mirror of
https://github.com/hakril/PythonForWindows
synced 2026-06-08 14:31:45 +00:00
Darius Houle
1859 lines
168 KiB
HTML
1859 lines
168 KiB
HTML
<!DOCTYPE html>
|
||
|
||
<html lang="en" data-content_root="./">
|
||
<head>
|
||
<meta charset="utf-8" />
|
||
<meta name="viewport" content="width=device-width, initial-scale=1.0" /><meta name="viewport" content="width=device-width, initial-scale=1" />
|
||
|
||
<title>2.1. Processes and Threads — PythonForWindows 1.0.3 documentation</title>
|
||
<link rel="stylesheet" type="text/css" href="_static/pygments.css?v=fa44fd50" />
|
||
<link rel="stylesheet" type="text/css" href="_static/classic.css?v=def86cc0" />
|
||
<link rel="stylesheet" type="text/css" href="_static/css/mbasic.css?v=957880af" />
|
||
|
||
<script src="_static/documentation_options.js?v=baaebd52"></script>
|
||
<script src="_static/doctools.js?v=9a2dae69"></script>
|
||
<script src="_static/sphinx_highlight.js?v=dc90522c"></script>
|
||
|
||
<link rel="index" title="Index" href="genindex.html" />
|
||
<link rel="search" title="Search" href="search.html" />
|
||
<link rel="next" title="2.4. Token" href="token.html" />
|
||
<link rel="prev" title="2. The windows objects" href="winobject.html" />
|
||
</head><body>
|
||
<div class="related" role="navigation" aria-label="related navigation">
|
||
<h3>Navigation</h3>
|
||
<ul>
|
||
<li class="right" style="margin-right: 10px">
|
||
<a href="genindex.html" title="General Index"
|
||
accesskey="I">index</a></li>
|
||
<li class="right" >
|
||
<a href="py-modindex.html" title="Python Module Index"
|
||
>modules</a> |</li>
|
||
<li class="right" >
|
||
<a href="token.html" title="2.4. Token"
|
||
accesskey="N">next</a> |</li>
|
||
<li class="right" >
|
||
<a href="winobject.html" title="2. The windows objects"
|
||
accesskey="P">previous</a> |</li>
|
||
<li class="nav-item nav-item-0"><a href="index.html">PythonForWindows 1.0.3 documentation</a> »</li>
|
||
<li class="nav-item nav-item-1"><a href="winobject.html" accesskey="U"><span class="section-number">2. </span>The <code class="xref py py-mod docutils literal notranslate"><span class="pre">windows</span></code> objects</a> »</li>
|
||
<li class="nav-item nav-item-this"><a href=""><span class="section-number">2.1. </span>Processes and Threads</a></li>
|
||
</ul>
|
||
</div>
|
||
|
||
<div class="document">
|
||
<div class="documentwrapper">
|
||
<div class="bodywrapper">
|
||
<div class="body" role="main">
|
||
|
||
<section id="module-windows.winobject.process">
|
||
<span id="processes-and-threads"></span><h1><span class="section-number">2.1. </span>Processes and Threads<a class="headerlink" href="#module-windows.winobject.process" title="Link to this heading">¶</a></h1>
|
||
<section id="currentprocess">
|
||
<h2><span class="section-number">2.1.1. </span>CurrentProcess<a class="headerlink" href="#currentprocess" title="Link to this heading">¶</a></h2>
|
||
<div class="admonition note">
|
||
<p class="admonition-title">Note</p>
|
||
<p>See sample <a class="reference internal" href="sample.html#sample-current-process"><span class="std std-ref">windows.current_process</span></a></p>
|
||
</div>
|
||
<dl class="py class">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.CurrentProcess">
|
||
<em class="property"><span class="pre">class</span><span class="w"> </span></em><span class="sig-prename descclassname"><span class="pre">windows.winobject.process.</span></span><span class="sig-name descname"><span class="pre">CurrentProcess</span></span><a class="reference internal" href="_modules/windows/winobject/process.html#CurrentProcess"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.winobject.process.CurrentProcess" title="Link to this definition">¶</a></dt>
|
||
<dd><p>Bases: <code class="xref py py-class docutils literal notranslate"><span class="pre">Process</span></code></p>
|
||
<p>The current process</p>
|
||
<dl class="py method">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.CurrentProcess.allocated_memory">
|
||
<span class="sig-name descname"><span class="pre">allocated_memory</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">size</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">prot</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">PAGE_EXECUTE_READWRITE(0x40)</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.CurrentProcess.allocated_memory" title="Link to this definition">¶</a></dt>
|
||
<dd><p>ContextManager to allocate memory and free it</p>
|
||
<dl class="field-list simple">
|
||
<dt class="field-odd">Type<span class="colon">:</span></dt>
|
||
<dd class="field-odd"><p><code class="xref py py-class docutils literal notranslate"><span class="pre">int</span></code> – the address of the allocated memory</p>
|
||
</dd>
|
||
</dl>
|
||
</dd></dl>
|
||
|
||
<dl class="py property">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.CurrentProcess.bitness">
|
||
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">bitness</span></span><a class="headerlink" href="#windows.winobject.process.CurrentProcess.bitness" title="Link to this definition">¶</a></dt>
|
||
<dd><p>The bitness of the process</p>
|
||
<dl class="field-list simple">
|
||
<dt class="field-odd">Type<span class="colon">:</span></dt>
|
||
<dd class="field-odd"><p><code class="xref py py-class docutils literal notranslate"><span class="pre">int</span></code> – 32 or 64</p>
|
||
</dd>
|
||
</dl>
|
||
</dd></dl>
|
||
|
||
<dl class="py method">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.CurrentProcess.create_thread">
|
||
<span class="sig-name descname"><span class="pre">create_thread</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">lpStartAddress</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">lpParameter</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">dwCreationFlags</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">0</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/process.html#CurrentProcess.create_thread"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.winobject.process.CurrentProcess.create_thread" title="Link to this definition">¶</a></dt>
|
||
<dd><p>Create a new thread</p>
|
||
<dl class="field-list simple">
|
||
<dt class="field-odd">Return type<span class="colon">:</span></dt>
|
||
<dd class="field-odd"><p><a class="reference internal" href="#windows.winobject.process.WinThread" title="windows.winobject.process.WinThread"><code class="xref py py-class docutils literal notranslate"><span class="pre">WinThread</span></code></a> or <a class="reference internal" href="#windows.winobject.process.DeadThread" title="windows.winobject.process.DeadThread"><code class="xref py py-class docutils literal notranslate"><span class="pre">DeadThread</span></code></a></p>
|
||
</dd>
|
||
</dl>
|
||
</dd></dl>
|
||
|
||
<dl class="py method">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.CurrentProcess.execute">
|
||
<span class="sig-name descname"><span class="pre">execute</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">code</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">parameter</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">0</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/process.html#CurrentProcess.execute"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.winobject.process.CurrentProcess.execute" title="Link to this definition">¶</a></dt>
|
||
<dd><p>Execute native code <code class="docutils literal notranslate"><span class="pre">code</span></code> in the current thread.</p>
|
||
<dl class="field-list simple">
|
||
<dt class="field-odd">Return type<span class="colon">:</span></dt>
|
||
<dd class="field-odd"><p><code class="xref py py-class docutils literal notranslate"><span class="pre">int</span></code> the return value of the native code</p>
|
||
</dd>
|
||
</dl>
|
||
</dd></dl>
|
||
|
||
<dl class="py method">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.CurrentProcess.exit">
|
||
<span class="sig-name descname"><span class="pre">exit</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">code</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">0</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/process.html#CurrentProcess.exit"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.winobject.process.CurrentProcess.exit" title="Link to this definition">¶</a></dt>
|
||
<dd><p>Exit the process</p>
|
||
</dd></dl>
|
||
|
||
<dl class="py property">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.CurrentProcess.exit_code">
|
||
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">exit_code</span></span><a class="headerlink" href="#windows.winobject.process.CurrentProcess.exit_code" title="Link to this definition">¶</a></dt>
|
||
<dd><p>The exit code of the process : <code class="docutils literal notranslate"><span class="pre">STILL_ACTIVE</span></code> means the process is not dead</p>
|
||
<dl class="field-list simple">
|
||
<dt class="field-odd">Type<span class="colon">:</span></dt>
|
||
<dd class="field-odd"><p><code class="xref py py-class docutils literal notranslate"><span class="pre">int</span></code></p>
|
||
</dd>
|
||
</dl>
|
||
</dd></dl>
|
||
|
||
<dl class="py method">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.CurrentProcess.get_mapped_filename">
|
||
<span class="sig-name descname"><span class="pre">get_mapped_filename</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">addr</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.CurrentProcess.get_mapped_filename" title="Link to this definition">¶</a></dt>
|
||
<dd><p>The filename mapped at address <code class="docutils literal notranslate"><span class="pre">addr</span></code> or <code class="docutils literal notranslate"><span class="pre">None</span></code></p>
|
||
<dl class="field-list simple">
|
||
<dt class="field-odd">Return type<span class="colon">:</span></dt>
|
||
<dd class="field-odd"><p><code class="xref py py-class docutils literal notranslate"><span class="pre">unicode</span></code> or <code class="docutils literal notranslate"><span class="pre">None</span></code></p>
|
||
</dd>
|
||
</dl>
|
||
</dd></dl>
|
||
|
||
<dl class="py property">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.CurrentProcess.handle">
|
||
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">handle</span></span><a class="headerlink" href="#windows.winobject.process.CurrentProcess.handle" title="Link to this definition">¶</a></dt>
|
||
<dd><p>An handle on the object</p>
|
||
<dl class="field-list">
|
||
<dt class="field-odd">Type<span class="colon">:</span></dt>
|
||
<dd class="field-odd"><p>HANDLE</p>
|
||
<div class="admonition note">
|
||
<p class="admonition-title">Note</p>
|
||
<p>The handle is automaticaly closed when the object is destroyed</p>
|
||
</div>
|
||
</dd>
|
||
</dl>
|
||
</dd></dl>
|
||
|
||
<dl class="py property">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.CurrentProcess.is_exit">
|
||
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">is_exit</span></span><a class="headerlink" href="#windows.winobject.process.CurrentProcess.is_exit" title="Link to this definition">¶</a></dt>
|
||
<dd><p><code class="docutils literal notranslate"><span class="pre">True</span></code> if the process is terminated</p>
|
||
<dl class="field-list simple">
|
||
<dt class="field-odd">Type<span class="colon">:</span></dt>
|
||
<dd class="field-odd"><p><code class="xref py py-class docutils literal notranslate"><span class="pre">bool</span></code></p>
|
||
</dd>
|
||
</dl>
|
||
</dd></dl>
|
||
|
||
<dl class="py property">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.CurrentProcess.is_wow_64">
|
||
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">is_wow_64</span></span><a class="headerlink" href="#windows.winobject.process.CurrentProcess.is_wow_64" title="Link to this definition">¶</a></dt>
|
||
<dd><p><code class="docutils literal notranslate"><span class="pre">True</span></code> if the process is a SysWow64 process (32bit process on 64bits system).</p>
|
||
<dl class="field-list simple">
|
||
<dt class="field-odd">Type<span class="colon">:</span></dt>
|
||
<dd class="field-odd"><p><code class="xref py py-class docutils literal notranslate"><span class="pre">bool</span></code></p>
|
||
</dd>
|
||
</dl>
|
||
</dd></dl>
|
||
|
||
<dl class="py method">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.CurrentProcess.load_library">
|
||
<span class="sig-name descname"><span class="pre">load_library</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">dll_path</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/process.html#CurrentProcess.load_library"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.winobject.process.CurrentProcess.load_library" title="Link to this definition">¶</a></dt>
|
||
<dd><p>Load the library in current process</p>
|
||
<dl class="field-list simple">
|
||
<dt class="field-odd">Return type<span class="colon">:</span></dt>
|
||
<dd class="field-odd"><p><a class="reference internal" href="#windows.winobject.process.LoadedModule" title="windows.winobject.process.LoadedModule"><code class="xref py py-class docutils literal notranslate"><span class="pre">LoadedModule</span></code></a></p>
|
||
</dd>
|
||
</dl>
|
||
</dd></dl>
|
||
|
||
<dl class="py method">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.CurrentProcess.memory_state">
|
||
<span class="sig-name descname"><span class="pre">memory_state</span></span><span class="sig-paren">(</span><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.CurrentProcess.memory_state" title="Link to this definition">¶</a></dt>
|
||
<dd><p>Yield the memory information for the whole address space of the process</p>
|
||
<dl class="field-list simple">
|
||
<dt class="field-odd">Yield<span class="colon">:</span></dt>
|
||
