{outsize}b}".format(immediat, outsize=outsize)
+        if len(binstr) != outsize:
+            raise ValueError("Could not encode immediat {0} in {1} bits. Value take {2} bits".format(immediat, outsize, len(binstr)))
+
+        binlist = [int(c) for c in reversed(binstr)]
+        return bytearray(binlist)
+
+    def setup_bitness(self, bitness):
+        assert bitness in (32, 64)
+        if self.bitness is None:
+            self.bitness = bitness
+            if bitness == 32:
+                self.sf[:] = b"\x00"
+            else: # bitness == 64:
+                self.sf[:] = b"\x01"
+        if self.bitness != bitness:
+            raise ValueError("Bitness mismatch on <{0}> encoding, instruction is alredy {1} cannot set as {2}".format(type(self).__name__, self.bitness, bitness))
+
+    def encode_register(self, register, outsize=5):
+        register = register.upper()
+        if register in SPECIAL_X31:
+            if register == ZERO:
+                pass # Special simple_arm64 value that do not setup bitness
+            elif register.startswith("W"):
+               self.setup_bitness(32)
+            else:
+                self.setup_bitness(64)
+            return self.binencode_imm(31, outsize)
+
+        assert register in ALL_REGISTER
+        if register in XREGISTER:
+            self.setup_bitness(64)
+        else:
+            self.setup_bitness(32)
+        return self.binencode_imm(int(register[1:]), outsize)
+
+    def setup_register(self, regfield, register):
+        encoded = self.encode_register(register)
+        regfield[:] = encoded
+
+    # Instruction filing at instanciation
+    def setup_immediat(self, immfield, value):
+        immsize = len(immfield)
+        immfield[:] = self.binencode_imm(value, immsize)
+        return True
+
+
+
+# C4.1.93 Data Processing - Immediate
+
+class DataProcessingImmediate(InstructionEncoding):
+    def __init__(self):
+        super(DataProcessingImmediate, self).__init__()
+        self.bits[26:29] = bytearray((0,0,1))
+        self.op0 = self.bits[29:31]
+        self.op1 = self.bits[22:26]
+
+class AddSubtractImmediate(DataProcessingImmediate):
+    def __init__(self, argsdict):
+        super(AddSubtractImmediate, self).__init__()
+        self.sf = self.bits[31:32] # Keep it a memoryview
+        self.op = self.bits[30:31] # Keep it a memoryview
+        self.S = self.bits[29:30] # Keep it a memoryview
+        self.bits[23:29] = bytearray((0, 1, 0, 0, 0, 1))
+        self.sh = self.bits[22:23]
+        self.imm12 = self.bits[10:22]
+        self.rn = self.bits[5:10]
+        self.rd = self.bits[0:5]
+
+
+        self.setup_fixed_values()
+        # Change instruction based of parameter
+        self.setup_register(self.rd, argsdict[0])
+        self.setup_register(self.rn, argsdict[1])
+        self.setup_immediat(self.imm12, argsdict[2])
+
+        shift = Shift.parse(argsdict.get(3))
+        if not shift:
+            return
+
+        if shift not in [("LSL", 0), ("LSL", 12)]:
+            raise ValueError("Invalid shift for instruction: {0}".format(shift))
+        if shift == ("LSL", 12):
+            self.sh[:] = bytearray((1,))
+
+
+    @classmethod
+    def accept_arg(cls, argsdict):
+        return (cls.is_register(argsdict[0], accept_sp=True) and
+                cls.is_register(argsdict[1], accept_sp=True) and
+                cls.is_imm(argsdict[2]) and
+                cls.is_shift(argsdict.get(3)))
+
+
+# C4.1.93.6 Logical (immediate)
+# Wtf : https://kddnewton.com/2022/08/11/aarch64-bitmask-immediates.html
+
+class DataProcessingLogicalImmediate(DataProcessingImmediate):
+    def __init__(self, argsdict):
+        super(DataProcessingLogicalImmediate, self).__init__()
+        self.sf = self.bits[31:32]
+        self.opc = self.bits[29:31]
+        self.bits[23:29] = bytearray(reversed((1, 0, 0, 1, 0, 0)))
+        self.N = self.bits[22:23]
+        self.immr = self.bits[16:22]
+        self.imms = self.bits[10:16]
+        self.rn = self.bits[5:10]
+        self.rd = self.bits[0:5]
+
+        self.setup_fixed_values()
+        # Change instruction based of parameter
+        self.setup_register(self.rd, argsdict[0])
+        self.setup_register(self.rn, argsdict[1])
+        self.setup_bitmask_imm(self.imm12, argsdict[2])
+
+    @classmethod
+    def accept_arg(cls, argsdict):
+        return (cls.is_register(argsdict[0], accept_sp=True) and
+                cls.is_register(argsdict[1], accept_sp=True) and
+                cls.is_bitmask_imm(argsdict[2]))
+
+    @classmethod
+    def is_bitmask_imm(*args, **kwargs):
+        raise NotImplementedError("is_bitmask_imm")
+
+    def setup_bitmask_imm(*args, **kwargs):
+        raise NotImplementedError("setup_bitmask_imm")
+
+
+class MovWideImmediat(DataProcessingImmediate):
+    def __init__(self, argsdict):
+        super(MovWideImmediat, self).__init__()
+        self.sf = self.bits[31:32]
+        self.opc = self.bits[29:31]
+        self.bits[23:29] = bytearray(reversed((1, 0, 0, 1, 0, 1)))
+        self.hw = self.bits[21:23]
+        self.imm16 = self.bits[5:21]
+        self.rd = self.bits[0:5]
+
+
+        self.setup_fixed_values()
+        # Change instruction based of parameter
+        self.setup_register(self.rd, argsdict[0])
+        self.setup_immediat(self.imm16, argsdict[1])
+
+        shift = Shift.parse(argsdict.get(2))
+        if not shift:
+            return
+        if shift.type != "LSL":
+            raise ValueError("Invalid shift type for {0} : {1}".format(type(self).__name__, shift.value))
+        if shift.value not in (0, 16 ,32, 48):
+            raise ValueError("Invalid shift value for {0} : {1}".format(type(self).__name__, shift.value))
+        if self.bitness == 32 and shift.value > 16:
+            raise ValueError("Invalid shift value for 32bits encoding of {0} : {1}".format(type(self).__name__, shift.value))
+
+        self.setup_immediat(self.hw, shift.value // 16)
+
+
+    @classmethod
+    def accept_arg(cls, argsdict):
+        return (cls.is_register(argsdict[0], accept_sp=True) and
+                cls.is_imm(argsdict[1]) and
+                cls.is_shift(argsdict.get(2)))
+
+
+
+### C4.1.94.13 Unconditional branch (register)
+
+class UnconditionalBranchRegister(InstructionEncoding):
+    BITNESS = 64
+
+    def __init__(self, argsdict):
+        super(UnconditionalBranchRegister, self).__init__()
+        # Allow to fill it in the same order as the ARM manual
+        self.bits[25:32] = bytearray(reversed((1, 1, 0, 1, 0, 1, 1)))
+        self.opc = self.bits[21:25]
+        self.op2 = self.bits[16:21]
+        self.op3 = self.bits[10:16]
+        self.rn = self.bits[5:10]
+        self.op4 = self.bits[0:5]
+
+        self.setup_fixed_values()
+        self.setup_register(self.rn, argsdict[0])
+
+    @classmethod
+    def accept_arg(cls, argsdict):
+        return (cls.is_register(argsdict[0], accept_sp=True))
+
+
+class RetEncoding(UnconditionalBranchRegister.gen(opc=0b10, op2=0b11111, op3=0, op4=0)):
+    # Ret can accept no register and default to X30
+    def __init__(self, argsdict):
+        if not argsdict:
+            argsdict[0] = "X30"
+        super(RetEncoding, self).__init__(argsdict)
+
+    @classmethod
+    def accept_arg(cls, argsdict):
+        return not argsdict or cls.is_register(argsdict[0], accept_sp=True)
+
+
+# C4.1.95 Data Processing – Register
+
+class DataProcessingRegister(InstructionEncoding):
+    def __init__(self):
+        super(DataProcessingRegister, self).__init__()
+        self.op0 = self.bits[30:31]
+        self.op1 = self.bits[28:29]
+        self.bits[25:28] = bytearray(reversed((1, 0, 1)))
+        self.op2 = self.bits[21:25]
+        self.op3 = self.bits[10:16]
+
+class DataProcessingLogicalShiftedRegister(DataProcessingRegister):
+    def __init__(self, argsdict):
+        super(DataProcessingLogicalShiftedRegister, self).__init__()
+        self.sf = self.bits[31:32]
+        self.opc = self.bits[29:31]
+        self.bits[24:29] = bytearray(reversed((0, 1, 0, 1, 0)))
+        self.shift = self.bits[22:24]
+        self.N = self.bits[21:22]
+        self.rm = self.bits[16:21]
+        self.imm6 = self.bits[10:16]
+        self.rn = self.bits[5:10]
+        self.rd = self.bits[0:5]
+
+        self.setup_fixed_values()
+        # Change instruction based of parameter
+        self.setup_register(self.rd, argsdict[0])
+        self.setup_register(self.rn, argsdict[1])
+        self.setup_register(self.rm, argsdict[2])
+
+        shift = Shift.parse(argsdict.get(3))
+        if not shift:
+            return
+        # Is this mapping generic ? Store ir somewhere ?
+        # Is the shift size logic repeatable and factorisable ?
+        if self.bitness == 32 and shift.value > 31:
+            raise ValueError("Invalid shift value for 32bits encoding of {0} : {1}".format(type(self).__name__, shift.value))
+
+        SHIFT_MAPPING = {"LSL": 0b00, "LSR": 0b01, "ASR": 0b10, "ROR": 0b11}
+        self.setup_immediat(self.shift, SHIFT_MAPPING[shift.type])
