Index

_

__init__() (windows.debug.Debugger method) (windows.debug.MemoryBreakpoint method)

A

action (windows.winobject.network.FirewallRule attribute) add_bp() (windows.debug.Debugger method) (windows.debug.LocalDebugger method) add_certificate() (windows.crypto.EHCERTSTORE method)

additionalinfo (windows.wintrust.SignatureData attribute) allocated_memory() (windows.winobject.process.CurrentProcess method) (windows.winobject.process.WinProcess method) application_name (windows.winobject.network.FirewallRule attribute) attach() (windows.debug.Debugger class method)

B

base (windows.native_exec.simple_x86.mem_access attribute) baseaddr (windows.winobject.process.LoadedModule attribute) bitness (windows.winobject.process.CurrentProcess attribute) (windows.winobject.process.WinProcess attribute) (windows.winobject.system.System attribute)

break_on_ret() (windows.debug.FunctionBP method) Breakpoint (class in windows.debug)

C

Callback (class in windows.hooks) catalog (windows.wintrust.SignatureData attribute) catalogsigned (windows.wintrust.SignatureData attribute) cert (windows.crypto.CryptObject attribute) CertificateContext (class in windows.crypto) certs (windows.crypto.EHCERTSTORE attribute) chains (windows.crypto.CertificateContext attribute) check_debug() (in module windows.utils) check_is_elevated() (in module windows.utils) check_signature() (in module windows.wintrust) close() (windows.winobject.network.TCP4Connection method) commandline (windows.winobject.process.PEB attribute) computer_name (windows.winobject.system.System attribute) computername (windows.winobject.process.Token attribute) contents (windows.crypto.CertificateContext attribute) (windows.crypto.CryptContext attribute)

context (windows.winobject.process.WinThread attribute) context_syswow (windows.winobject.process.WinThread attribute) control_accepted (windows.winobject.service.ServiceStatus attribute) create_console() (in module windows.utils) create_displacement() (in module windows.native_exec.simple_x86) create_file_from_handle() (in module windows.utils) create_function() (in module windows.native_exec) create_process() (in module windows.utils) create_thread() (windows.winobject.process.CurrentProcess method) (windows.winobject.process.WinProcess method) CryptContext (class in windows.crypto) CryptObject (class in windows.crypto) current_profile_types (windows.winobject.network.Firewall attribute) CurrentProcess (class in windows.winobject.process) CurrentThread (class in windows.winobject.process)

D

DeadThread (class in windows.winobject.process) debug() (windows.debug.Debugger class method) Debugger (class in windows.debug) decrypt() (in module windows.crypto) del_bp() (windows.debug.Debugger method) (windows.debug.LocalDebugger method) deref() (in module windows.native_exec.simple_x86) description (windows.winobject.network.FirewallRule attribute) (windows.winobject.service.ServiceA attribute) detach() (windows.debug.Debugger method) direction (windows.winobject.network.FirewallRule attribute)

disable() (windows.hooks.IATHook method) disable_all_memory_breakpoints() (windows.debug.Debugger method) DisabledMemoryBreakpoint() (windows.debug.Debugger method) DisableWow64FsRedirection (class in windows.utils) disp (windows.native_exec.simple_x86.mem_access attribute) do_cpuid() (in module windows.native_exec.cpuid) dump() (windows.winobject.exception.ECONTEXT32 method) (windows.winobject.exception.ECONTEXT64 method) (windows.winobject.exception.ECONTEXTWOW64 method) (windows.winobject.exception.EEXCEPTION_POINTERS method) duplicate() (windows.crypto.CertificateContext method)