<dd class="field-odd"><p><a class="reference internal" href="winstructs_generated.html#windows.generated_def.winstructs.MEMORY_BASIC_INFORMATION" title="windows.generated_def.winstructs.MEMORY_BASIC_INFORMATION"><code class="xref py py-class docutils literal notranslate"><span class="pre">MEMORY_BASIC_INFORMATION</span></code></a></p>
|
||
</dd>
|
||
</dl>
|
||
</dd></dl>
|
||
|
||
<dl class="py method">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.CurrentProcess.open_token">
|
||
<span class="sig-name descname"><span class="pre">open_token</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">flags</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">MAXIMUM_ALLOWED(0x2000000)</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.CurrentProcess.open_token" title="Link to this definition">¶</a></dt>
|
||
<dd><p>Open the process Token</p>
|
||
<dl class="field-list simple">
|
||
<dt class="field-odd">Returns<span class="colon">:</span></dt>
|
||
<dd class="field-odd"><p><a class="reference internal" href="token.html#windows.winobject.token.Token" title="windows.winobject.token.Token"><code class="xref py py-class docutils literal notranslate"><span class="pre">Token</span></code></a></p>
|
||
</dd>
|
||
</dl>
|
||
</dd></dl>
|
||
|
||
<dl class="py property">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.CurrentProcess.peb">
|
||
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">peb</span></span><a class="headerlink" href="#windows.winobject.process.CurrentProcess.peb" title="Link to this definition">¶</a></dt>
|
||
<dd><p>The Process Environment Block of the current process</p>
|
||
<dl class="field-list simple">
|
||
<dt class="field-odd">Type<span class="colon">:</span></dt>
|
||
<dd class="field-odd"><p><a class="reference internal" href="#windows.winobject.process.PEB" title="windows.winobject.process.PEB"><code class="xref py py-class docutils literal notranslate"><span class="pre">PEB</span></code></a></p>
|
||
</dd>
|
||
</dl>
|
||
</dd></dl>
|
||
|
||
<dl class="py property">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.CurrentProcess.peb_syswow">
|
||
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">peb_syswow</span></span><a class="headerlink" href="#windows.winobject.process.CurrentProcess.peb_syswow" title="Link to this definition">¶</a></dt>
|
||
<dd><p>The 64bits PEB of a SysWow64 process</p>
|
||
<dl class="field-list simple">
|
||
<dt class="field-odd">Type<span class="colon">:</span></dt>
|
||
<dd class="field-odd"><p><a class="reference internal" href="#windows.winobject.process.PEB" title="windows.winobject.process.PEB"><code class="xref py py-class docutils literal notranslate"><span class="pre">PEB</span></code></a></p>
|
||
</dd>
|
||
</dl>
|
||
</dd></dl>
|
||
|
||
<dl class="py property">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.CurrentProcess.pid">
|
||
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">pid</span></span><a class="headerlink" href="#windows.winobject.process.CurrentProcess.pid" title="Link to this definition">¶</a></dt>
|
||
<dd><p>Process ID</p>
|
||
<dl class="field-list simple">
|
||
<dt class="field-odd">Type<span class="colon">:</span></dt>
|
||
<dd class="field-odd"><p><code class="xref py py-class docutils literal notranslate"><span class="pre">int</span></code></p>
|
||
</dd>
|
||
</dl>
|
||
</dd></dl>
|
||
|
||
<dl class="py property">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.CurrentProcess.ppid">
|
||
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">ppid</span></span><a class="headerlink" href="#windows.winobject.process.CurrentProcess.ppid" title="Link to this definition">¶</a></dt>
|
||
<dd><p>Parent Process ID</p>
|
||
<dl class="field-list simple">
|
||
<dt class="field-odd">Type<span class="colon">:</span></dt>
|
||
<dd class="field-odd"><p><code class="xref py py-class docutils literal notranslate"><span class="pre">int</span></code></p>
|
||
</dd>
|
||
</dl>
|
||
</dd></dl>
|
||
|
||
<dl class="py property">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.CurrentProcess.priority">
|
||
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">priority</span></span><a class="headerlink" href="#windows.winobject.process.CurrentProcess.priority" title="Link to this definition">¶</a></dt>
|
||
<dd></dd></dl>
|
||
|
||
<dl class="py method">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.CurrentProcess.query_memory">
|
||
<span class="sig-name descname"><span class="pre">query_memory</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">addr</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.CurrentProcess.query_memory" title="Link to this definition">¶</a></dt>
|
||
<dd><p>Query the memory informations about page at <code class="docutils literal notranslate"><span class="pre">addr</span></code></p>
|
||
<dl class="field-list simple">
|
||
<dt class="field-odd">Return type<span class="colon">:</span></dt>
|
||
<dd class="field-odd"><p><a class="reference internal" href="winstructs_generated.html#windows.generated_def.winstructs.MEMORY_BASIC_INFORMATION" title="windows.generated_def.winstructs.MEMORY_BASIC_INFORMATION"><code class="xref py py-class docutils literal notranslate"><span class="pre">MEMORY_BASIC_INFORMATION</span></code></a></p>
|
||
</dd>
|
||
</dl>
|
||
</dd></dl>
|
||
|
||
<dl class="py method">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.CurrentProcess.read_byte">
|
||
<span class="sig-name descname"><span class="pre">read_byte</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">addr</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.CurrentProcess.read_byte" title="Link to this definition">¶</a></dt>
|
||
<dd><p>Read a <code class="docutils literal notranslate"><span class="pre">CHAR</span></code> at <code class="docutils literal notranslate"><span class="pre">addr</span></code></p>
|
||
</dd></dl>
|
||
|
||
<dl class="py method">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.CurrentProcess.read_dword">
|
||
<span class="sig-name descname"><span class="pre">read_dword</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">addr</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.CurrentProcess.read_dword" title="Link to this definition">¶</a></dt>
|
||
<dd><p>Read a <code class="docutils literal notranslate"><span class="pre">DWORD</span></code> at <code class="docutils literal notranslate"><span class="pre">addr</span></code></p>
|
||
</dd></dl>
|
||
|
||
<dl class="py method">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.CurrentProcess.read_memory">
|
||
<span class="sig-name descname"><span class="pre">read_memory</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">addr</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">size</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/process.html#CurrentProcess.read_memory"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.winobject.process.CurrentProcess.read_memory" title="Link to this definition">¶</a></dt>
|
||
<dd><p>Read <code class="docutils literal notranslate"><span class="pre">size</span></code> from <code class="docutils literal notranslate"><span class="pre">addr</span></code></p>
|
||
<dl class="field-list simple">
|
||
<dt class="field-odd">Returns<span class="colon">:</span></dt>
|
||
<dd class="field-odd"><p>The data read</p>
|
||
</dd>
|
||
<dt class="field-even">Return type<span class="colon">:</span></dt>
|
||
<dd class="field-even"><p><code class="xref py py-class docutils literal notranslate"><span class="pre">str</span></code></p>
|
||
</dd>
|
||
</dl>
|
||
</dd></dl>
|
||
|
||
<dl class="py method">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.CurrentProcess.read_ptr">
|
||
<span class="sig-name descname"><span class="pre">read_ptr</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">addr</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.CurrentProcess.read_ptr" title="Link to this definition">¶</a></dt>
|
||
<dd><p>Read a <code class="docutils literal notranslate"><span class="pre">PTR</span></code> at <code class="docutils literal notranslate"><span class="pre">addr</span></code></p>
|
||
</dd></dl>
|
||
|
||
<dl class="py method">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.CurrentProcess.read_qword">
|
||
<span class="sig-name descname"><span class="pre">read_qword</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">addr</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.CurrentProcess.read_qword" title="Link to this definition">¶</a></dt>
|
||
<dd><p>Read a <code class="docutils literal notranslate"><span class="pre">ULONG64</span></code> at <code class="docutils literal notranslate"><span class="pre">addr</span></code></p>
|
||
</dd></dl>
|
||
|
||
<dl class="py method">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.CurrentProcess.read_short">
|
||
<span class="sig-name descname"><span class="pre">read_short</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">addr</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.CurrentProcess.read_short" title="Link to this definition">¶</a></dt>
|
||
<dd><p>Read a <code class="docutils literal notranslate"><span class="pre">SHORT</span></code> at <code class="docutils literal notranslate"><span class="pre">addr</span></code></p>
|
||
</dd></dl>
|
||
|
||
<dl class="py method">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.CurrentProcess.read_string">
|
||
<span class="sig-name descname"><span class="pre">read_string</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">addr</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/process.html#CurrentProcess.read_string"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.winobject.process.CurrentProcess.read_string" title="Link to this definition">¶</a></dt>
|
||
<dd><p>Read an ascii string at <code class="docutils literal notranslate"><span class="pre">addr</span></code></p>
|
||
</dd></dl>
|
||
|
||
<dl class="py method">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.CurrentProcess.read_wstring">
|
||
<span class="sig-name descname"><span class="pre">read_wstring</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">addr</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/process.html#CurrentProcess.read_wstring"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.winobject.process.CurrentProcess.read_wstring" title="Link to this definition">¶</a></dt>
|
||
<dd><p>Read a windows UTF16 string at <code class="docutils literal notranslate"><span class="pre">addr</span></code></p>
|
||
</dd></dl>
|
||
|
||
<dl class="py property">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.CurrentProcess.threads">
|
||
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">threads</span></span><a class="headerlink" href="#windows.winobject.process.CurrentProcess.threads" title="Link to this definition">¶</a></dt>
|
||
<dd><p>The threads of the process</p>
|
||
<dl class="field-list simple">
|
||
<dt class="field-odd">Type<span class="colon">:</span></dt>
|
||
<dd class="field-odd"><p>[<a class="reference internal" href="#windows.winobject.process.WinThread" title="windows.winobject.process.WinThread"><code class="xref py py-class docutils literal notranslate"><span class="pre">WinThread</span></code></a>] – A list of Thread</p>
|
||
</dd>
|
||
</dl>
|
||
</dd></dl>
|
||
|
||
<dl class="py property">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.CurrentProcess.time_info">
|
||
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">time_info</span></span><a class="headerlink" href="#windows.winobject.process.CurrentProcess.time_info" title="Link to this definition">¶</a></dt>
|
||
<dd><p>The time information of the process (creation, kernel/user time, exit time)</p>
|
||
<dl class="field-list simple">
|
||
<dt class="field-odd">Type<span class="colon">:</span></dt>
|
||
<dd class="field-odd"><p><code class="xref py py-class docutils literal notranslate"><span class="pre">TimeInfo</span></code></p>
|
||
</dd>
|
||
</dl>
|
||
</dd></dl>
|
||
|
||
<dl class="py property">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.CurrentProcess.token">
|
||
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">token</span></span><a class="headerlink" href="#windows.winobject.process.CurrentProcess.token" title="Link to this definition">¶</a></dt>
|
||
<dd><p>The process <a class="reference internal" href="token.html#windows.winobject.token.Token" title="windows.winobject.token.Token"><code class="xref py py-class docutils literal notranslate"><span class="pre">Token</span></code></a></p>
|
||
</dd></dl>
|
||
|
||
<dl class="py method">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.CurrentProcess.virtual_alloc">
|
||
<span class="sig-name descname"><span class="pre">virtual_alloc</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">size</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">prot</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">PAGE_EXECUTE_READWRITE(0x40)</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/process.html#CurrentProcess.virtual_alloc"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.winobject.process.CurrentProcess.virtual_alloc" title="Link to this definition">¶</a></dt>
|
||
<dd><p>Allocate memory in the process</p>
|
||
<dl class="field-list simple">
|
||
<dt class="field-odd">Returns<span class="colon">:</span></dt>
|
||
<dd class="field-odd"><p>The address of the allocated memory</p>
|
||
</dd>
|
||
<dt class="field-even">Return type<span class="colon">:</span></dt>
|
||
<dd class="field-even"><p><code class="xref py py-class docutils literal notranslate"><span class="pre">int</span></code></p>
|
||
</dd>
|
||
</dl>
|
||
</dd></dl>
|
||
|
||
<dl class="py method">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.CurrentProcess.virtual_free">
|
||
<span class="sig-name descname"><span class="pre">virtual_free</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">addr</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/process.html#CurrentProcess.virtual_free"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.winobject.process.CurrentProcess.virtual_free" title="Link to this definition">¶</a></dt>