+        self.setup_immediat(self.imm6, shift.value)
+
+
+    @classmethod
+    def accept_arg(cls, argsdict):
+        return (cls.is_register(argsdict[0]) and
+                cls.is_register(argsdict[1]) and
+                cls.is_register(argsdict[2]) and
+                cls.is_shift(argsdict.get(3)))
+
+# An instruction is a Name that can have multiple encoding
+# It's the class we instanciate to assemble instructions
+# C6.2.270 ORR (immediate)
+# C6.2.271 ORR (shifted register)
+
+# there also seem to exist "alias instructions" like "mov"
+# That just map to others instruction when specific condition are met on the params
+
+
+class Instruction(object):
+    encoding = []
+
+    def __init__(self, *args):
+        argsdict = dict(enumerate(args)) # Like a list but allow arg.get(4)
+        for i, encodcls in enumerate(self.encoding):
+            # Late rewrite of GeneratedEncodingCls classname for better message error
+            if encodcls.__name__ == "GeneratedEncodingCls":
+                encodcls.__name__ = "{0}Encoding{1}".format(type(self).__name__, i)
+
+
+            if encodcls.accept_arg(argsdict):
+                self.encoded = encodcls(argsdict)
+                return
+        raise ValueError("Cannot encode <{0} {1}>:(".format(type(self).__name__, args))
+
+    def get_code(self):
+        intlist = list(self.encoded.bits)
+        if not is_py3:
+            intlist = [ord(x) for x in intlist]
+        # Our encoding to real little-endian
+        encoding_getter = operator.itemgetter(7, 6, 5, 4, 3, 2, 1, 0, 15, 14, 13, 12, 11, 10, 9, 8, 23, 22, 21, 20, 19, 18, 17, 16, 31, 30, 29, 28, 27, 26, 25, 24)
+        dword = 0
+        for bit in encoding_getter(intlist):
+            assert bit in (0, 1), "Unexpected bite value in encoding of {0} : {1} in {2}".format(type(self).__name__, bit, intlist)
+            dword = (dword << 1) | bit
+        return struct.pack(">I", dword) # We already have handled endianess
+
+
+
+        # Fix endianned
+
+
+class Add(Instruction):
+    encoding = [AddSubtractImmediate.gen(op=0, S=0)]
+
+class Subs(Instruction):
+    encoding = [AddSubtractImmediate.gen(op=1, S=1)]
+
+### C6.2.307 RET (page 2203) (11010110010111110000000000000000)
+
+class Ret(Instruction):
+    encoding = [RetEncoding]
+
+#  C6.2.254
+
+class Movz(Instruction):
+    encoding = [MovWideImmediat.gen(opc=0b10)]
+
+class Movk(Instruction):
+    encoding = [MovWideImmediat.gen(opc=0b11)]
+
+# The encoding for "mov reg, reg" :D
+# C6.2.271
+# Todo: Instruction like "mov" that dispatch to other instruction encoding based on more precise condition on param ?
+class Orr(Instruction):
+    encoding = [DataProcessingLogicalShiftedRegister.gen(opc=0b01)]
+
+
+# Meta Instruction that can dispatch to others Instruction/Encoding based on special case
+# Ex: "mov reg1, re2" -> "orr reg1, xzr, reg2"
+
+class Mov(Instruction): # VirtualInstruction ?
+    def __new__(self, *args):
+        argsdict = dict(enumerate(args)) # Like a list but allow arg.get(4)
+        if (set(argsdict) == {0, 1} and  # Only 2 args
+                InstructionEncoding.is_register(argsdict[0]) and
+                InstructionEncoding.is_register(argsdict[1])):
+            return Orr(argsdict[0], ZERO, argsdict[1])
+
+        raise ValueError("Cannot encode <{0} {1}>:(".format(type(self).__name__, args))
+
+
+class MultipleInstr(object):
+    INSTRUCTION_SIZE = 4
+
+    def __init__(self, init_instrs=()):
+        self.instrs = {}
+        self.labels = {}
+        self.expected_labels = {}
+        # List of all labeled jump already resolved
+        # Will be used for 'relocation'
+        self.computed_jump = []
+        self.size = 0
+        for i in init_instrs:
+            self += i
+
+    def get_code(self):
+        if self.expected_labels:
+            raise ValueError("Unresolved labels: {0}".format(self.expected_labels.keys()))
+        return b"".join([x[1].get_code() for x in sorted(self.instrs.items())])
+
+    def add_instruction(self, instruction):
+        # if isinstance(instruction, Label):
+        #     return self.add_label(instruction)
+        # # Change DelayedJump to LabeledJump ?
+        # if isinstance(instruction, DelayedJump):
+        #     return self.add_delayed_jump(instruction)
+        if isinstance(instruction, Instruction):
+            self.instrs[self.size] = instruction
+            self.size += self.INSTRUCTION_SIZE
+            return
+        raise ValueError("Don't know what to do with {0} of type {1}".format(instruction, type(instruction)))
+
+    def add_label(self, label):
+        if label.name not in self.expected_labels:
+            # Label that have no jump before definition
+            # Just registed the address of the label
+            self.labels[label.name] = self.size
+            return
+        # Label with jmp before definition
+        # Lot of stuff todo:
+            # Find all delayed jump that refer to this jump
+            # Replace them with real jump
+            # If size of jump < JUMP_SIZE: relocate everything we can
+            # Update expected_labels
+        for jump_to_label in self.expected_labels[label.name]:
+            if jump_to_label.offset in self.instrs:
+                raise ValueError("WTF REPLACE EXISTING INSTR...")
+            distance = self.size - jump_to_label.offset
+            real_jump = jump_to_label.type(distance)
+            self.instrs[jump_to_label.offset] = real_jump
+            self.computed_jump.append((jump_to_label.offset, self.size))
+            for i in range(self.JUMP_SIZE - len(real_jump.get_code())):
+                self.instrs[jump_to_label.offset + len(real_jump.get_code()) + i] = _NopArtifact()
+        del self.expected_labels[label.name]
+        self.labels[label.name] = self.size
+        if not self.expected_labels:
+            # No more un-resolved label (for now): time to reduce the shellcode
+            self._reduce_shellcode()
+
+    def add_delayed_jump(self, jump):
+        dst = jump.label
+        if dst in self.labels:
+            # Jump to already defined labels
+            # Nothing fancy: get offset of label and jump to it !
+            distance = self.size - self.labels[dst]
+            jump_instruction = jump.type(-distance)
+            self.computed_jump.append((self.size, self.labels[dst]))
+            return self.add_instruction(jump_instruction)
+        # Jump to undefined label
+        # Add label to expected ones
+        # Add jump info -> offset of jump | type
+        # Reserve space for call !
+        jump.offset = self.size
+        self.expected_labels.setdefault(dst, []).append(jump)
+        self.size += self.JUMP_SIZE
+        return
+
+    def merge_shellcode(self, other):
+        shared_labels = set(self.labels) & set(other.labels)
+        if shared_labels:
+            raise ValueError("Cannot merge shellcode: shared labels {0}".format(shared_labels))
+        for offset, instr in sorted(other.instrs.items()):
+            for label_name in [name for name, label_offset in other.labels.items() if label_offset == offset]:
+                self.add_instruction(Label(label_name))
+            self.add_instruction(instr)
+
+    def __iadd__(self, other):
+        if isinstance(other, MultipleInstr):
+            self.merge_shellcode(other)
+        elif isinstance(other, basestring):
+            self.assemble(other)
+        else:
+            self.add_instruction(other)
+        return self
+
+    def assemble(self, code):
+        for instr in assemble_instructions_generator(code):
+            self.add_instruction(instr)
+
+
+def split_in_instruction(str):
+    for line in str.split("\n"):
+        if not line:
+            continue
+        for instr in line.split(";"):
+            if not instr:
+                continue
+            yield instr.strip()
+
+def assemble_instructions_generator(str):
+    for instr in split_in_instruction(str):
+        data = instr.split(" ", 1)
+        mnemo, args_raw = data[0], data[1:]
+        try:
+            instr_object = globals()[mnemo.capitalize()]
+        except:
+            raise ValueError("Unknow mnemonic <{0}>".format(mnemo))
+
+        # if issubclass(instr_object, Raw):
+        #     # Raw should received the raw buffer as it expect encoded hex
+        #     # The transformation may transform 'raw 9090' (nopnop) as 0n9090
+        #     # If other fake-instr need this : make a class attribute
+        #     yield instr_object(*args_raw)
+        #     continue
+
+        args = []
+        if args_raw:
+            for arg in args_raw[0].split(","):
+                arg = arg.strip()
+                try:
+                    arg = int(arg, 0)
+                except ValueError:
+                    pass
+                args.append(arg)
+        yield instr_object(*args)
+
+def assemble(str):
+    """Play test"""
+    shellcode = MultipleInstr()
+    shellcode += str
+    return shellcode.get_code()