E

ECONTEXT32 (class in windows.winobject.exception) ECONTEXT64 (class in windows.winobject.exception) ECONTEXTWOW64 (class in windows.winobject.exception) EDr7 (class in windows.winobject.exception) (windows.winobject.exception.ECONTEXT32 attribute) (windows.winobject.exception.ECONTEXT64 attribute) (windows.winobject.exception.ECONTEXTWOW64 attribute) EEflags (class in windows.winobject.exception) EEFlags (windows.winobject.exception.ECONTEXT32 attribute) (windows.winobject.exception.ECONTEXT64 attribute) (windows.winobject.exception.ECONTEXTWOW64 attribute) EEXCEPTION_DEBUG_INFO32 (class in windows.winobject.exception) EEXCEPTION_DEBUG_INFO32.ExceptionRecord (in module windows.winobject.exception) EEXCEPTION_DEBUG_INFO64 (class in windows.winobject.exception) EEXCEPTION_DEBUG_INFO64.ExceptionRecord (in module windows.winobject.exception) EEXCEPTION_POINTERS (class in windows.winobject.exception) EEXCEPTION_POINTERS.ContextRecord (in module windows.winobject.exception) EEXCEPTION_POINTERS.ExceptionRecord (in module windows.winobject.exception) EEXCEPTION_RECORD (class in windows.winobject.exception) EEXCEPTION_RECORD32 (class in windows.winobject.exception) EEXCEPTION_RECORD64 (class in windows.winobject.exception) EHCERTSTORE (class in windows.crypto) enable() (windows.hooks.IATHook method) enable_privilege() (in module windows.utils) enabled (windows.winobject.network.Firewall attribute) (windows.winobject.network.FirewallRule attribute)

encoded (windows.crypto.CertificateContext attribute) encrypt() (in module windows.crypto) established (windows.winobject.network.TCP4Connection attribute) (windows.winobject.network.TCP6Connection attribute) ExceptionAddress (windows.winobject.exception.EEXCEPTION_RECORD attribute) (windows.winobject.exception.EEXCEPTION_RECORD32 attribute) (windows.winobject.exception.EEXCEPTION_RECORD64 attribute) ExceptionCode (windows.winobject.exception.EEXCEPTION_RECORD attribute) (windows.winobject.exception.EEXCEPTION_RECORD32 attribute) (windows.winobject.exception.EEXCEPTION_RECORD64 attribute) execute() (windows.winobject.process.CurrentProcess method) (windows.winobject.process.WinProcess method) execute_64bits_code_from_syswow() (in module windows.syswow64) execute_python() (windows.winobject.process.WinProcess method) execute_python_unsafe() (windows.winobject.process.WinProcess method) exit() (windows.winobject.process.CurrentProcess method) (windows.winobject.process.CurrentThread method) (windows.winobject.process.WinProcess method) (windows.winobject.process.WinThread method) exit_code (windows.winobject.process.CurrentProcess attribute) (windows.winobject.process.DeadThread attribute) (windows.winobject.process.WinProcess attribute) (windows.winobject.process.WinThread attribute) export_name (windows.pe_parse.PEFile attribute) exports (windows.pe_parse.PEFile attribute) extract_arguments() (windows.debug.FunctionBP method)

F

fields (windows.native_exec.cpuid.X86CpuidResult attribute) (windows.winobject.exception.ECONTEXT32 attribute) (windows.winobject.exception.ECONTEXT64 attribute) (windows.winobject.exception.ECONTEXTWOW64 attribute) (windows.winobject.exception.EDr7 attribute) (windows.winobject.exception.EEXCEPTION_DEBUG_INFO32 attribute) (windows.winobject.exception.EEXCEPTION_DEBUG_INFO64 attribute) (windows.winobject.exception.EEXCEPTION_RECORD attribute) (windows.winobject.exception.EEXCEPTION_RECORD32 attribute) (windows.winobject.exception.EEXCEPTION_RECORD64 attribute) (windows.winobject.exception.EEflags attribute) (windows.winobject.process.WinUnicodeString attribute) Firewall (class in windows.winobject.network)