|
||
<dd><p>Free memory in the process by virtual_alloc</p>
|
||
</dd></dl>
|
||
|
||
<dl class="py method">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.CurrentProcess.virtual_protect">
|
||
<span class="sig-name descname"><span class="pre">virtual_protect</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">addr</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">size</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">protect</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">old_protect</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">None</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.CurrentProcess.virtual_protect" title="Link to this definition">¶</a></dt>
|
||
<dd><p>Change the access right of one or more page of the process</p>
|
||
</dd></dl>
|
||
|
||
<dl class="py method">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.CurrentProcess.virtual_protected">
|
||
<span class="sig-name descname"><span class="pre">virtual_protected</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">addr</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">size</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">protect</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.CurrentProcess.virtual_protected" title="Link to this definition">¶</a></dt>
|
||
<dd><p>A context manager for local virtual_protect (old Protection are restored at exit)</p>
|
||
</dd></dl>
|
||
|
||
<dl class="py method">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.CurrentProcess.wait">
|
||
<span class="sig-name descname"><span class="pre">wait</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">timeout</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">INFINITE(0xffffffff)</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/process.html#CurrentProcess.wait"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.winobject.process.CurrentProcess.wait" title="Link to this definition">¶</a></dt>
|
||
<dd><p>Raise <code class="xref py py-class docutils literal notranslate"><span class="pre">ValueError</span></code> to prevent deadlock :D</p>
|
||
</dd></dl>
|
||
|
||
<dl class="py method">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.CurrentProcess.write_byte">
|
||
<span class="sig-name descname"><span class="pre">write_byte</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">addr</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">byte</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.CurrentProcess.write_byte" title="Link to this definition">¶</a></dt>
|
||
<dd><p>write a byte at <code class="docutils literal notranslate"><span class="pre">addr</span></code></p>
|
||
</dd></dl>
|
||
|
||
<dl class="py method">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.CurrentProcess.write_dword">
|
||
<span class="sig-name descname"><span class="pre">write_dword</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">addr</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">dword</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.CurrentProcess.write_dword" title="Link to this definition">¶</a></dt>
|
||
<dd><p>write a dword at <code class="docutils literal notranslate"><span class="pre">addr</span></code></p>
|
||
</dd></dl>
|
||
|
||
<dl class="py method">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.CurrentProcess.write_memory">
|
||
<span class="sig-name descname"><span class="pre">write_memory</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">addr</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">data</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/process.html#CurrentProcess.write_memory"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.winobject.process.CurrentProcess.write_memory" title="Link to this definition">¶</a></dt>
|
||
<dd><p>Write data at addr</p>
|
||
</dd></dl>
|
||
|
||
<dl class="py method">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.CurrentProcess.write_ptr">
|
||
<span class="sig-name descname"><span class="pre">write_ptr</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">addr</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">value</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.CurrentProcess.write_ptr" title="Link to this definition">¶</a></dt>
|
||
<dd><p>Write a <code class="docutils literal notranslate"><span class="pre">PTR</span></code> at <code class="docutils literal notranslate"><span class="pre">addr</span></code></p>
|
||
</dd></dl>
|
||
|
||
<dl class="py method">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.CurrentProcess.write_qword">
|
||
<span class="sig-name descname"><span class="pre">write_qword</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">addr</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">qword</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.CurrentProcess.write_qword" title="Link to this definition">¶</a></dt>
|
||
<dd><p>write a qword at <code class="docutils literal notranslate"><span class="pre">addr</span></code></p>
|
||
</dd></dl>
|
||
|
||
<dl class="py method">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.CurrentProcess.write_short">
|
||
<span class="sig-name descname"><span class="pre">write_short</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">addr</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">word</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.CurrentProcess.write_short" title="Link to this definition">¶</a></dt>
|
||
<dd><p>write a word at <code class="docutils literal notranslate"><span class="pre">addr</span></code></p>
|
||
</dd></dl>
|
||
|
||
</dd></dl>
|
||
|
||
</section>
|
||
<section id="currentthread">
|
||
<h2><span class="section-number">2.1.2. </span>CurrentThread<a class="headerlink" href="#currentthread" title="Link to this heading">¶</a></h2>
|
||
<dl class="py class">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.CurrentThread">
|
||
<em class="property"><span class="pre">class</span><span class="w"> </span></em><span class="sig-prename descclassname"><span class="pre">windows.winobject.process.</span></span><span class="sig-name descname"><span class="pre">CurrentThread</span></span><a class="reference internal" href="_modules/windows/winobject/process.html#CurrentThread"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.winobject.process.CurrentThread" title="Link to this definition">¶</a></dt>
|
||
<dd><p>Bases: <code class="xref py py-class docutils literal notranslate"><span class="pre">Thread</span></code></p>
|
||
<p>The current thread</p>
|
||
<dl class="py method">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.CurrentThread.exit">
|
||
<span class="sig-name descname"><span class="pre">exit</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">code</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">0</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/process.html#CurrentThread.exit"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.winobject.process.CurrentThread.exit" title="Link to this definition">¶</a></dt>
|
||
<dd><p>Exit the thread</p>
|
||
</dd></dl>
|
||
|
||
<dl class="py property">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.CurrentThread.handle">
|
||
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">handle</span></span><a class="headerlink" href="#windows.winobject.process.CurrentThread.handle" title="Link to this definition">¶</a></dt>
|
||
<dd><p>An handle on the object</p>
|
||
<dl class="field-list">
|
||
<dt class="field-odd">Type<span class="colon">:</span></dt>
|
||
<dd class="field-odd"><p>HANDLE</p>
|
||
<div class="admonition note">
|
||
<p class="admonition-title">Note</p>
|
||
<p>The handle is automaticaly closed when the object is destroyed</p>
|
||
</div>
|
||
</dd>
|
||
</dl>
|
||
</dd></dl>
|
||
|
||
<dl class="py method">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.CurrentThread.open_token">
|
||
<span class="sig-name descname"><span class="pre">open_token</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">flags</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">MAXIMUM_ALLOWED(0x2000000)</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">as_self</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">False</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.CurrentThread.open_token" title="Link to this definition">¶</a></dt>
|
||
<dd><p>Open the Thread token if any (Impersonation) else return None.
|
||
<code class="docutils literal notranslate"><span class="pre">as_self</span></code> tells which security context should be used</p>
|
||
<dl class="field-list simple">
|
||
<dt class="field-odd">Returns<span class="colon">:</span></dt>
|
||
<dd class="field-odd"><p><a class="reference internal" href="token.html#windows.winobject.token.Token" title="windows.winobject.token.Token"><code class="xref py py-class docutils literal notranslate"><span class="pre">Token</span></code></a></p>
|
||
</dd>
|
||
</dl>
|
||
<div class="admonition note">
|
||
<p class="admonition-title">Note</p>
|
||
<p>see <a class="reference external" href="https://docs.microsoft.com/en-us/windows/desktop/api/processthreadsapi/nf-processthreadsapi-openthreadtoken">https://docs.microsoft.com/en-us/windows/desktop/api/processthreadsapi/nf-processthreadsapi-openthreadtoken</a></p>
|
||
</div>
|
||
</dd></dl>
|
||
|
||
<dl class="py property">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.CurrentThread.owner">
|
||
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">owner</span></span><a class="headerlink" href="#windows.winobject.process.CurrentThread.owner" title="Link to this definition">¶</a></dt>
|
||
<dd><p>The current process</p>
|
||
<dl class="field-list simple">
|
||
<dt class="field-odd">Type<span class="colon">:</span></dt>
|
||
<dd class="field-odd"><p><a class="reference internal" href="#windows.winobject.process.CurrentProcess" title="windows.winobject.process.CurrentProcess"><code class="xref py py-class docutils literal notranslate"><span class="pre">CurrentProcess</span></code></a></p>
|
||
</dd>
|
||
</dl>
|
||
</dd></dl>
|
||
|
||
<dl class="py method">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.CurrentThread.set_token">
|
||
<span class="sig-name descname"><span class="pre">set_token</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">token</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.CurrentThread.set_token" title="Link to this definition">¶</a></dt>
|
||
<dd><p>Set the token for the thread (impersonation). Setting the token to None revert the impersonation</p>
|
||
</dd></dl>
|
||
|
||
<dl class="py property">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.CurrentThread.tid">
|
||
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">tid</span></span><a class="headerlink" href="#windows.winobject.process.CurrentThread.tid" title="Link to this definition">¶</a></dt>
|
||
<dd><p>Thread ID</p>
|
||
<dl class="field-list simple">
|
||
<dt class="field-odd">Type<span class="colon">:</span></dt>
|
||
<dd class="field-odd"><p><code class="xref py py-class docutils literal notranslate"><span class="pre">int</span></code></p>
|
||
</dd>
|
||
</dl>
|
||
</dd></dl>
|
||
|
||
<dl class="py property">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.CurrentThread.token">
|
||
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">token</span></span><a class="headerlink" href="#windows.winobject.process.CurrentThread.token" title="Link to this definition">¶</a></dt>
|
||
<dd><p>The thread <a class="reference internal" href="token.html#windows.winobject.token.Token" title="windows.winobject.token.Token"><code class="xref py py-class docutils literal notranslate"><span class="pre">Token</span></code></a></p>
|
||
<dl class="field-list simple">
|
||
<dt class="field-odd">Getter<span class="colon">:</span></dt>
|
||
<dd class="field-odd"><p><a class="reference internal" href="#windows.winobject.process.CurrentThread.open_token" title="windows.winobject.process.CurrentThread.open_token"><code class="xref py py-func docutils literal notranslate"><span class="pre">open_token()</span></code></a></p>
|
||
</dd>
|
||
<dt class="field-even">Setter<span class="colon">:</span></dt>
|
||
<dd class="field-even"><p><a class="reference internal" href="#windows.winobject.process.CurrentThread.set_token" title="windows.winobject.process.CurrentThread.set_token"><code class="xref py py-func docutils literal notranslate"><span class="pre">set_token()</span></code></a></p>
|
||
</dd>
|
||
</dl>
|
||
</dd></dl>
|
||
|
||
<dl class="py method">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.CurrentThread.wait">
|
||
<span class="sig-name descname"><span class="pre">wait</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">timeout</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">INFINITE(0xffffffff)</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/process.html#CurrentThread.wait"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.winobject.process.CurrentThread.wait" title="Link to this definition">¶</a></dt>
|
||
<dd><p>Raise <code class="xref py py-class docutils literal notranslate"><span class="pre">ValueError</span></code> to prevent deadlock :D</p>
|
||
</dd></dl>
|
||
|
||
</dd></dl>
|
||
|
||
</section>
|
||
<section id="winprocess">
|
||
<h2><span class="section-number">2.1.3. </span>WinProcess<a class="headerlink" href="#winprocess" title="Link to this heading">¶</a></h2>
|
||
<div class="admonition note">
|
||
<p class="admonition-title">Note</p>
|
||
<p>See sample <a class="reference internal" href="sample.html#sample-remote-process"><span class="std std-ref">Remote process : WinProcess</span></a></p>
|
||
</div>
|
||
<dl class="py class">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.WinProcess">
|
||