windows/pe_parse.py

@@ -3,6 +3,7 @@ import windows
 import windows.hooks as hooks
 import windows.utils as utils
 
+import windows.generated_def as gdef
 from windows.generated_def.winstructs import *
 from windows.utils import transform_ctypes_fields
 import windows.remotectypes as rctypes
@@ -38,9 +39,9 @@ def get_pe_bitness(baseaddr, target):
     # We can force bitness as the field we access are bitness-independant
     pe = GetPEFile(baseaddr, target, force_bitness=32)
     machine = pe.get_NT_HEADER().FileHeader.Machine
-    if machine == 0x14c:
+    if machine == gdef.IMAGE_FILE_MACHINE_I386:
         return 32
-    elif machine == 0x8664:
+    elif machine in (gdef.IMAGE_FILE_MACHINE_AMD64, gdef.IMAGE_FILE_MACHINE_ARM64):
         return 64
     else:
         raise ValueError("Unknow PE target machine <0x{0:x}>".format(machine))
@@ -108,7 +109,7 @@ class PESection(IMAGE_SECTION_HEADER):
         if self.target is None:
             name = get_string(self.target, ctypes.addressof(self.Name))[:8]
         else:
-            name = get_string(self.target, self._base_addr)[:8]
+            name = self.target.read_memory(self._base_addr, 8).split(b"\x00", 1)[0].decode("ascii")
         # Decode as UTF-8 as the MS doc say ?
         return name
 