firewall (windows.winobject.network.Network attribute) FirewallRule (class in windows.winobject.network) flags (windows.winobject.service.ServiceStatus attribute) from_buffer() (windows.crypto.CertificateContext class method) from_file() (windows.crypto.CertificateContext class method) (windows.crypto.EHCERTSTORE class method) from_system_store() (windows.crypto.EHCERTSTORE class method) full_signature_information() (in module windows.wintrust) fullname (windows.winobject.process.LoadedModule attribute) func_result (windows.winobject.exception.ECONTEXT32 attribute) (windows.winobject.exception.ECONTEXT64 attribute) (windows.winobject.exception.ECONTEXTWOW64 attribute) FunctionBP (class in windows.debug)

G

generate_key() (in module windows.crypto.generation) generate_pfx() (in module windows.crypto.generation) generate_selfsigned_certificate() (in module windows.crypto.generation) generate_syswow64_call() (in module windows.syswow64) get() (windows.winobject.registry.PyHKey method) get_cert() (windows.crypto.CryptObject method) get_exception_bitness() (windows.debug.Debugger method) get_exception_code() (windows.debug.LocalDebugger method) get_exception_context() (windows.debug.LocalDebugger method) get_handle_from_file() (in module windows.utils)

get_mapped_filename() (windows.winobject.process.CurrentProcess method) (windows.winobject.process.WinProcess method) get_memory_breakpoint_at() (windows.debug.Debugger method) get_name() (windows.crypto.CertificateContext method) get_proc_family_model() (in module windows.native_exec.cpuid) get_signer_certificate() (windows.crypto.CryptObject method) get_signer_data() (windows.crypto.CryptObject method) get_vendor_id() (in module windows.native_exec.cpuid) GetPEFile() (in module windows.pe_parse) grouping (windows.winobject.network.FirewallRule attribute)

H

Handle (class in windows.winobject.handle) handle (windows.winobject.process.CurrentProcess attribute) (windows.winobject.process.CurrentThread attribute) (windows.winobject.process.DeadThread attribute) (windows.winobject.process.Token attribute) (windows.winobject.process.WinProcess attribute) (windows.winobject.process.WinThread attribute)

handles (windows.winobject.system.System attribute) HXBreakpoint (class in windows.debug)

I

IATEntry (class in windows.pe_parse) IATEntry.addr (in module windows.pe_parse) IATEntry.name (in module windows.pe_parse) IATEntry.ord (in module windows.pe_parse) IATEntry.value (in module windows.pe_parse) IATHook (class in windows.hooks) imagepath (windows.winobject.process.PEB attribute) import_pfx() (in module windows.crypto) imports (windows.pe_parse.PEFile attribute) index (windows.native_exec.simple_x86.mem_access attribute) infos (windows.winobject.handle.Handle attribute) integrity (windows.winobject.process.Token attribute) interface_types (windows.winobject.network.FirewallRule attribute)

ipv4 (windows.winobject.network.Network attribute) ipv6 (windows.winobject.network.Network attribute) is_amd_proc() (in module windows.native_exec.cpuid) is_elevated (windows.winobject.process.Token attribute) is_exit (windows.winobject.process.CurrentProcess attribute) (windows.winobject.process.DeadThread attribute) (windows.winobject.process.WinProcess attribute) (windows.winobject.process.WinThread attribute) is_intel_proc() (in module windows.native_exec.cpuid) is_signed() (in module windows.wintrust) is_wow_64 (windows.winobject.process.CurrentProcess attribute) (windows.winobject.process.WinProcess attribute) issuer (windows.crypto.CertificateContext attribute)

K

KeyValue (class in windows.winobject.registry)