<em class="property"><span class="pre">class</span><span class="w"> </span></em><span class="sig-prename descclassname"><span class="pre">windows.winobject.process.</span></span><span class="sig-name descname"><span class="pre">WinProcess</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">pid</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">None</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">handle</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">None</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">name</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">None</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">ppid</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">None</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/process.html#WinProcess"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.winobject.process.WinProcess" title="Link to this definition">¶</a></dt>
|
||
<dd><p>Bases: <code class="xref py py-class docutils literal notranslate"><span class="pre">Process</span></code></p>
|
||
<p>A Process on the system</p>
|
||
<dl class="py method">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.WinProcess.allocated_memory">
|
||
<span class="sig-name descname"><span class="pre">allocated_memory</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">size</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">prot</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">PAGE_EXECUTE_READWRITE(0x40)</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.WinProcess.allocated_memory" title="Link to this definition">¶</a></dt>
|
||
<dd><p>ContextManager to allocate memory and free it</p>
|
||
<dl class="field-list simple">
|
||
<dt class="field-odd">Type<span class="colon">:</span></dt>
|
||
<dd class="field-odd"><p><code class="xref py py-class docutils literal notranslate"><span class="pre">int</span></code> – the address of the allocated memory</p>
|
||
</dd>
|
||
</dl>
|
||
</dd></dl>
|
||
|
||
<dl class="py property">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.WinProcess.bitness">
|
||
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">bitness</span></span><a class="headerlink" href="#windows.winobject.process.WinProcess.bitness" title="Link to this definition">¶</a></dt>
|
||
<dd><p>The bitness of the process</p>
|
||
<dl class="field-list simple">
|
||
<dt class="field-odd">Returns<span class="colon">:</span></dt>
|
||
<dd class="field-odd"><p><code class="xref py py-class docutils literal notranslate"><span class="pre">int</span></code> – 32 or 64</p>
|
||
</dd>
|
||
</dl>
|
||
</dd></dl>
|
||
|
||
<dl class="py method">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.WinProcess.create_thread">
|
||
<span class="sig-name descname"><span class="pre">create_thread</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">addr</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">param</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/process.html#WinProcess.create_thread"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.winobject.process.WinProcess.create_thread" title="Link to this definition">¶</a></dt>
|
||
<dd><p>Create a remote thread</p>
|
||
<dl class="field-list simple">
|
||
<dt class="field-odd">Return type<span class="colon">:</span></dt>
|
||
<dd class="field-odd"><p><a class="reference internal" href="#windows.winobject.process.WinThread" title="windows.winobject.process.WinThread"><code class="xref py py-class docutils literal notranslate"><span class="pre">WinThread</span></code></a> or <a class="reference internal" href="#windows.winobject.process.DeadThread" title="windows.winobject.process.DeadThread"><code class="xref py py-class docutils literal notranslate"><span class="pre">DeadThread</span></code></a></p>
|
||
</dd>
|
||
</dl>
|
||
</dd></dl>
|
||
|
||
<dl class="py method">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.WinProcess.execute">
|
||
<span class="sig-name descname"><span class="pre">execute</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">code</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">parameter</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">0</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.WinProcess.execute" title="Link to this definition">¶</a></dt>
|
||
<dd><p>Execute some native code in the context of the process</p>
|
||
<dl class="field-list simple">
|
||
<dt class="field-odd">Returns<span class="colon">:</span></dt>
|
||
<dd class="field-odd"><p>The thread executing the code</p>
|
||
</dd>
|
||
<dt class="field-even">Return type<span class="colon">:</span></dt>
|
||
<dd class="field-even"><p><a class="reference internal" href="#windows.winobject.process.WinThread" title="windows.winobject.process.WinThread"><code class="xref py py-class docutils literal notranslate"><span class="pre">WinThread</span></code></a> or <a class="reference internal" href="#windows.winobject.process.DeadThread" title="windows.winobject.process.DeadThread"><code class="xref py py-class docutils literal notranslate"><span class="pre">DeadThread</span></code></a></p>
|
||
</dd>
|
||
</dl>
|
||
</dd></dl>
|
||
|
||
<dl class="py method">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.WinProcess.execute_python">
|
||
<span class="sig-name descname"><span class="pre">execute_python</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">pycode</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/process.html#WinProcess.execute_python"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.winobject.process.WinProcess.execute_python" title="Link to this definition">¶</a></dt>
|
||
<dd><p>Execute Python code in the remote process.</p>
|
||
<p>This function waits for the remote process to end and
|
||
raises an exception if the remote thread raised one</p>
|
||
<div class="admonition note">
|
||
<p class="admonition-title">Note</p>
|
||
<p>This method is incompatible with Microsoft Store builds of python, as the interpreter DLLs do not grant execute to Users.
|
||
See workaround: <a class="reference external" href="https://github.com/hakril/PythonForWindows/tree/master/samples/process/msstore_interpreter_remote_python.py">https://github.com/hakril/PythonForWindows/tree/master/samples/process/msstore_interpreter_remote_python.py</a></p>
|
||
</div>
|
||
</dd></dl>
|
||
|
||
<dl class="py method">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.WinProcess.execute_python_unsafe">
|
||
<span class="sig-name descname"><span class="pre">execute_python_unsafe</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">pycode</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/process.html#WinProcess.execute_python_unsafe"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.winobject.process.WinProcess.execute_python_unsafe" title="Link to this definition">¶</a></dt>
|
||
<dd><p>Execute Python code in the remote process.</p>
|
||
<dl class="field-list simple">
|
||
<dt class="field-odd">Return type<span class="colon">:</span></dt>
|
||
<dd class="field-odd"><p><dl class="field-list simple">
|
||
<dt class="field-odd">rtype<span class="colon">:</span></dt>
|
||
<dd class="field-odd"><p><a class="reference internal" href="#windows.winobject.process.WinThread" title="windows.winobject.process.WinThread"><code class="xref py py-class docutils literal notranslate"><span class="pre">WinThread</span></code></a> or <a class="reference internal" href="#windows.winobject.process.DeadThread" title="windows.winobject.process.DeadThread"><code class="xref py py-class docutils literal notranslate"><span class="pre">DeadThread</span></code></a> : The thread executing the python code</p>
|
||
</dd>
|
||
</dl>
|
||
</p>
|
||
</dd>
|
||
</dl>
|
||
<div class="admonition note">
|
||
<p class="admonition-title">Note</p>
|
||
<p>This method is incompatible with Microsoft Store builds of python, as the interpreter DLLs do not grant execute to Users.
|
||
See workaround: <a class="reference external" href="https://github.com/hakril/PythonForWindows/tree/master/samples/process/msstore_interpreter_remote_python.py">https://github.com/hakril/PythonForWindows/tree/master/samples/process/msstore_interpreter_remote_python.py</a></p>
|
||
</div>
|
||
</dd></dl>
|
||
|
||
<dl class="py method">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.WinProcess.exit">
|
||
<span class="sig-name descname"><span class="pre">exit</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">code</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">0</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/process.html#WinProcess.exit"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.winobject.process.WinProcess.exit" title="Link to this definition">¶</a></dt>
|
||
<dd><p>Exit the process</p>
|
||
</dd></dl>
|
||
|
||
<dl class="py property">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.WinProcess.exit_code">
|
||
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">exit_code</span></span><a class="headerlink" href="#windows.winobject.process.WinProcess.exit_code" title="Link to this definition">¶</a></dt>
|
||
<dd><p>The exit code of the process : <code class="docutils literal notranslate"><span class="pre">STILL_ACTIVE</span></code> means the process is not dead</p>
|
||
<dl class="field-list simple">
|
||
<dt class="field-odd">Type<span class="colon">:</span></dt>
|
||
<dd class="field-odd"><p><code class="xref py py-class docutils literal notranslate"><span class="pre">int</span></code></p>
|
||
</dd>
|
||
</dl>
|
||
</dd></dl>
|
||
|
||
<dl class="py method">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.WinProcess.get_mapped_filename">
|
||
<span class="sig-name descname"><span class="pre">get_mapped_filename</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">addr</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.WinProcess.get_mapped_filename" title="Link to this definition">¶</a></dt>
|
||
<dd><p>The filename mapped at address <code class="docutils literal notranslate"><span class="pre">addr</span></code> or <code class="docutils literal notranslate"><span class="pre">None</span></code></p>
|
||
<dl class="field-list simple">
|
||
<dt class="field-odd">Return type<span class="colon">:</span></dt>
|
||
<dd class="field-odd"><p><code class="xref py py-class docutils literal notranslate"><span class="pre">unicode</span></code> or <code class="docutils literal notranslate"><span class="pre">None</span></code></p>
|
||
</dd>
|
||
</dl>
|
||
</dd></dl>
|
||
|
||
<dl class="py property">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.WinProcess.handle">
|
||
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">handle</span></span><a class="headerlink" href="#windows.winobject.process.WinProcess.handle" title="Link to this definition">¶</a></dt>
|
||
<dd><p>An handle on the object</p>
|
||
<dl class="field-list">
|
||
<dt class="field-odd">Type<span class="colon">:</span></dt>
|
||
<dd class="field-odd"><p>HANDLE</p>
|
||
<div class="admonition note">
|
||
<p class="admonition-title">Note</p>
|
||
<p>The handle is automaticaly closed when the object is destroyed</p>
|
||
</div>
|
||
</dd>
|
||
</dl>
|
||
</dd></dl>
|
||
|
||
<dl class="py property">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.WinProcess.is_exit">
|
||
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">is_exit</span></span><a class="headerlink" href="#windows.winobject.process.WinProcess.is_exit" title="Link to this definition">¶</a></dt>
|
||
<dd><p><code class="docutils literal notranslate"><span class="pre">True</span></code> if the process is terminated</p>
|
||
<dl class="field-list simple">
|
||
<dt class="field-odd">Type<span class="colon">:</span></dt>
|
||
<dd class="field-odd"><p><code class="xref py py-class docutils literal notranslate"><span class="pre">bool</span></code></p>
|
||
</dd>
|
||
</dl>
|
||
</dd></dl>
|
||
|
||
<dl class="py property">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.WinProcess.is_wow_64">
|
||
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">is_wow_64</span></span><a class="headerlink" href="#windows.winobject.process.WinProcess.is_wow_64" title="Link to this definition">¶</a></dt>
|
||
<dd><p><code class="docutils literal notranslate"><span class="pre">True</span></code> if the process is a SysWow64 process (32bit process on 64bits system).</p>
|
||
<dl class="field-list simple">
|
||
<dt class="field-odd">Type<span class="colon">:</span></dt>
|
||
<dd class="field-odd"><p><code class="xref py py-class docutils literal notranslate"><span class="pre">bool</span></code></p>
|
||
</dd>
|
||
</dl>
|
||
</dd></dl>
|
||
|
||
<dl class="py method">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.WinProcess.load_library">
|
||
<span class="sig-name descname"><span class="pre">load_library</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">dll_path</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/process.html#WinProcess.load_library"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.winobject.process.WinProcess.load_library" title="Link to this definition">¶</a></dt>
|
||
<dd><p>Load the library in remote process</p>
|
||
<dl class="field-list simple">
|
||
<dt class="field-odd">Return type<span class="colon">:</span></dt>
|
||
<dd class="field-odd"><p><a class="reference internal" href="#windows.winobject.process.LoadedModule" title="windows.winobject.process.LoadedModule"><code class="xref py py-class docutils literal notranslate"><span class="pre">LoadedModule</span></code></a></p>
|
||
</dd>
|
||
</dl>
|
||
</dd></dl>
|
||
|
||
<dl class="py method">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.WinProcess.memory_state">
|
||
<span class="sig-name descname"><span class="pre">memory_state</span></span><span class="sig-paren">(</span><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.WinProcess.memory_state" title="Link to this definition">¶</a></dt>
|
||
<dd><p>Yield the memory information for the whole address space of the process</p>