@@ -450,4 +451,17 @@ class PEFile(object):
                     iat_entry.name = str(name) if name else ""
             name = get_string(self.target, self.baseaddr + import_descriptor.Name)
             res.setdefault(name.lower(), []).extend(IAT)
-        return res
+        return res
+
+    @utils.fixedpropety
+    def binid(self):
+        """Return the hex-string {TimeStamp}{SizeOfCode} used by PDB to identify a PE.
+
+        I do not know the official name of this value...
+
+        :type: :class:`str`
+        """
+        nth = self.get_NT_HEADER()
+        timestamp = nth.FileHeader.TimeDateStamp
+        image_size = nth.OptionalHeader.SizeOfImage
+        return "{timestamp:08x}{image_size:x}".format(timestamp=timestamp, image_size=image_size)

windows/rpc/client.py

@@ -220,7 +220,7 @@ class RPCClient(object):
             data = response.data[ctypes.sizeof(ALPC_RPC_RESPONSE):]
         else:
             # Response in view M extract size from PORT_MESSAGE & read data from view
-            assert response.port_message.u1.s1.TotalLength >= 0x48 # At least 0x20 of data
+            assert response.port_message.u1.s1.DataLength >= ctypes.sizeof(ALPC_RPC_RESPONSE) # 0x20
             rpcdatasize = struct.unpack("<I", response.data[0x18:0x1c])[0] # ctypes.sizeof(ALPC_RPC_RESPONSE)
             viewattr = response.view_attribute
             assert viewattr.ViewSize >= rpcdatasize

windows/rpc/stubborn.py

@@ -62,10 +62,14 @@ def stubborn_create_instance(clsid, iid):
     # resolver_info.OxidInfo.containerVersion.version is part of OxidInfo.ipidRemUnknown on PPRIV_RESOLVER_INFO_LEGACY
     # And this part of ipidRemUnknown is a PID
     # So a good value to check for > 3 :)
+    # On 2019 IT IS NOT :( as it's its own struct. So I will hardcod this one.
     # Bad alignemetn of containerVersion -> its an older version
-    if resolver_info.OxidInfo.containerVersion.version > 3:
-        dcomversionstruct = resolver_info.OxidInfo.dcomVersion
+    dcomversionstruct = resolver_info.OxidInfo.dcomVersion
+    if windows.system.build_number == 17763:
+        resolver_info = ctypes.cast(rpiv_infoptr, gdef.PPRIV_RESOLVER_INFO_17763)[0]
+    elif resolver_info.OxidInfo.containerVersion.version > 3:
         # If 5,7 -> good alignement of dcomversion so we know its PRIV_RESOLVER_INFO_17763
+        # Should never happen as its now covered by the `windows.system.build_number == 17763` check
         dcomversion = (dcomversionstruct.MajorVersion, dcomversionstruct.MinorVersion)
         if dcomversion == (5, 7):
             resolver_info = ctypes.cast(rpiv_infoptr, gdef.PPRIV_RESOLVER_INFO_17763)[0]

windows/syswow64.py

@@ -169,7 +169,9 @@ def get_current_process_syswow_peb():
 
 class CurrentProcessReadSyswow(process.Process):
     bitness = 64
+
     def _get_handle(self):
+        # GetCurrentProcess() is not accepted for NtWow64ReadVirtualMemory64 :(
         return winproxy.OpenProcess(dwProcessId=windows.current_process.pid)
 
     def read_memory(self, addr, size):

windows/utils/winutils.py

@@ -36,19 +36,6 @@ def get_remote_func_addr(target, dll_name, func_name):
         return mod.pe.exports[func_name]
 
 
-def is_wow_64(hProcess):
-    try:
-        fnIsWow64Process = get_func_addr("kernel32.dll", "IsWow64Process")
-    except winproxy.WinproxyError:
-        return False
-    IsWow64Process = ctypes.WINFUNCTYPE(BOOL, HANDLE, ctypes.POINTER(BOOL))(fnIsWow64Process)
-    Wow64Process = BOOL()
-    res = IsWow64Process(hProcess, ctypes.byref(Wow64Process))
-    if res:
-        return bool(Wow64Process)
-    raise ctypes.WinError()
-
-
 def create_file_from_handle(handle, mode="r"):
     """Return a Python :class:`file` around a ``Windows`` HANDLE"""
     flags = os.O_BINARY if "b" in mode else os.O_TEXT
@@ -86,14 +73,35 @@ def create_console():
     sys.stderr = console_stderr
 
 
-def create_process(path, args=None, dwCreationFlags=0, show_windows=True):
-    """A convenient wrapper arround :func:`windows.winproxy.CreateProcessW`"""
+def create_process(path, args=None, dwCreationFlags=0, show_windows=True, machine=None):
+    """A convenient wrapper arround :func:`windows.winproxy.CreateProcessW`
+    ..note:
+        The machine param only works starting at vista and should be used on arm64 computer
+    """
     proc_info = PROCESS_INFORMATION()
+    StartupInfo = None
     lpStartupInfo = None
+
+    if machine is not None:
+        buffer = ctypes.create_string_buffer(0x100)
+        size = gdef.DWORD64(len(buffer))
+        machine = gdef.WORD(machine)
+        windows.winproxy.InitializeProcThreadAttributeList(buffer, 1, 0, size)
+        windows.winproxy.UpdateProcThreadAttribute(buffer, 0, gdef.PROC_THREAD_ATTRIBUTE_MACHINE_TYPE, ctypes.addressof(machine), ctypes.sizeof(machine), None, None)
+
+        startup_infoex = gdef.STARTUPINFOEXW()
+        startup_infoex.StartupInfo.cb = ctypes.sizeof(gdef.STARTUPINFOEXW)
+        startup_infoex.lpAttributeList = ctypes.cast(buffer, gdef.PVOID)
+        StartupInfo = startup_infoex.StartupInfo
+
+        dwCreationFlags |= gdef.EXTENDED_STARTUPINFO_PRESENT
+
     if show_windows:
-        StartupInfo = STARTUPINFOW()
-        StartupInfo.cb = ctypes.sizeof(StartupInfo)
+        if StartupInfo is None:
+            StartupInfo = STARTUPINFOW()
+            StartupInfo.cb = ctypes.sizeof(StartupInfo)
         StartupInfo.dwFlags = 0
+    if StartupInfo:
         lpStartupInfo = ctypes.byref(StartupInfo)
     lpCommandLine = None
     if isinstance(path, bytes):
@@ -110,6 +118,8 @@ def create_process(path, args=None, dwCreationFlags=0, show_windows=True):
     dbgprint("CreateProcessW new thread handle {:#x}".format(proc_info.hThread), "HANDLE")
     dbgprint("Automatic close of thread handle {:#x}".format(proc_info.hThread), "HANDLE")
     windows.winproxy.CloseHandle(proc_info.hThread)  # Give access to a WinThread in addition of the WinProcess ?
+    if machine:
+        windows.winproxy.DeleteProcThreadAttributeList(buffer)
     return windows.winobject.process.WinProcess(pid=proc_info.dwProcessId, handle=proc_info.hProcess)
 
 
@@ -300,6 +310,16 @@ def datetime_from_systemtime(systime):
             microsecond=systime.wMilliseconds * 1000,
     )
 