L

LdrLoadDll_32_to_64() (in module windows.syswow64) load_library() (windows.winobject.process.WinProcess method) LoadedModule (class in windows.winobject.process) local_addr (windows.winobject.network.TCP4Connection attribute) (windows.winobject.network.TCP6Connection attribute) local_address (windows.winobject.network.FirewallRule attribute) local_handle (windows.winobject.handle.Handle attribute)

local_port (windows.winobject.network.FirewallRule attribute) (windows.winobject.network.TCP4Connection attribute) (windows.winobject.network.TCP6Connection attribute) LocalDebugger (class in windows.debug) LogicalDrive (class in windows.winobject.volume) LogicalDrive.name (in module windows.winobject.volume) logicaldrives (windows.winobject.system.System attribute) loop() (windows.debug.Debugger method)

M

mem() (in module windows.native_exec.simple_x86) mem_access (class in windows.native_exec.simple_x86) memory_state() (windows.winobject.process.CurrentProcess method) (windows.winobject.process.WinProcess method)

MemoryBreakpoint (class in windows.debug) modules (windows.winobject.process.PEB attribute)

N

name (windows.crypto.CertificateContext attribute) (windows.winobject.handle.Handle attribute) (windows.winobject.network.FirewallRule attribute) (windows.winobject.process.LoadedModule attribute) (windows.winobject.process.WinProcess attribute) (windows.winobject.registry.KeyValue attribute) (windows.winobject.service.ServiceA attribute) nb_cert (windows.crypto.CryptObject attribute) nb_signer (windows.crypto.CryptObject attribute)

Network (class in windows.winobject.network) network (windows.winobject.system.System attribute) new_aligned() (windows.winobject.exception.ECONTEXT64 class method) new_in_memory() (windows.crypto.EHCERTSTORE class method) NtCreateThreadEx_32_to_64() (in module windows.syswow64) NtGetContextThread_32_to_64() (in module windows.syswow64) NtQueryInformationProcess_32_to_64() (in module windows.syswow64) NtQueryInformationThread_32_to_64() (in module windows.syswow64) NtQueryVirtualMemory_32_to_64() (in module windows.syswow64) NtSetContextThread_32_to_64() (in module windows.syswow64)

O

on_create_process() (windows.debug.Debugger method) on_create_thread() (windows.debug.Debugger method) on_exception() (windows.debug.Debugger method) (windows.debug.LocalDebugger method) on_exit_process() (windows.debug.Debugger method) on_exit_thread() (windows.debug.Debugger method) on_load_dll() (windows.debug.Debugger method)

on_output_debug_string() (windows.debug.Debugger method) on_rip() (windows.debug.Debugger method) on_single_step() (windows.debug.Debugger method) on_unload_dll() (windows.debug.Debugger method) open_subkey() (windows.winobject.registry.PyHKey method) owner (windows.winobject.process.CurrentThread attribute) (windows.winobject.process.WinThread attribute)

P

path (windows.winobject.volume.LogicalDrive attribute) pc (windows.winobject.exception.ECONTEXT32 attribute) (windows.winobject.exception.ECONTEXT64 attribute) (windows.winobject.exception.ECONTEXTWOW64 attribute) pe (windows.winobject.process.LoadedModule attribute) PEB (class in windows.winobject.process) peb (windows.winobject.process.CurrentProcess attribute) (windows.winobject.process.WinProcess attribute) peb_addr (windows.winobject.process.WinProcess attribute) peb_syswow (windows.winobject.process.CurrentProcess attribute) (windows.winobject.process.WinProcess attribute) PEFile (class in windows.pe_parse) pid (windows.winobject.process.CurrentProcess attribute) (windows.winobject.process.WinProcess attribute)

pop_shell() (in module windows.utils) ppid (windows.winobject.process.CurrentProcess attribute) (windows.winobject.process.WinProcess attribute) prefix (windows.native_exec.simple_x86.mem_access attribute) process (windows.winobject.handle.Handle attribute) (windows.winobject.service.ServiceA attribute) processes (windows.winobject.system.System attribute) product_type (windows.winobject.system.System attribute) protocol (windows.winobject.network.FirewallRule attribute) PyHKey (class in windows.winobject.registry) PyHKey.__call__() (in module windows.winobject.registry) PyHKey.__getitem__() (in module windows.winobject.registry) PyHKey.__setitem__() (in module windows.winobject.registry)