|
||
<dl class="field-list simple">
|
||
<dt class="field-odd">Yield<span class="colon">:</span></dt>
|
||
<dd class="field-odd"><p><a class="reference internal" href="winstructs_generated.html#windows.generated_def.winstructs.MEMORY_BASIC_INFORMATION" title="windows.generated_def.winstructs.MEMORY_BASIC_INFORMATION"><code class="xref py py-class docutils literal notranslate"><span class="pre">MEMORY_BASIC_INFORMATION</span></code></a></p>
|
||
</dd>
|
||
</dl>
|
||
</dd></dl>
|
||
|
||
<dl class="py property">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.WinProcess.name">
|
||
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">name</span></span><a class="headerlink" href="#windows.winobject.process.WinProcess.name" title="Link to this definition">¶</a></dt>
|
||
<dd><p>Name of the process</p>
|
||
<dl class="field-list simple">
|
||
<dt class="field-odd">Type<span class="colon">:</span></dt>
|
||
<dd class="field-odd"><p><code class="xref py py-class docutils literal notranslate"><span class="pre">str</span></code></p>
|
||
</dd>
|
||
</dl>
|
||
</dd></dl>
|
||
|
||
<dl class="py method">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.WinProcess.open_token">
|
||
<span class="sig-name descname"><span class="pre">open_token</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">flags</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">MAXIMUM_ALLOWED(0x2000000)</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.WinProcess.open_token" title="Link to this definition">¶</a></dt>
|
||
<dd><p>Open the process Token</p>
|
||
<dl class="field-list simple">
|
||
<dt class="field-odd">Returns<span class="colon">:</span></dt>
|
||
<dd class="field-odd"><p><a class="reference internal" href="token.html#windows.winobject.token.Token" title="windows.winobject.token.Token"><code class="xref py py-class docutils literal notranslate"><span class="pre">Token</span></code></a></p>
|
||
</dd>
|
||
</dl>
|
||
</dd></dl>
|
||
|
||
<dl class="py property">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.WinProcess.peb">
|
||
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">peb</span></span><a class="headerlink" href="#windows.winobject.process.WinProcess.peb" title="Link to this definition">¶</a></dt>
|
||
<dd><p>The PEB of the process (see <code class="xref py py-mod docutils literal notranslate"><span class="pre">remotectypes</span></code>)</p>
|
||
<dl class="field-list simple">
|
||
<dt class="field-odd">Type<span class="colon">:</span></dt>
|
||
<dd class="field-odd"><p><a class="reference internal" href="#windows.winobject.process.PEB" title="windows.winobject.process.PEB"><code class="xref py py-class docutils literal notranslate"><span class="pre">PEB</span></code></a></p>
|
||
</dd>
|
||
</dl>
|
||
</dd></dl>
|
||
|
||
<dl class="py property">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.WinProcess.peb_addr">
|
||
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">peb_addr</span></span><a class="headerlink" href="#windows.winobject.process.WinProcess.peb_addr" title="Link to this definition">¶</a></dt>
|
||
<dd><p>The address of the PEB</p>
|
||
<dl class="field-list simple">
|
||
<dt class="field-odd">Type<span class="colon">:</span></dt>
|
||
<dd class="field-odd"><p><code class="xref py py-class docutils literal notranslate"><span class="pre">int</span></code></p>
|
||
</dd>
|
||
</dl>
|
||
</dd></dl>
|
||
|
||
<dl class="py property">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.WinProcess.peb_syswow">
|
||
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">peb_syswow</span></span><a class="headerlink" href="#windows.winobject.process.WinProcess.peb_syswow" title="Link to this definition">¶</a></dt>
|
||
<dd><p>The 64bits PEB of a SysWow64 process</p>
|
||
<dl class="field-list simple">
|
||
<dt class="field-odd">Type<span class="colon">:</span></dt>
|
||
<dd class="field-odd"><p><a class="reference internal" href="#windows.winobject.process.PEB" title="windows.winobject.process.PEB"><code class="xref py py-class docutils literal notranslate"><span class="pre">PEB</span></code></a></p>
|
||
</dd>
|
||
</dl>
|
||
</dd></dl>
|
||
|
||
<dl class="py property">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.WinProcess.pid">
|
||
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">pid</span></span><a class="headerlink" href="#windows.winobject.process.WinProcess.pid" title="Link to this definition">¶</a></dt>
|
||
<dd><p>Process ID</p>
|
||
<dl class="field-list simple">
|
||
<dt class="field-odd">Type<span class="colon">:</span></dt>
|
||
<dd class="field-odd"><p><code class="xref py py-class docutils literal notranslate"><span class="pre">int</span></code></p>
|
||
</dd>
|
||
</dl>
|
||
</dd></dl>
|
||
|
||
<dl class="py property">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.WinProcess.ppid">
|
||
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">ppid</span></span><a class="headerlink" href="#windows.winobject.process.WinProcess.ppid" title="Link to this definition">¶</a></dt>
|
||
<dd><p>Parent Process ID</p>
|
||
<dl class="field-list simple">
|
||
<dt class="field-odd">Type<span class="colon">:</span></dt>
|
||
<dd class="field-odd"><p><code class="xref py py-class docutils literal notranslate"><span class="pre">int</span></code></p>
|
||
</dd>
|
||
</dl>
|
||
</dd></dl>
|
||
|
||
<dl class="py property">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.WinProcess.priority">
|
||
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">priority</span></span><a class="headerlink" href="#windows.winobject.process.WinProcess.priority" title="Link to this definition">¶</a></dt>
|
||
<dd></dd></dl>
|
||
|
||
<dl class="py method">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.WinProcess.query_memory">
|
||
<span class="sig-name descname"><span class="pre">query_memory</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">addr</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.WinProcess.query_memory" title="Link to this definition">¶</a></dt>
|
||
<dd><p>Query the memory informations about page at <code class="docutils literal notranslate"><span class="pre">addr</span></code></p>
|
||
<dl class="field-list simple">
|
||
<dt class="field-odd">Return type<span class="colon">:</span></dt>
|
||
<dd class="field-odd"><p><a class="reference internal" href="winstructs_generated.html#windows.generated_def.winstructs.MEMORY_BASIC_INFORMATION" title="windows.generated_def.winstructs.MEMORY_BASIC_INFORMATION"><code class="xref py py-class docutils literal notranslate"><span class="pre">MEMORY_BASIC_INFORMATION</span></code></a></p>
|
||
</dd>
|
||
</dl>
|
||
</dd></dl>
|
||
|
||
<dl class="py method">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.WinProcess.read_byte">
|
||
<span class="sig-name descname"><span class="pre">read_byte</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">addr</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.WinProcess.read_byte" title="Link to this definition">¶</a></dt>
|
||
<dd><p>Read a <code class="docutils literal notranslate"><span class="pre">CHAR</span></code> at <code class="docutils literal notranslate"><span class="pre">addr</span></code></p>
|
||
</dd></dl>
|
||
|
||
<dl class="py method">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.WinProcess.read_dword">
|
||
<span class="sig-name descname"><span class="pre">read_dword</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">addr</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.WinProcess.read_dword" title="Link to this definition">¶</a></dt>
|
||
<dd><p>Read a <code class="docutils literal notranslate"><span class="pre">DWORD</span></code> at <code class="docutils literal notranslate"><span class="pre">addr</span></code></p>
|
||
</dd></dl>
|
||
|
||
<dl class="py method">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.WinProcess.read_memory">
|
||
<span class="sig-name descname"><span class="pre">read_memory</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">addr</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">size</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/process.html#WinProcess.read_memory"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.winobject.process.WinProcess.read_memory" title="Link to this definition">¶</a></dt>
|
||
<dd><p>Read <code class="docutils literal notranslate"><span class="pre">size</span></code> from <code class="docutils literal notranslate"><span class="pre">addr</span></code></p>
|
||
<dl class="field-list simple">
|
||
<dt class="field-odd">Returns<span class="colon">:</span></dt>
|
||
<dd class="field-odd"><p>The data read</p>
|
||
</dd>
|
||
<dt class="field-even">Return type<span class="colon">:</span></dt>
|
||
<dd class="field-even"><p><code class="xref py py-class docutils literal notranslate"><span class="pre">str</span></code></p>
|
||
</dd>
|
||
</dl>
|
||
</dd></dl>
|
||
|
||
<dl class="py method">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.WinProcess.read_memory_into">
|
||
<span class="sig-name descname"><span class="pre">read_memory_into</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">addr</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">struct</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/process.html#WinProcess.read_memory_into"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.winobject.process.WinProcess.read_memory_into" title="Link to this definition">¶</a></dt>
|
||
<dd><p>Read a <code class="xref py py-mod docutils literal notranslate"><span class="pre">ctypes</span></code> struct from <cite>addr</cite></p>
|
||
<dl class="field-list simple">
|
||
<dt class="field-odd">Returns<span class="colon">:</span></dt>
|
||
<dd class="field-odd"><p>struct</p>
|
||
</dd>
|
||
</dl>
|
||
</dd></dl>
|
||
|
||
<dl class="py method">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.WinProcess.read_ptr">
|
||
<span class="sig-name descname"><span class="pre">read_ptr</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">addr</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.WinProcess.read_ptr" title="Link to this definition">¶</a></dt>
|
||
<dd><p>Read a <code class="docutils literal notranslate"><span class="pre">PTR</span></code> at <code class="docutils literal notranslate"><span class="pre">addr</span></code></p>
|
||
</dd></dl>
|
||
|
||
<dl class="py method">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.WinProcess.read_qword">
|
||
<span class="sig-name descname"><span class="pre">read_qword</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">addr</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.WinProcess.read_qword" title="Link to this definition">¶</a></dt>
|
||
<dd><p>Read a <code class="docutils literal notranslate"><span class="pre">ULONG64</span></code> at <code class="docutils literal notranslate"><span class="pre">addr</span></code></p>
|
||
</dd></dl>
|
||
|
||
<dl class="py method">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.WinProcess.read_short">
|
||
<span class="sig-name descname"><span class="pre">read_short</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">addr</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.WinProcess.read_short" title="Link to this definition">¶</a></dt>
|
||
<dd><p>Read a <code class="docutils literal notranslate"><span class="pre">SHORT</span></code> at <code class="docutils literal notranslate"><span class="pre">addr</span></code></p>
|
||
</dd></dl>
|
||
|
||
<dl class="py method">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.WinProcess.read_string">
|
||
<span class="sig-name descname"><span class="pre">read_string</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">addr</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.WinProcess.read_string" title="Link to this definition">¶</a></dt>
|
||
<dd><p>Read an ascii string at <code class="docutils literal notranslate"><span class="pre">addr</span></code></p>
|
||
</dd></dl>
|
||
|
||
<dl class="py method">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.WinProcess.read_wstring">
|
||
<span class="sig-name descname"><span class="pre">read_wstring</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">addr</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.WinProcess.read_wstring" title="Link to this definition">¶</a></dt>
|
||
<dd><p>Read a windows UTF16 string at <code class="docutils literal notranslate"><span class="pre">addr</span></code></p>
|
||
</dd></dl>
|
||
|
||
<dl class="py property">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.WinProcess.threads">
|
||
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">threads</span></span><a class="headerlink" href="#windows.winobject.process.WinProcess.threads" title="Link to this definition">¶</a></dt>
|
||
<dd><p>The threads of the process</p>
|
||
<dl class="field-list simple">
|
||
<dt class="field-odd">Type<span class="colon">:</span></dt>
|
||
<dd class="field-odd"><p>[<a class="reference internal" href="#windows.winobject.process.WinThread" title="windows.winobject.process.WinThread"><code class="xref py py-class docutils literal notranslate"><span class="pre">WinThread</span></code></a>] – A list of Thread</p>
|
||
</dd>
|
||
</dl>
|
||
</dd></dl>
|
||
|
||
<dl class="py property">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.WinProcess.time_info">
|
||
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">time_info</span></span><a class="headerlink" href="#windows.winobject.process.WinProcess.time_info" title="Link to this definition">¶</a></dt>
|
||
<dd><p>The time information of the process (creation, kernel/user time, exit time)</p>
|
||
<dl class="field-list simple">
|
||
<dt class="field-odd">Type<span class="colon">:</span></dt>
|
||
<dd class="field-odd"><p><code class="xref py py-class docutils literal notranslate"><span class="pre">TimeInfo</span></code></p>