+IMAGE_FILE_MACHINE_TO_PROC_ARCH = {
+    gdef.IMAGE_FILE_MACHINE_I386: gdef.PROCESSOR_ARCHITECTURE_INTEL,
+    gdef.IMAGE_FILE_MACHINE_AMD64: gdef.PROCESSOR_ARCHITECTURE_AMD64,
+    gdef.IMAGE_FILE_MACHINE_ARM64: gdef.PROCESSOR_ARCHITECTURE_ARM64,
+    gdef.IMAGE_FILE_MACHINE_UNKNOWN: gdef.PROCESSOR_ARCHITECTURE_UNKNOWN
+}
+
+def image_file_machine_to_processor_architecture(image_file_machine):
+    return IMAGE_FILE_MACHINE_TO_PROC_ARCH[image_file_machine]
+
 class FixedInteractiveConsole(code.InteractiveConsole):
     def raw_input(self, prompt=">>>"):
         sys.stdout.write(prompt)
@@ -557,6 +577,14 @@ def create_file(name, access=gdef.GENERIC_READ, share=gdef.FILE_SHARE_READ, secu
 #    addr = windows.winproxy.MapViewOfFile(h, dwDesiredAccess=FILE_MAP_READ, dwNumberOfBytesToMap=1)
 #    return addr
 
+def get_system_info(native=False):
+    res = gdef.SYSTEM_INFO()
+    if native:
+        windows.winproxy.GetNativeSystemInfo(res)
+    else:
+        windows.winproxy.GetSystemInfo(res)
+    return res
+
 def decompress_buffer(buffer, comptype=gdef.COMPRESSION_FORMAT_LZNT1, uncompress_size=None):
     if uncompress_size is None:
         uncompress_size = len(buffer) * 10

windows/winobject/event_log.py

@@ -377,6 +377,7 @@ class ImprovedEVT_VARIANT(gdef.EVT_VARIANT):
         gdef.EvtVarTypeUInt16 + gdef.EVT_VARIANT_TYPE_ARRAY : "UInt16Arr",
         gdef.EvtVarTypeUInt32 + gdef.EVT_VARIANT_TYPE_ARRAY : "UInt32Arr",
         gdef.EvtVarTypeUInt64 + gdef.EVT_VARIANT_TYPE_ARRAY : "UInt64Arr",
+        gdef.EvtVarTypeHexInt64 + gdef.EVT_VARIANT_TYPE_ARRAY : "UInt64Arr",
     }
     NoneValue = None
 

windows/winobject/handle.py

@@ -144,6 +144,8 @@ def enumerate_handles():
 
 
 def enumerate_handles_syswow64():
+    if windows.current_process._is_x86_on_arm64:
+        raise NotImplementedError("Crossing heaven gate x86 -> arm64 not implemented")
     size_needed = gdef.ULONG()
     # Should at least be sizeof(gdef.SYSTEM_HANDLE_INFORMATION)
     tmp_buffer = windows.utils.BUFFER(gdef.SYSTEM_HANDLE_INFORMATION64)()

windows/winobject/process.py

@@ -12,6 +12,7 @@ from collections import namedtuple
 import windows
 import windows.native_exec.simple_x86 as x86
 import windows.native_exec.simple_x64 as x64
+import windows.native_exec.simple_arm64 as arm64
 import windows.remotectypes as rctypes
 import windows.generated_def as gdef
 
@@ -70,8 +71,24 @@ class Process(utils.AutoHandle):
 
         :type: :class:`bool`
 		"""
-        # return utils.is_wow_64(self.handle)
-        return utils.is_wow_64(self.limited_handle)
+        if not windows.winproxy.is_implemented(windows.winproxy.IsWow64Process):
+            return False
+        Wow64Process = gdef.BOOL()
+        windows.winproxy.IsWow64Process(self.handle, Wow64Process)
+        return bool(Wow64Process)
+
+
+
+    @utils.fixedproperty
+    def is_wow_64_2(self):
+        if not windows.winproxy.is_implemented(windows.winproxy.IsWow64Process2):
+            return None, None
+        processMachine = gdef.USHORT()
+        nativeMachine = gdef.USHORT()
+        windows.winproxy.IsWow64Process2(self.handle, processMachine, nativeMachine)
+        return (gdef.IMAGE_FILE_MACHINE_MAPPER[processMachine.value],
+                gdef.IMAGE_FILE_MACHINE_MAPPER[nativeMachine.value])
+
 
     @utils.fixedproperty
     def bitness(self):
@@ -79,13 +96,52 @@ class Process(utils.AutoHandle):
 
         :returns: :class:`int` -- 32 or 64
 		"""
-        if windows.system.bitness == 32:
-            return 32
-        if self.is_wow_64:
+        if windows.system.bitness == 32 or self.is_wow_64:
             return 32
         return 64
 