Q

query_memory() (windows.winobject.process.CurrentProcess method) (windows.winobject.process.WinProcess method)

R

raw (windows.winobject.exception.EEflags attribute) raw_serial (windows.crypto.CertificateContext attribute) read_byte() (windows.winobject.process.CurrentProcess method) (windows.winobject.process.WinProcess method) read_dword() (windows.winobject.process.CurrentProcess method) (windows.winobject.process.WinProcess method) read_memory() (windows.winobject.process.CurrentProcess method) (windows.winobject.process.WinProcess method) read_memory_into() (windows.winobject.process.WinProcess method) read_ptr() (windows.winobject.process.CurrentProcess method) (windows.winobject.process.WinProcess method) read_qword() (windows.winobject.process.CurrentProcess method) (windows.winobject.process.WinProcess method) read_short() (windows.winobject.process.CurrentProcess method) (windows.winobject.process.WinProcess method) read_string() (windows.winobject.process.CurrentProcess method) (windows.winobject.process.WinProcess method) read_wstring() (windows.winobject.process.CurrentProcess method) (windows.winobject.process.WinProcess method)

Registry (class in windows.winobject.registry) registry (windows.winobject.system.System attribute) regs() (windows.winobject.exception.ECONTEXT32 method) (windows.winobject.exception.ECONTEXT64 method) (windows.winobject.exception.ECONTEXTWOW64 method) remote_addr (windows.winobject.network.TCP4Connection attribute) (windows.winobject.network.TCP6Connection attribute) remote_address (windows.winobject.network.FirewallRule attribute) remote_host (windows.winobject.network.TCP4Connection attribute) (windows.winobject.network.TCP6Connection attribute) remote_port (windows.winobject.network.FirewallRule attribute) (windows.winobject.network.TCP4Connection attribute) (windows.winobject.network.TCP6Connection attribute) remote_proto (windows.winobject.network.TCP4Connection attribute) (windows.winobject.network.TCP6Connection attribute) remove_hook() (windows.pe_parse.IATEntry method) restore_all_memory_breakpoints() (windows.debug.Debugger method) resume() (windows.winobject.process.WinThread method) ret_trigger() (windows.debug.FunctionBP method) rules (windows.winobject.network.Firewall attribute)

S

scale (windows.native_exec.simple_x86.mem_access attribute) select() (windows.winobject.wmi.WmiRequester method) serial (windows.crypto.CertificateContext attribute) service_name (windows.winobject.network.FirewallRule attribute) ServiceA (class in windows.winobject.service) services (windows.winobject.system.System attribute) ServiceStatus (class in windows.winobject.service) set() (windows.winobject.registry.PyHKey method) set_context() (windows.winobject.process.WinThread method) set_hook() (windows.pe_parse.IATEntry method) set_syswow_context() (windows.winobject.process.WinThread method) SignatureData (class in windows.wintrust) signed (windows.wintrust.SignatureData attribute)

single_step() (windows.debug.Debugger method) (windows.debug.LocalDebugger method) sp (windows.winobject.exception.ECONTEXT32 attribute) (windows.winobject.exception.ECONTEXT64 attribute) (windows.winobject.exception.ECONTEXTWOW64 attribute) start_address (windows.winobject.process.WinThread attribute) state (windows.winobject.service.ServiceStatus attribute) status (windows.winobject.service.ServiceA attribute) store (windows.crypto.CertificateContext attribute) str (windows.winobject.process.WinUnicodeString attribute) subkeys (windows.winobject.registry.PyHKey attribute) suspend() (windows.winobject.process.WinThread method) System (class in windows.winobject.system) Syswow64ApiProxy (class in windows.syswow64)