|
||
</dd>
|
||
</dl>
|
||
</dd></dl>
|
||
|
||
<dl class="py property">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.WinProcess.token">
|
||
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">token</span></span><a class="headerlink" href="#windows.winobject.process.WinProcess.token" title="Link to this definition">¶</a></dt>
|
||
<dd><p>The process <a class="reference internal" href="token.html#windows.winobject.token.Token" title="windows.winobject.token.Token"><code class="xref py py-class docutils literal notranslate"><span class="pre">Token</span></code></a></p>
|
||
</dd></dl>
|
||
|
||
<dl class="py method">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.WinProcess.virtual_alloc">
|
||
<span class="sig-name descname"><span class="pre">virtual_alloc</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">size</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">prot</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">PAGE_EXECUTE_READWRITE(0x40)</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">addr</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">None</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/process.html#WinProcess.virtual_alloc"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.winobject.process.WinProcess.virtual_alloc" title="Link to this definition">¶</a></dt>
|
||
<dd><p>Allocate memory in the process</p>
|
||
<dl class="field-list simple">
|
||
<dt class="field-odd">Returns<span class="colon">:</span></dt>
|
||
<dd class="field-odd"><p>The address of the allocated memory</p>
|
||
</dd>
|
||
<dt class="field-even">Return type<span class="colon">:</span></dt>
|
||
<dd class="field-even"><p><code class="xref py py-class docutils literal notranslate"><span class="pre">int</span></code></p>
|
||
</dd>
|
||
</dl>
|
||
</dd></dl>
|
||
|
||
<dl class="py method">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.WinProcess.virtual_free">
|
||
<span class="sig-name descname"><span class="pre">virtual_free</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">addr</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/process.html#WinProcess.virtual_free"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.winobject.process.WinProcess.virtual_free" title="Link to this definition">¶</a></dt>
|
||
<dd><p>Free memory in the process by virtual_alloc</p>
|
||
</dd></dl>
|
||
|
||
<dl class="py method">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.WinProcess.virtual_protect">
|
||
<span class="sig-name descname"><span class="pre">virtual_protect</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">addr</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">size</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">protect</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">old_protect</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">None</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.WinProcess.virtual_protect" title="Link to this definition">¶</a></dt>
|
||
<dd><p>Change the access right of one or more page of the process</p>
|
||
</dd></dl>
|
||
|
||
<dl class="py method">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.WinProcess.virtual_protected">
|
||
<span class="sig-name descname"><span class="pre">virtual_protected</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">addr</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">size</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">protect</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.WinProcess.virtual_protected" title="Link to this definition">¶</a></dt>
|
||
<dd><p>A context manager for local virtual_protect (old Protection are restored at exit)</p>
|
||
</dd></dl>
|
||
|
||
<dl class="py method">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.WinProcess.wait">
|
||
<span class="sig-name descname"><span class="pre">wait</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">timeout</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">INFINITE(0xffffffff)</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.WinProcess.wait" title="Link to this definition">¶</a></dt>
|
||
<dd><p>Wait for the object</p>
|
||
</dd></dl>
|
||
|
||
<dl class="py method">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.WinProcess.write_byte">
|
||
<span class="sig-name descname"><span class="pre">write_byte</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">addr</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">byte</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.WinProcess.write_byte" title="Link to this definition">¶</a></dt>
|
||
<dd><p>write a byte at <code class="docutils literal notranslate"><span class="pre">addr</span></code></p>
|
||
</dd></dl>
|
||
|
||
<dl class="py method">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.WinProcess.write_dword">
|
||
<span class="sig-name descname"><span class="pre">write_dword</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">addr</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">dword</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.WinProcess.write_dword" title="Link to this definition">¶</a></dt>
|
||
<dd><p>write a dword at <code class="docutils literal notranslate"><span class="pre">addr</span></code></p>
|
||
</dd></dl>
|
||
|
||
<dl class="py method">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.WinProcess.write_memory">
|
||
<span class="sig-name descname"><span class="pre">write_memory</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">addr</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">data</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/process.html#WinProcess.write_memory"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.winobject.process.WinProcess.write_memory" title="Link to this definition">¶</a></dt>
|
||
<dd><p>Write <cite>data</cite> at <cite>addr</cite></p>
|
||
</dd></dl>
|
||
|
||
<dl class="py method">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.WinProcess.write_ptr">
|
||
<span class="sig-name descname"><span class="pre">write_ptr</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">addr</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">value</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.WinProcess.write_ptr" title="Link to this definition">¶</a></dt>
|
||
<dd><p>Write a <code class="docutils literal notranslate"><span class="pre">PTR</span></code> at <code class="docutils literal notranslate"><span class="pre">addr</span></code></p>
|
||
</dd></dl>
|
||
|
||
<dl class="py method">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.WinProcess.write_qword">
|
||
<span class="sig-name descname"><span class="pre">write_qword</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">addr</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">qword</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.WinProcess.write_qword" title="Link to this definition">¶</a></dt>
|
||
<dd><p>write a qword at <code class="docutils literal notranslate"><span class="pre">addr</span></code></p>
|
||
</dd></dl>
|
||
|
||
<dl class="py method">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.WinProcess.write_short">
|
||
<span class="sig-name descname"><span class="pre">write_short</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">addr</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">word</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.WinProcess.write_short" title="Link to this definition">¶</a></dt>
|
||
<dd><p>write a word at <code class="docutils literal notranslate"><span class="pre">addr</span></code></p>
|
||
</dd></dl>
|
||
|
||
</dd></dl>
|
||
|
||
</section>
|
||
<section id="winthread">
|
||
<h2><span class="section-number">2.1.4. </span>WinThread<a class="headerlink" href="#winthread" title="Link to this heading">¶</a></h2>
|
||
<dl class="py class">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.WinThread">
|
||
<em class="property"><span class="pre">class</span><span class="w"> </span></em><span class="sig-prename descclassname"><span class="pre">windows.winobject.process.</span></span><span class="sig-name descname"><span class="pre">WinThread</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">tid</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">None</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">handle</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">None</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">owner_pid</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">None</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">owner</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">None</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/process.html#WinThread"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.winobject.process.WinThread" title="Link to this definition">¶</a></dt>
|
||
<dd><p>Bases: <code class="xref py py-class docutils literal notranslate"><span class="pre">Thread</span></code></p>
|
||
<p>Represent a thread</p>
|
||
<dl class="py property">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.WinThread.context">
|
||
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">context</span></span><a class="headerlink" href="#windows.winobject.process.WinThread.context" title="Link to this definition">¶</a></dt>
|
||
<dd><p>The context of the thread, type depend of the target process.</p>
|
||
<dl class="field-list simple">
|
||
<dt class="field-odd">Type<span class="colon">:</span></dt>
|
||
<dd class="field-odd"><p><code class="xref py py-class docutils literal notranslate"><span class="pre">windows.exception.ECONTEXT32</span></code> or <code class="xref py py-class docutils literal notranslate"><span class="pre">windows.exception.ECONTEXT64</span></code> or <code class="xref py py-class docutils literal notranslate"><span class="pre">windows.exception.ECONTEXTWOW64</span></code></p>
|
||
</dd>
|
||
</dl>
|
||
</dd></dl>
|
||
|
||
<dl class="py property">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.WinThread.context_syswow">
|
||
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">context_syswow</span></span><a class="headerlink" href="#windows.winobject.process.WinThread.context_syswow" title="Link to this definition">¶</a></dt>
|
||
<dd><p>The 64 bits context of a syswow thread.</p>
|
||
<dl class="field-list simple">
|
||
<dt class="field-odd">Type<span class="colon">:</span></dt>
|
||
<dd class="field-odd"><p><code class="xref py py-class docutils literal notranslate"><span class="pre">windows.exception.ECONTEXT64</span></code></p>
|
||
</dd>
|
||
</dl>
|
||
</dd></dl>
|
||
|
||
<dl class="py method">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.WinThread.exit">
|
||
<span class="sig-name descname"><span class="pre">exit</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">code</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">0</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/process.html#WinThread.exit"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.winobject.process.WinThread.exit" title="Link to this definition">¶</a></dt>
|
||
<dd><p>Exit the thread</p>
|
||
</dd></dl>
|
||
|
||
<dl class="py property">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.WinThread.exit_code">
|
||
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">exit_code</span></span><a class="headerlink" href="#windows.winobject.process.WinThread.exit_code" title="Link to this definition">¶</a></dt>
|
||
<dd><p>The exit code of the thread : <code class="docutils literal notranslate"><span class="pre">STILL_ACTIVE</span></code> means the process is not dead</p>
|
||
<dl class="field-list simple">
|
||
<dt class="field-odd">Type<span class="colon">:</span></dt>
|
||
<dd class="field-odd"><p><code class="xref py py-class docutils literal notranslate"><span class="pre">int</span></code></p>
|
||
</dd>
|
||
</dl>
|
||
</dd></dl>
|
||
|
||
<dl class="py property">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.WinThread.handle">
|
||
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">handle</span></span><a class="headerlink" href="#windows.winobject.process.WinThread.handle" title="Link to this definition">¶</a></dt>
|
||
<dd><p>An handle on the object</p>
|
||
<dl class="field-list">
|
||
<dt class="field-odd">Type<span class="colon">:</span></dt>
|
||
<dd class="field-odd"><p>HANDLE</p>
|
||
<div class="admonition note">
|
||
<p class="admonition-title">Note</p>
|
||
<p>The handle is automaticaly closed when the object is destroyed</p>
|
||
</div>
|
||
</dd>
|
||
</dl>
|
||
</dd></dl>
|
||
|
||
<dl class="py property">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.WinThread.is_exit">
|
||
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">is_exit</span></span><a class="headerlink" href="#windows.winobject.process.WinThread.is_exit" title="Link to this definition">¶</a></dt>
|
||
<dd><p><code class="docutils literal notranslate"><span class="pre">True</span></code> if the thread is terminated</p>
|
||
<dl class="field-list simple">
|
||
<dt class="field-odd">Type<span class="colon">:</span></dt>
|
||
<dd class="field-odd"><p><code class="xref py py-class docutils literal notranslate"><span class="pre">bool</span></code></p>
|
||
</dd>
|
||
</dl>
|
||
</dd></dl>
|
||
|
||
<dl class="py method">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.WinThread.open_token">
|
||
<span class="sig-name descname"><span class="pre">open_token</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">flags</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">MAXIMUM_ALLOWED(0x2000000)</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">as_self</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">False</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.WinThread.open_token" title="Link to this definition">¶</a></dt>
|
||
<dd><p>Open the Thread token if any (Impersonation) else return None.