     @utils.fixedproperty
+    def architecture(self):
+        # Syswow2 will exactly tell us the architecture
+        if windows.winproxy.is_implemented(windows.winproxy.IsWow64Process2):
+            process_machine, native_machine = self.is_wow_64_2
+            if process_machine != gdef.IMAGE_FILE_MACHINE_UNKNOWN:
+                return process_machine
+
+            if windows.system.architecture == gdef.PROCESSOR_ARCHITECTURE_ARM64:
+                # May be ARM64 or AMD64 as X64TA64 is not considered WOW64
+                # ProcessMachineTypeInfo is from build 22000
+                # What if not implemented ? parse target main binary PE ?
+                machine_archi = gdef.PROCESS_MACHINE_INFORMATION()
+                windows.winproxy.GetProcessInformation(self.handle, gdef.ProcessMachineTypeInfo, ctypes.byref(machine_archi), ctypes.sizeof(machine_archi))
+                return gdef.IMAGE_FILE_MACHINE_MAPPER[machine_archi.ProcessMachine]
+
+        # No IsWow64Process2 -> No ARM
+        # So its up on x86 -> x64 based on process bitness
+        if self.bitness == 32:
+            return gdef.IMAGE_FILE_MACHINE_I386
+        return gdef.IMAGE_FILE_MACHINE_AMD64
+
+    @utils.fixedproperty
+    def _is_x86_on_arm64(self):
+        return (windows.system.architecture == gdef.PROCESSOR_ARCHITECTURE_ARM64 and
+                    self.architecture == gdef.IMAGE_FILE_MACHINE_I386)
+
+    @utils.fixedproperty
+    def _is_x86_on_x64(self):
+        return (windows.system.architecture == gdef.PROCESSOR_ARCHITECTURE_AMD64 and
+                    self.architecture == gdef.IMAGE_FILE_MACHINE_I386)
+
+    @utils.fixedproperty
+    def _is_native_architecture(self):
+        return ((windows.system.architecture == gdef.PROCESSOR_ARCHITECTURE_INTEL and
+                    self.architecture == gdef.IMAGE_FILE_MACHINE_I386) or
+                (windows.system.architecture == gdef.PROCESSOR_ARCHITECTURE_AMD64 and
+                    self.architecture == gdef.IMAGE_FILE_MACHINE_AMD64) or
+                (windows.system.architecture == gdef.PROCESSOR_ARCHITECTURE_ARM64 and
+                    self.architecture == gdef.IMAGE_FILE_MACHINE_ARM64))
+
+    @utils.fixedpropety
     def limited_handle(self):
         if windows.system.version[0] <= 5:
             # Windows XP | Serveur 2003
@@ -110,6 +166,8 @@ class Process(utils.AutoHandle):
         :type: :class:`int`
 		"""
         if windows.current_process.bitness == 32 and self.bitness == 64:
+            if windows.current_process._is_x86_on_arm64:
+                raise NotImplementedError("Crossing heaven gate x86 -> arm64 not implemented")
             xtype = windows.remotectypes.transform_type_to_remote64bits(PROCESS_BASIC_INFORMATION)
             # Fuck-it <3
             data = (ctypes.c_char * ctypes.sizeof(xtype))()
@@ -180,6 +238,8 @@ class Process(utils.AutoHandle):
     def virtual_protect(self, addr, size, protect, old_protect=None):
         """Change the access right of one or more page of the process"""
         if windows.current_process.bitness == 32 and self.bitness == 64:
+            if windows.current_process._is_x86_on_arm64:
+                raise NotImplementedError("Crossing heaven gate x86 -> arm64 not implemented")
             if size & 0x0fff:
                 size = ((size >> 12) + 1) << 12
             if old_protect is None:
@@ -210,6 +270,8 @@ class Process(utils.AutoHandle):
         :rtype: :class:`~windows.generated_def.winstructs.MEMORY_BASIC_INFORMATION`
 		"""
         if windows.current_process.bitness == 32 and self.bitness == 64:
+            if windows.current_process._is_x86_on_arm64:
+                raise NotImplementedError("Crossing heaven gate x86 -> arm64 not implemented")
             res = MEMORY_BASIC_INFORMATION64()
             try:
                 v = windows.syswow64.NtQueryVirtualMemory_32_to_64(ProcessHandle=self.handle, BaseAddress=addr, MemoryInformationClass=MemoryBasicInformation, MemoryInformation=res)
@@ -290,6 +352,8 @@ class Process(utils.AutoHandle):
         for i, data in enumerate(info_array):
             info_array[i].VirtualAddress = addresses[i]
         if windows.current_process.bitness == 32 and self.bitness == 64:
+            if windows.current_process._is_x86_on_arm64:
+                raise NotImplementedError("Crossing heaven gate x86 -> arm64 not implemented")
             windows.syswow64.NtQueryVirtualMemory_32_to_64(self.handle, 0, MemoryWorkingSetListEx, info_array)
         else:
             winproxy.QueryWorkingSetEx(self.handle, ctypes.byref(info_array), ctypes.sizeof(info_array))
@@ -520,11 +584,12 @@ class Process(utils.AutoHandle):
         return [h for h in windows.system.handles if h.dwProcessId == pid]
 
     def __del__(self):
-        super(Process, self).__del__()
-        # Same logic that AutoHandle.__del__ for Process.limited_handle
-        # Assert that Process inherit AutoHandle
         # sys.path is not None -> check if python shutdown
         if sys.path is not None and hasattr(self, "_limited_handle") and self._limited_handle:
+            # Same logic that AutoHandle.__del__ for Process.limited_handle
+            # Assert that Process inherit AutoHandle
+            # Call super after check as Process could be None during destruction
+            super(Process, self).__del__()
             # Prevent some bug where dbgprint might be None when __del__ is called in a closing process
             # This line is bad -> it reopens a handle closed by 'super(Process, self).__del__()' ._.
             dbgprint("Closing limited handle {0} for {1}".format(hex(self._limited_handle), self), "HANDLE") if dbgprint is not None else None
@@ -570,10 +635,10 @@ class Thread(utils.AutoHandle):
 class CurrentThread(Thread):
     """The current thread"""
 
-    get_teb_code_by_bitness = {
-        32: x86.assemble("mov eax, fs:[0x18]; ret"),
-        64: x64.assemble("mov rax, gs:[0x30]; ret")
-
+    get_teb_code_by_architecture = {
+        gdef.IMAGE_FILE_MACHINE_I386: x86.assemble("mov eax, fs:[0x18]; ret"),
+        gdef.IMAGE_FILE_MACHINE_AMD64: x64.assemble("mov rax, gs:[0x30]; ret"),
+        gdef.IMAGE_FILE_MACHINE_ARM64: arm64.assemble("mov x0, x18; ret")
     }
 
     @property #It's not a fixedproperty because executing thread might change
@@ -586,7 +651,7 @@ class CurrentThread(Thread):
 
     @property #It's not a fixedproperty because executing thread might change
     def teb_base(self):
-        get_teb_base_code = self.get_teb_code_by_bitness[self.owner.bitness]
+        get_teb_base_code = self.get_teb_code_by_architecture[self.owner.architecture]
         return self.owner.execute(get_teb_base_code)
 
     @property
@@ -723,6 +788,8 @@ class CurrentProcess(Process):
 		"""
         if not self.is_wow_64:
             raise ValueError("Not a syswow process")
+        if windows.current_process._is_x86_on_arm64:
+            raise NotImplementedError("Crossing heaven gate x86 -> arm64 not implemented")
         return windows.syswow64.get_current_process_syswow_peb()
 
     # TODO: use ctypes.string_at / ctypes.wstring_at for read_string / read_wstring ?
@@ -849,6 +916,8 @@ class WinThread(Thread):
             :type: :class:`int`
 		"""
         if windows.current_process.bitness == 32 and self.owner.bitness == 64:
+            if windows.current_process._is_x86_on_arm64:
+                raise NotImplementedError("Crossing heaven gate x86 -> arm64 not implemented")
             res = ULONGLONG()
             windows.syswow64.NtQueryInformationThread_32_to_64(self.handle, ThreadQuerySetWin32StartAddress, byref(res), ctypes.sizeof(res))
             return res.value
@@ -868,6 +937,9 @@ class WinThread(Thread):
         # - Want the TEB of a 64b process
         # - Want the TEB64 of a Wowprocess
         # It's the same code for both
+        if windows.current_process._is_x86_on_arm64:
+            raise NotImplementedError("Crossing heaven gate x86 -> arm64 not implemented")
+
         if windows.current_process.is_wow_64:
             restype = rctypes.transform_type_to_remote64bits(THREAD_BASIC_INFORMATION)
             ressize = (ctypes.sizeof(restype))
@@ -972,8 +1044,6 @@ class WinThread(Thread):
 
     @staticmethod
     def _get_thread_id_manual(handle):
-        if windows.current_process.bitness == 32 and self.owner.bitness == 64:
-            raise NotImplementedError("[_get_thread_id_manual] 32 -> 64 (XP64 bits + Syswow process ?)")
         res = THREAD_BASIC_INFORMATION()
         windows.winproxy.NtQueryInformationThread(handle, ThreadBasicInformation, byref(res), ctypes.sizeof(res))
         id2 = res.ClientId.UniqueThread
@@ -1108,11 +1178,16 @@ class WinProcess(Process):
 
