2. The windows objects

Through the system object many classes representing various Windows parts are accessible.

This sections describes them by group of relation.

• 2.1. Processes and Threads
  • 2.1.1. CurrentProcess
  • 2.1.2. CurrentThread
  • 2.1.3. WinProcess
  • 2.1.4. WinThread
  • 2.1.5. Token
• 2.2. PEB Exploration
  • 2.2.1. PEB
  • 2.2.2. LoadedModule
  • 2.2.3. ApiSetMap
• 2.3. PEFile - Parsing loaded PE
  • 2.3.1. windows.pe_parse
    • 2.3.1.1. PEFile
    • 2.3.1.2. IATEntry
• 2.4. Exception and Context related structures
  • 2.4.1. Exception Records
  • 2.4.2. EXCEPTION DEBUG INFO
  • 2.4.3. Context
  • 2.4.4. EXCEPTION POINTERS
  • 2.4.5. Vectored Exception
• 2.5. Registry
  • 2.5.1. Registry
  • 2.5.2. PyHKey
  • 2.5.3. KeyValue
• 2.6. Network
  • 2.6.1. Connections
  • 2.6.2. Firewall
• 2.7. Service
• 2.8. Volume – The logical drives
• 2.9. WMI – Make request to WMI
  • 2.9.1. WmiManager
  • 2.9.2. WmiRequester
• 2.10. Handle – Processes handles
• 2.11. System Module – Loaded kernel modules
  • 2.11.1. SystemModule
  • 2.11.2. SystemModuleWow64
  • 2.11.3. BaseSystemModule
• 2.12. Object Manager – Kernel objects
  • 2.12.1. ObjectManager
  • 2.12.2. KernelObject
• 2.13. Task scheduler
  • 2.13.1. TaskService
  • 2.13.2. TaskFolder
  • 2.13.3. Task
  • 2.13.4. TaskDefinition
  • 2.13.5. Action
    • 2.13.5.1. Action
    • 2.13.5.2. ExecAction
    • 2.13.5.3. ComHandlerAction
  • 2.13.6. Trigger
  • 2.13.7. Collections
    • 2.13.7.1. TaskFolderCollection
    • 2.13.7.2. TaskCollection
    • 2.13.7.3. ActionCollection
    • 2.13.7.4. TriggerCollection
• 2.14. Event Log
  • 2.14.1. EvtlogManager
  • 2.14.2. Channel
    • 2.14.2.1. EvtChannel
    • 2.14.2.2. ChannelConfig
  • 2.14.3. Publisher
    • 2.14.3.1. EvtPublisher
    • 2.14.3.2. PublisherMetadata
  • 2.14.4. EvtFile
  • 2.14.5. Event
    • 2.14.5.1. EvtEvent
    • 2.14.5.2. EventMetadata
    • 2.14.5.3. EvtQuery
  • 2.14.6. TODO