|
||
<code class="docutils literal notranslate"><span class="pre">as_self</span></code> tells which security context should be used</p>
|
||
<dl class="field-list simple">
|
||
<dt class="field-odd">Returns<span class="colon">:</span></dt>
|
||
<dd class="field-odd"><p><a class="reference internal" href="token.html#windows.winobject.token.Token" title="windows.winobject.token.Token"><code class="xref py py-class docutils literal notranslate"><span class="pre">Token</span></code></a></p>
|
||
</dd>
|
||
</dl>
|
||
<div class="admonition note">
|
||
<p class="admonition-title">Note</p>
|
||
<p>see <a class="reference external" href="https://docs.microsoft.com/en-us/windows/desktop/api/processthreadsapi/nf-processthreadsapi-openthreadtoken">https://docs.microsoft.com/en-us/windows/desktop/api/processthreadsapi/nf-processthreadsapi-openthreadtoken</a></p>
|
||
</div>
|
||
</dd></dl>
|
||
|
||
<dl class="py property">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.WinThread.owner">
|
||
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">owner</span></span><a class="headerlink" href="#windows.winobject.process.WinThread.owner" title="Link to this definition">¶</a></dt>
|
||
<dd><p>The Process owning the thread</p>
|
||
<dl class="field-list simple">
|
||
<dt class="field-odd">Type<span class="colon">:</span></dt>
|
||
<dd class="field-odd"><p><a class="reference internal" href="#windows.winobject.process.WinProcess" title="windows.winobject.process.WinProcess"><code class="xref py py-class docutils literal notranslate"><span class="pre">WinProcess</span></code></a></p>
|
||
</dd>
|
||
</dl>
|
||
</dd></dl>
|
||
|
||
<dl class="py method">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.WinThread.resume">
|
||
<span class="sig-name descname"><span class="pre">resume</span></span><span class="sig-paren">(</span><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/process.html#WinThread.resume"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.winobject.process.WinThread.resume" title="Link to this definition">¶</a></dt>
|
||
<dd><p>Resume the thread</p>
|
||
</dd></dl>
|
||
|
||
<dl class="py method">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.WinThread.set_context">
|
||
<span class="sig-name descname"><span class="pre">set_context</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">context</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/process.html#WinThread.set_context"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.winobject.process.WinThread.set_context" title="Link to this definition">¶</a></dt>
|
||
<dd><p>Set the thread’s context to <code class="docutils literal notranslate"><span class="pre">context</span></code></p>
|
||
</dd></dl>
|
||
|
||
<dl class="py method">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.WinThread.set_syswow_context">
|
||
<span class="sig-name descname"><span class="pre">set_syswow_context</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">context</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/process.html#WinThread.set_syswow_context"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.winobject.process.WinThread.set_syswow_context" title="Link to this definition">¶</a></dt>
|
||
<dd><p>Set a syswow thread’s 64 context to <code class="docutils literal notranslate"><span class="pre">context</span></code></p>
|
||
</dd></dl>
|
||
|
||
<dl class="py method">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.WinThread.set_token">
|
||
<span class="sig-name descname"><span class="pre">set_token</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">token</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.WinThread.set_token" title="Link to this definition">¶</a></dt>
|
||
<dd><p>Set the token for the thread (impersonation). Setting the token to None revert the impersonation</p>
|
||
</dd></dl>
|
||
|
||
<dl class="py property">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.WinThread.start_address">
|
||
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">start_address</span></span><a class="headerlink" href="#windows.winobject.process.WinThread.start_address" title="Link to this definition">¶</a></dt>
|
||
<dd><p>The start address of the thread</p>
|
||
<dl class="field-list simple">
|
||
<dt class="field-odd">Type<span class="colon">:</span></dt>
|
||
<dd class="field-odd"><p><code class="xref py py-class docutils literal notranslate"><span class="pre">int</span></code></p>
|
||
</dd>
|
||
</dl>
|
||
</dd></dl>
|
||
|
||
<dl class="py method">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.WinThread.suspend">
|
||
<span class="sig-name descname"><span class="pre">suspend</span></span><span class="sig-paren">(</span><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/process.html#WinThread.suspend"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.winobject.process.WinThread.suspend" title="Link to this definition">¶</a></dt>
|
||
<dd><p>Suspend the thread</p>
|
||
</dd></dl>
|
||
|
||
<dl class="py property">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.WinThread.teb_base">
|
||
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">teb_base</span></span><a class="headerlink" href="#windows.winobject.process.WinThread.teb_base" title="Link to this definition">¶</a></dt>
|
||
<dd><p>The address of the thread’s TEB. If the owner is a SysWow64 process, return the TEB32.</p>
|
||
<dl class="field-list simple">
|
||
<dt class="field-odd">Type<span class="colon">:</span></dt>
|
||
<dd class="field-odd"><p><code class="xref py py-class docutils literal notranslate"><span class="pre">int</span></code></p>
|
||
</dd>
|
||
</dl>
|
||
</dd></dl>
|
||
|
||
<dl class="py property">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.WinThread.teb_syswow_base">
|
||
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">teb_syswow_base</span></span><a class="headerlink" href="#windows.winobject.process.WinThread.teb_syswow_base" title="Link to this definition">¶</a></dt>
|
||
<dd><p>The address of the thread’s TEB64 for a SysWow64 process</p>
|
||
<dl class="field-list simple">
|
||
<dt class="field-odd">Type<span class="colon">:</span></dt>
|
||
<dd class="field-odd"><p><code class="xref py py-class docutils literal notranslate"><span class="pre">int</span></code></p>
|
||
</dd>
|
||
</dl>
|
||
</dd></dl>
|
||
|
||
<dl class="py property">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.WinThread.tid">
|
||
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">tid</span></span><a class="headerlink" href="#windows.winobject.process.WinThread.tid" title="Link to this definition">¶</a></dt>
|
||
<dd><p>Thread ID</p>
|
||
<dl class="field-list simple">
|
||
<dt class="field-odd">Type<span class="colon">:</span></dt>
|
||
<dd class="field-odd"><p><code class="xref py py-class docutils literal notranslate"><span class="pre">int</span></code></p>
|
||
</dd>
|
||
</dl>
|
||
</dd></dl>
|
||
|
||
<dl class="py property">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.WinThread.token">
|
||
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">token</span></span><a class="headerlink" href="#windows.winobject.process.WinThread.token" title="Link to this definition">¶</a></dt>
|
||
<dd><p>The thread <a class="reference internal" href="token.html#windows.winobject.token.Token" title="windows.winobject.token.Token"><code class="xref py py-class docutils literal notranslate"><span class="pre">Token</span></code></a></p>
|
||
<dl class="field-list simple">
|
||
<dt class="field-odd">Getter<span class="colon">:</span></dt>
|
||
<dd class="field-odd"><p><a class="reference internal" href="#windows.winobject.process.WinThread.open_token" title="windows.winobject.process.WinThread.open_token"><code class="xref py py-func docutils literal notranslate"><span class="pre">open_token()</span></code></a></p>
|
||
</dd>
|
||
<dt class="field-even">Setter<span class="colon">:</span></dt>
|
||
<dd class="field-even"><p><a class="reference internal" href="#windows.winobject.process.WinThread.set_token" title="windows.winobject.process.WinThread.set_token"><code class="xref py py-func docutils literal notranslate"><span class="pre">set_token()</span></code></a></p>
|
||
</dd>
|
||
</dl>
|
||
</dd></dl>
|
||
|
||
<dl class="py method">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.WinThread.wait">
|
||
<span class="sig-name descname"><span class="pre">wait</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">timeout</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">INFINITE(0xffffffff)</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.WinThread.wait" title="Link to this definition">¶</a></dt>
|
||
<dd><p>Wait for the object</p>
|
||
</dd></dl>
|
||
|
||
</dd></dl>
|
||
|
||
<dl class="py class">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.DeadThread">
|
||
<em class="property"><span class="pre">class</span><span class="w"> </span></em><span class="sig-prename descclassname"><span class="pre">windows.winobject.process.</span></span><span class="sig-name descname"><span class="pre">DeadThread</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">handle</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">tid</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">None</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/process.html#DeadThread"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.winobject.process.DeadThread" title="Link to this definition">¶</a></dt>
|
||
<dd><p>Bases: <code class="xref py py-class docutils literal notranslate"><span class="pre">AutoHandle</span></code></p>
|
||
<p>An already dead thread (returned only by API returning a new thread if thread die before being returned)</p>
|
||
<dl class="py property">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.DeadThread.exit_code">
|
||
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">exit_code</span></span><a class="headerlink" href="#windows.winobject.process.DeadThread.exit_code" title="Link to this definition">¶</a></dt>
|
||
<dd><p>The exit code of the thread : <code class="docutils literal notranslate"><span class="pre">STILL_ACTIVE</span></code> means the process is not dead</p>
|
||
<dl class="field-list simple">
|
||
<dt class="field-odd">Type<span class="colon">:</span></dt>
|
||
<dd class="field-odd"><p><code class="xref py py-class docutils literal notranslate"><span class="pre">int</span></code></p>
|
||
</dd>
|
||
</dl>
|
||
</dd></dl>
|
||
|
||
<dl class="py property">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.DeadThread.handle">
|
||
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">handle</span></span><a class="headerlink" href="#windows.winobject.process.DeadThread.handle" title="Link to this definition">¶</a></dt>
|
||
<dd><p>An handle on the object</p>
|
||
<dl class="field-list">
|
||
<dt class="field-odd">Type<span class="colon">:</span></dt>
|
||
<dd class="field-odd"><p>HANDLE</p>
|
||
<div class="admonition note">
|
||
<p class="admonition-title">Note</p>
|
||
<p>The handle is automaticaly closed when the object is destroyed</p>
|
||
</div>
|
||
</dd>
|
||
</dl>
|
||
</dd></dl>
|
||
|
||
<dl class="py property">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.DeadThread.is_exit">
|
||
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">is_exit</span></span><a class="headerlink" href="#windows.winobject.process.DeadThread.is_exit" title="Link to this definition">¶</a></dt>
|
||
<dd><p><code class="docutils literal notranslate"><span class="pre">True</span></code> if the thread is terminated</p>
|
||
<dl class="field-list simple">
|
||
<dt class="field-odd">Type<span class="colon">:</span></dt>
|
||
<dd class="field-odd"><p><code class="xref py py-class docutils literal notranslate"><span class="pre">bool</span></code></p>
|
||
</dd>
|
||
</dl>
|
||
</dd></dl>
|
||
|
||
<dl class="py method">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.DeadThread.wait">
|
||
<span class="sig-name descname"><span class="pre">wait</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">timeout</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">INFINITE(0xffffffff)</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.DeadThread.wait" title="Link to this definition">¶</a></dt>
|
||
<dd><p>Wait for the object</p>
|
||
</dd></dl>
|
||
|
||
</dd></dl>
|
||
|
||
</section>
|
||
</section>
|
||
<section id="peb-exploration">
|
||
<h1><span class="section-number">2.2. </span>PEB Exploration<a class="headerlink" href="#peb-exploration" title="Link to this heading">¶</a></h1>
|
||
<p>The <code class="xref py py-mod docutils literal notranslate"><span class="pre">windows</span></code> module is able to parse the PEB of the current process or remote process.