             :rtype: :class:`WinThread` or :class:`DeadThread`
 		"""
+        # We are using NtCreateThreadEx as  its more permissive about cross-bitness / cross-architecture
+        # And we can asume we known what we are doing -> So no safeguard ;)
+        thread_handle = HANDLE()
         if windows.current_process.bitness == 32 and self.bitness == 64:
-            thread_handle = HANDLE()
+            if self._is_x86_on_arm64:
+                raise NotImplementedError("Crossing heaven gate x86 -> arm64 not implemented")
             windows.syswow64.NtCreateThreadEx_32_to_64(ThreadHandle=byref(thread_handle) ,ProcessHandle=self.handle, lpStartAddress=addr, lpParameter=param)
-            return WinThread._from_handle(thread_handle.value)
-        return WinThread._from_handle(winproxy.CreateRemoteThread(hProcess=self.handle, lpStartAddress=addr, lpParameter=param))
+        else:
+            windows.winproxy.NtCreateThreadEx(ThreadHandle=byref(thread_handle) ,ProcessHandle=self.handle, lpStartAddress=addr, lpParameter=param)
+        return WinThread._from_handle(thread_handle.value)
 
     def load_library(self, dll_path):
         """Load the library in remote process
@@ -1148,26 +1223,27 @@ class WinProcess(Process):
 
     @utils.fixedproperty
     def peb_addr(self):
-        """The address of the PEB
+        """The address of the PEB.
 
             :type: :class:`int`
 		"""
-        if windows.current_process.bitness == 32 and self.bitness == 64:
+        if windows.current_process._is_x86_on_arm64 and not self.bitness == 32:
+            raise NotImplementedError("Crossing heaven gate x86 -> arm64 not implemented")
+
+        if windows.current_process.bitness == 32 and self.bitness == 64: # Intel to Intel
             x = windows.remotectypes.transform_type_to_remote64bits(PROCESS_BASIC_INFORMATION)
             # Fuck-it <3
             data = (ctypes.c_char * ctypes.sizeof(x))()
-            windows.syswow64.NtQueryInformationProcess_32_to_64(self.handle, ProcessInformation=data, ProcessInformationLength=ctypes.sizeof(x))
+            windows.syswow64.NtQueryInformationProcess_32_to_64(self.handle, gdef.ProcessBasicInformation, ProcessInformation=data)
             peb_offset = x.PebBaseAddress.offset
             peb_addr = struct.unpack("<Q", data[x.PebBaseAddress.offset: x.PebBaseAddress.offset+8])[0]
         elif windows.current_process.bitness == 64 and self.bitness == 32:
-            information_type = 26
             y = ULONGLONG()
-            winproxy.NtQueryInformationProcess(self.handle, information_type, byref(y), sizeof(y))
+            winproxy.NtQueryInformationProcess(self.handle, gdef.ProcessWow64Information, byref(y), sizeof(y))
             peb_addr = y.value
         else:
-            information_type = 0
             x = PROCESS_BASIC_INFORMATION()
-            winproxy.NtQueryInformationProcess(self.handle, information_type, x)
+            winproxy.NtQueryInformationProcess(self.handle, gdef.ProcessBasicInformation, x)
             peb_addr = ctypes.cast(x.PebBaseAddress, PVOID).value
         if peb_addr is None:
             raise ValueError("Could not get peb addr of process {0}".format(self.name))
@@ -1191,6 +1267,10 @@ class WinProcess(Process):
     def peb_syswow_addr(self):
         if not self.is_wow_64:
             raise ValueError("Not a syswow process")
+
+        if windows.current_process._is_x86_on_arm64:
+            raise NotImplementedError("Crossing heaven gate x86 -> arm64 not implemented")
+
         if windows.current_process.bitness == 64:
             information_type = 0
             x = PROCESS_BASIC_INFORMATION()

windows/winobject/system.py

@@ -10,7 +10,6 @@ from windows import utils
 import windows.generated_def as gdef
 
 
-
 from windows.winobject import process
 from windows.winobject import network
 from windows.winobject import registry
@@ -586,6 +585,24 @@ class System(object):
         # These are the part that do not move much between XP & Win10
         return gdef.PFW_MINIMAL_KUSER_SHARED_DATA.from_address(gdef.MM_SHARED_USER_DATA_VA)
 
+    @utils.fixedproperty
+    def architecture(self):
+        # Retrieve system processor architecture
+        # It's not that easy as x64-on-ARM64 will lie on most API except IsWow64Process2
+        # EX: GetNativeSystemInfo will returns PROCESSOR_ARCHITECTURE_AMD64
+        if windows.winproxy.is_implemented(windows.winproxy.IsWow64Process2):
+            process_machine, native_machine = windows.current_process.is_wow_64_2
+            try:
+                return utils.image_file_machine_to_processor_architecture(native_machine)
+            except KeyError as e:
+                raise ValueError("Unknown IsWow64Process2(native_machine:#x) -> {0}".format(native_machine))
+
+        # No IsWow64Process2 -> assert it cannot be ARM64 and thus GetNativeSystemInfo will not lie ?
+        sysinfo = gdef.SYSTEM_INFO()
+        windows.winproxy.GetNativeSystemInfo(sysinfo)
+        return gdef.PROCESSOR_ARCHITECTURE_MAPPER[sysinfo.wProcessorArchitecture]
+
+
 
     @staticmethod
     def enumerate_processes():

windows/winobject/system_module.py

@@ -44,6 +44,8 @@ def enumerate_kernel_modules():
     return list(modules)
 
 def enumerate_kernel_modules_syswow64():
+    if windows.current_process._is_x86_on_arm64:
+        raise NotImplementedError("Crossing heaven gate x86 -> arm64 not implemented")
     cbsize = gdef.DWORD()
     windows.syswow64.NtQuerySystemInformation_32_to_64(gdef.SystemModuleInformation, None, 0, ctypes.addressof(cbsize))
     raw_buffer = (cbsize.value * gdef.BYTE)()

windows/winproxy/apis/kernel32.py

@@ -6,7 +6,8 @@ from ..error import (fail_on_zero,
                         no_error_check,
                         result_is_handle,
                         succeed_on_zero,
-                        fail_on_minus_one)
+                        fail_on_minus_one,
+                        WinproxyError)
 
 
 class Kernel32Proxy(ApiProxy):
@@ -81,6 +82,18 @@ def GetPriorityClass(hProcess):
 def SetPriorityClass(hProcess, dwPriorityClass):
     return SetPriorityClass.ctypes_function(hProcess, dwPriorityClass)
 