T

TCP4Connection (class in windows.winobject.network) TCP6Connection (class in windows.winobject.network) teb_base (windows.winobject.process.WinThread attribute) threads (windows.winobject.process.CurrentProcess attribute) (windows.winobject.process.WinProcess attribute) (windows.winobject.system.System attribute) tid (windows.winobject.process.CurrentThread attribute) (windows.winobject.process.WinThread attribute) time_info (windows.winobject.process.CurrentProcess attribute) (windows.winobject.process.WinProcess attribute) Token (class in windows.winobject.process)

transform_type_to_remote32bits() (in module windows.remotectypes) transform_type_to_remote64bits() (in module windows.remotectypes) trigger() (windows.debug.Breakpoint method) (windows.debug.FunctionBP method) (windows.debug.HXBreakpoint method) (windows.debug.MemoryBreakpoint method) try_generate_stub_target() (in module windows.syswow64) type (windows.winobject.handle.Handle attribute) (windows.winobject.registry.KeyValue attribute) (windows.winobject.service.ServiceStatus attribute) (windows.winobject.volume.LogicalDrive attribute)

U

username (windows.winobject.process.Token attribute)

V

value (windows.crypto.EHCERTSTORE attribute) (windows.winobject.network.Firewall attribute) (windows.winobject.network.FirewallRule attribute) (windows.winobject.registry.KeyValue attribute) values (windows.winobject.registry.PyHKey attribute) VectoredException (class in windows.winobject.exception) version (windows.winobject.system.System attribute) version_name (windows.winobject.system.System attribute)

virtual_alloc() (windows.winobject.process.CurrentProcess method) (windows.winobject.process.WinProcess method) virtual_free() (windows.winobject.process.CurrentProcess method) (windows.winobject.process.WinProcess method) virtual_protect() (windows.winobject.process.CurrentProcess method) (windows.winobject.process.WinProcess method) virtual_protected() (windows.winobject.process.CurrentProcess method) (windows.winobject.process.WinProcess method) VirtualProtected (class in windows.utils)

W

wait() (windows.winobject.process.CurrentProcess method) (windows.winobject.process.CurrentThread method) (windows.winobject.process.DeadThread method) (windows.winobject.process.Token method) (windows.winobject.process.WinProcess method) (windows.winobject.process.WinThread method) windows.com (module) windows.crypto (module) windows.crypto.generation (module) windows.debug (module) windows.hooks (module) windows.native_exec (module) windows.native_exec.cpuid (module) windows.native_exec.nativeutils (module) windows.native_exec.simple_x64 (module) windows.native_exec.simple_x86 (module) windows.pe_parse (module) windows.remotectypes (module) windows.syswow64 (module) windows.utils (module) windows.winobject.exception (module) windows.winobject.handle (module)

windows.winobject.network (module) windows.winobject.process (module) windows.winobject.registry (module) windows.winobject.service (module) windows.winobject.volume (module) windows.winobject.wmi (module) windows.winproxy (module) windows.wintrust (module) WinProcess (class in windows.winobject.process) WinThread (class in windows.winobject.process) WinUnicodeString (class in windows.winobject.process) wmi (windows.winobject.system.System attribute) WmiRequester (class in windows.winobject.wmi) write_byte() (windows.winobject.process.CurrentProcess method) (windows.winobject.process.WinProcess method) write_dword() (windows.winobject.process.CurrentProcess method) (windows.winobject.process.WinProcess method) write_memory() (windows.winobject.process.CurrentProcess method) (windows.winobject.process.WinProcess method) write_qword() (windows.winobject.process.CurrentProcess method) (windows.winobject.process.WinProcess method) write_short() (windows.winobject.process.CurrentProcess method) (windows.winobject.process.WinProcess method)

X

x64_cpuid() (in module windows.native_exec.cpuid)

x86_cpuid() (in module windows.native_exec.cpuid) X86CpuidResult (class in windows.native_exec.cpuid)