+@Kernel32Proxy()
+def GetProcessInformation(hProcess, ProcessInformationClass, ProcessInformation, ProcessInformationSize=None):
+    if ProcessInformationSize is None:
+        ProcessInformationSize = ctypes.sizeof(ProcessInformation)
+    return GetProcessInformation.ctypes_function(hProcess, ProcessInformationClass, ProcessInformation, ProcessInformationSize)
+
+@Kernel32Proxy()
+def SetProcessInformation(hProcess, ProcessInformationClass, ProcessInformation, ProcessInformationSize):
+    if ProcessInformationSize is None:
+        ProcessInformationSize = ctypes.sizeof(ProcessInformation)
+    return SetProcessInformation.ctypes_function(hProcess, ProcessInformationClass, ProcessInformation, ProcessInformationSize)
+
 
 PROCESS_MITIGATION_STUCTS = (gdef.PROCESS_MITIGATION_ASLR_POLICY,
                                 gdef.PROCESS_MITIGATION_BINARY_SIGNATURE_POLICY,
@@ -201,6 +214,11 @@ def CreateRemoteThread(hProcess=NeededParameter, lpThreadAttributes=None, dwStac
                        lpStartAddress=NeededParameter, lpParameter=NeededParameter, dwCreationFlags=0, lpThreadId=None):
     return CreateRemoteThread.ctypes_function(hProcess, lpThreadAttributes, dwStackSize, lpStartAddress, lpParameter, dwCreationFlags, lpThreadId)
 
+@Kernel32Proxy()
+def CreateRemoteThreadEx(hProcess, lpThreadAttributes=None, dwStackSize=0, lpStartAddress=NeededParameter, lpParameter=NeededParameter, dwCreationFlags=0, lpAttributeList=None, lpThreadId=None):
+   return CreateRemoteThreadEx.ctypes_function(hProcess, lpThreadAttributes, dwStackSize, lpStartAddress, lpParameter, dwCreationFlags, lpAttributeList, lpThreadId)
+
+
 @Kernel32Proxy()
 def GetThreadContext(hThread, lpContext):
     # TODO: RM ME IF TEST PASS
@@ -407,6 +425,14 @@ def GetWindowsDirectoryW(lpBuffer, uSize=None):
 def GetProductInfo(dwOSMajorVersion, dwOSMinorVersion, dwSpMajorVersion, dwSpMinorVersion, pdwReturnedProductType):
    return GetProductInfo.ctypes_function(dwOSMajorVersion, dwOSMinorVersion, dwSpMajorVersion, dwSpMinorVersion, pdwReturnedProductType)
 
+@Kernel32Proxy(error_check=no_error_check)
+def GetNativeSystemInfo(lpSystemInfo):
+    return GetNativeSystemInfo.ctypes_function(lpSystemInfo)
+
+@Kernel32Proxy(error_check=no_error_check)
+def GetSystemInfo(lpSystemInfo):
+    return GetSystemInfo.ctypes_function(lpSystemInfo)
+
 ## Io
 
 @Kernel32Proxy()
@@ -503,6 +529,41 @@ def Wow64GetThreadContext(hThread, lpContext):
 def Wow64SetThreadContext(hThread, lpContext):
     return Wow64SetThreadContext.ctypes_function(hThread, lpContext)
 
+@Kernel32Proxy()
+def IsWow64Process(hProcess, Wow64Process):
+    return IsWow64Process.ctypes_function(hProcess, Wow64Process)
+
+@Kernel32Proxy()
+def IsWow64Process2(hProcess, pProcessMachine, pNativeMachine):
+    return IsWow64Process2.ctypes_function(hProcess, pProcessMachine, pNativeMachine)
+
+@Kernel32Proxy()
+def IsWow64GuestMachineSupported(WowGuestMachine, MachineIsSupported):
+    return IsWow64GuestMachineSupported.ctypes_function(WowGuestMachine, MachineIsSupported)
+
+@Kernel32Proxy()
+def GetSystemWow64DirectoryA(lpBuffer, uSize):
+    return GetSystemWow64DirectoryA.ctypes_function(lpBuffer, uSize)
+
+@Kernel32Proxy()
+def GetSystemWow64DirectoryW(lpBuffer, uSize):
+    return GetSystemWow64DirectoryW.ctypes_function(lpBuffer, uSize)
+
+@Kernel32Proxy()
+def GetSystemWow64Directory2A(lpBuffer, uSize, ImageFileMachineType):
+    return GetSystemWow64Directory2A.ctypes_function(lpBuffer, uSize, ImageFileMachineType)
+
+@Kernel32Proxy()
+def GetSystemWow64Directory2W(lpBuffer, uSize, ImageFileMachineType):
+    return GetSystemWow64Directory2W.ctypes_function(lpBuffer, uSize, ImageFileMachineType)
+
+@Kernel32Proxy()
+def Wow64SetThreadDefaultGuestMachine(Machine):
+    return Wow64SetThreadDefaultGuestMachine.ctypes_function(Machine)
+
+@Kernel32Proxy()
+def Wow64SuspendThread(hThread):
+    return Wow64SuspendThread.ctypes_function(hThread)
 
 
 ## File
@@ -605,12 +666,7 @@ def FindNextChangeNotification(hChangeHandle):
 
 @Kernel32Proxy()
 def FindCloseChangeNotification(hChangeHandle):
-    return FindCloseChange
-    Notification.ctypes_function(hChangeHandle)
-
-@Kernel32Proxy()
-def FindNextChangeNotification(hChangeHandle):
-    return FindNextChangeNotification.ctypes_function(hChangeHandle)
+    return FindCloseChangeNotification.ctypes_function(hChangeHandle)
 
 @Kernel32Proxy()
 def ReadDirectoryChangesW(hDirectory, lpBuffer, nBufferLength, bWatchSubtree, dwNotifyFilter, lpBytesReturned, lpOverlapped, lpCompletionRoutine):

windows/winproxy/apis/ntdll.py

@@ -148,7 +148,7 @@ def NtCreateProcessEx(ProcessHandle, DesiredAccess, ObjectAttributes=None, Paren
     return NtCreateProcessEx.ctypes_function(ProcessHandle, DesiredAccess, ObjectAttributes, ParentProcess, Flags, SectionHandle, DebugPort, ExceptionPort, InJob)
 
 @NtdllProxy()
-def NtCreateThreadEx(ThreadHandle=None, DesiredAccess=0x1fffff, ObjectAttributes=0, ProcessHandle=NeededParameter, lpStartAddress=NeededParameter, lpParameter=NeededParameter, CreateSuspended=0, dwStackSize=0, Unknown1=0, Unknown2=0, Unknown=0):
+def NtCreateThreadEx(ThreadHandle=None, DesiredAccess=0x1fffff, ObjectAttributes=0, ProcessHandle=NeededParameter, lpStartAddress=NeededParameter, lpParameter=NeededParameter, CreateSuspended=0, dwStackSize=0, Unknown1=0, Unknown2=0, Unknown3=0):
     if ThreadHandle is None:
         ThreadHandle = ctypes.byref(gdef.HANDLE())
     return NtCreateThreadEx.ctypes_function(ThreadHandle, DesiredAccess, ObjectAttributes, ProcessHandle, lpStartAddress, lpParameter, CreateSuspended, dwStackSize, Unknown1, Unknown2, Unknown3)