|
||
The <a class="reference internal" href="#windows.winobject.process.PEB" title="windows.winobject.process.PEB"><code class="xref py py-class docutils literal notranslate"><span class="pre">PEB</span></code></a> is accessible via <code class="docutils literal notranslate"><span class="pre">process.peb</span></code> and is of type <a class="reference internal" href="#windows.winobject.process.PEB" title="windows.winobject.process.PEB"><code class="xref py py-class docutils literal notranslate"><span class="pre">PEB</span></code></a>.</p>
|
||
<div class="admonition note">
|
||
<p class="admonition-title">Note</p>
|
||
<p>See sample <a class="reference internal" href="sample.html#sample-peb-exploration"><span class="std std-ref">PEB exploration</span></a></p>
|
||
</div>
|
||
<section id="peb">
|
||
<h2><span class="section-number">2.2.1. </span>PEB<a class="headerlink" href="#peb" title="Link to this heading">¶</a></h2>
|
||
<dl class="py class">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.PEB">
|
||
<em class="property"><span class="pre">class</span><span class="w"> </span></em><span class="sig-prename descclassname"><span class="pre">windows.winobject.process.</span></span><span class="sig-name descname"><span class="pre">PEB</span></span><a class="reference internal" href="_modules/windows/winobject/process.html#PEB"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.winobject.process.PEB" title="Link to this definition">¶</a></dt>
|
||
<dd><p>The PEB (Process Environment Block) of the current process</p>
|
||
<dl class="py property">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.PEB.apisetmap">
|
||
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">apisetmap</span></span><a class="headerlink" href="#windows.winobject.process.PEB.apisetmap" title="Link to this definition">¶</a></dt>
|
||
<dd><p>The <a class="reference internal" href="#windows.winobject.apisetmap.ApiSetMap" title="windows.winobject.apisetmap.ApiSetMap"><code class="xref py py-class docutils literal notranslate"><span class="pre">ApiSetMap</span></code></a> of the process</p>
|
||
<dl class="field-list simple">
|
||
<dt class="field-odd">Return type<span class="colon">:</span></dt>
|
||
<dd class="field-odd"><p>A subclass of <a class="reference internal" href="#windows.winobject.apisetmap.ApiSetMap" title="windows.winobject.apisetmap.ApiSetMap"><code class="xref py py-class docutils literal notranslate"><span class="pre">ApiSetMap</span></code></a></p>
|
||
</dd>
|
||
<dt class="field-even">Raise<span class="colon">:</span></dt>
|
||
<dd class="field-even"><p><code class="xref py py-class docutils literal notranslate"><span class="pre">NotImplementedError</span></code> – Before <code class="docutils literal notranslate"><span class="pre">6.2</span></code> ApiSetMap did not exist</p>
|
||
</dd>
|
||
<dt class="field-odd">Raise<span class="colon">:</span></dt>
|
||
<dd class="field-odd"><p><code class="xref py py-class docutils literal notranslate"><span class="pre">NotImplementedError</span></code> – Not implemented for remote process</p>
|
||
</dd>
|
||
</dl>
|
||
</dd></dl>
|
||
|
||
<dl class="py property">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.PEB.commandline">
|
||
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">commandline</span></span><a class="headerlink" href="#windows.winobject.process.PEB.commandline" title="Link to this definition">¶</a></dt>
|
||
<dd><p>The CommandLine of the PEB</p>
|
||
<dl class="field-list simple">
|
||
<dt class="field-odd">Type<span class="colon">:</span></dt>
|
||
<dd class="field-odd"><p><a class="reference internal" href="winstructs_generated.html#windows.generated_def.winstructs.LSA_UNICODE_STRING" title="windows.generated_def.winstructs.LSA_UNICODE_STRING"><code class="xref py py-class docutils literal notranslate"><span class="pre">LSA_UNICODE_STRING</span></code></a></p>
|
||
</dd>
|
||
</dl>
|
||
</dd></dl>
|
||
|
||
<dl class="py property">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.PEB.exe">
|
||
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">exe</span></span><a class="headerlink" href="#windows.winobject.process.PEB.exe" title="Link to this definition">¶</a></dt>
|
||
<dd><p>The executable of the process, as pointed by PEB.ImageBaseAddress</p>
|
||
<dl class="field-list simple">
|
||
<dt class="field-odd">Type<span class="colon">:</span></dt>
|
||
<dd class="field-odd"><p><a class="reference internal" href="#windows.pe_parse.PEFile" title="windows.pe_parse.PEFile"><code class="xref py py-class docutils literal notranslate"><span class="pre">windows.pe_parse.PEFile</span></code></a></p>
|
||
</dd>
|
||
</dl>
|
||
</dd></dl>
|
||
|
||
<dl class="py property">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.PEB.imagepath">
|
||
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">imagepath</span></span><a class="headerlink" href="#windows.winobject.process.PEB.imagepath" title="Link to this definition">¶</a></dt>
|
||
<dd><p>The ImagePathName of the PEB</p>
|
||
<dl class="field-list simple">
|
||
<dt class="field-odd">Type<span class="colon">:</span></dt>
|
||
<dd class="field-odd"><p><a class="reference internal" href="winstructs_generated.html#windows.generated_def.winstructs.LSA_UNICODE_STRING" title="windows.generated_def.winstructs.LSA_UNICODE_STRING"><code class="xref py py-class docutils literal notranslate"><span class="pre">LSA_UNICODE_STRING</span></code></a></p>
|
||
</dd>
|
||
</dl>
|
||
</dd></dl>
|
||
|
||
<dl class="py property">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.PEB.modules">
|
||
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">modules</span></span><a class="headerlink" href="#windows.winobject.process.PEB.modules" title="Link to this definition">¶</a></dt>
|
||
<dd><p>The loaded modules present in the PEB</p>
|
||
<dl class="field-list simple">
|
||
<dt class="field-odd">Type<span class="colon">:</span></dt>
|
||
<dd class="field-odd"><p>[<a class="reference internal" href="#windows.winobject.process.LoadedModule" title="windows.winobject.process.LoadedModule"><code class="xref py py-class docutils literal notranslate"><span class="pre">LoadedModule</span></code></a>] – List of loaded modules</p>
|
||
</dd>
|
||
</dl>
|
||
</dd></dl>
|
||
|
||
</dd></dl>
|
||
|
||
</section>
|
||
<section id="loadedmodule">
|
||
<h2><span class="section-number">2.2.2. </span>LoadedModule<a class="headerlink" href="#loadedmodule" title="Link to this heading">¶</a></h2>
|
||
<dl class="py class">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.LoadedModule">
|
||
<em class="property"><span class="pre">class</span><span class="w"> </span></em><span class="sig-prename descclassname"><span class="pre">windows.winobject.process.</span></span><span class="sig-name descname"><span class="pre">LoadedModule</span></span><a class="reference internal" href="_modules/windows/winobject/process.html#LoadedModule"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.winobject.process.LoadedModule" title="Link to this definition">¶</a></dt>
|
||
<dd><p>An entry in the PEB Ldr list</p>
|
||
<dl class="py property">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.LoadedModule.baseaddr">
|
||
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">baseaddr</span></span><a class="headerlink" href="#windows.winobject.process.LoadedModule.baseaddr" title="Link to this definition">¶</a></dt>
|
||
<dd><p>Base address of the module</p>
|
||
<dl class="field-list simple">
|
||
<dt class="field-odd">Type<span class="colon">:</span></dt>
|
||
<dd class="field-odd"><p><code class="xref py py-class docutils literal notranslate"><span class="pre">int</span></code></p>
|
||
</dd>
|
||
</dl>
|
||
</dd></dl>
|
||
|
||
<dl class="py property">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.LoadedModule.fullname">
|
||
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">fullname</span></span><a class="headerlink" href="#windows.winobject.process.LoadedModule.fullname" title="Link to this definition">¶</a></dt>
|
||
<dd><p>Full name of the module (path)</p>
|
||
<dl class="field-list simple">
|
||
<dt class="field-odd">Type<span class="colon">:</span></dt>
|
||
<dd class="field-odd"><p><code class="xref py py-class docutils literal notranslate"><span class="pre">str</span></code></p>
|
||
</dd>
|
||
</dl>
|
||
</dd></dl>
|
||
|
||
<dl class="py property">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.LoadedModule.name">
|
||
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">name</span></span><a class="headerlink" href="#windows.winobject.process.LoadedModule.name" title="Link to this definition">¶</a></dt>
|
||
<dd><p>Name of the module</p>
|
||
<dl class="field-list simple">
|
||
<dt class="field-odd">Type<span class="colon">:</span></dt>
|
||
<dd class="field-odd"><p><code class="xref py py-class docutils literal notranslate"><span class="pre">str</span></code></p>
|
||
</dd>
|
||
</dl>
|
||
</dd></dl>
|
||
|
||
<dl class="py property">
|
||
<dt class="sig sig-object py" id="windows.winobject.process.LoadedModule.pe">
|
||
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">pe</span></span><a class="headerlink" href="#windows.winobject.process.LoadedModule.pe" title="Link to this definition">¶</a></dt>
|
||
<dd><p>A PE representation of the module</p>
|
||
<dl class="field-list simple">
|
||
<dt class="field-odd">Type<span class="colon">:</span></dt>
|
||
<dd class="field-odd"><p><a class="reference internal" href="#windows.pe_parse.PEFile" title="windows.pe_parse.PEFile"><code class="xref py py-class docutils literal notranslate"><span class="pre">windows.pe_parse.PEFile</span></code></a></p>
|
||
</dd>
|
||
</dl>
|
||
</dd></dl>
|
||
|
||
</dd></dl>
|
||
|
||
</section>
|
||
<section id="apisetmap">
|
||
<h2><span class="section-number">2.2.3. </span>ApiSetMap<a class="headerlink" href="#apisetmap" title="Link to this heading">¶</a></h2>
|
||
<div class="admonition note">
|
||
<p class="admonition-title">Note</p>
|
||
<p>see sample <a class="reference internal" href="sample.html#sample-apisetmap"><span class="std std-ref">ApiSetMap</span></a></p>
|
||
</div>
|
||
<dl class="py class">
|
||
<dt class="sig sig-object py" id="windows.winobject.apisetmap.ApiSetMap">
|
||
<em class="property"><span class="pre">class</span><span class="w"> </span></em><span class="sig-prename descclassname"><span class="pre">windows.winobject.apisetmap.</span></span><span class="sig-name descname"><span class="pre">ApiSetMap</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">base</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/apisetmap.html#ApiSetMap"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.winobject.apisetmap.ApiSetMap" title="Link to this definition">¶</a></dt>
|
||
<dd><p>The base class for the ApiSeMap
|
||
(see <a class="reference external" href="https://blog.quarkslab.com/runtime-dll-name-resolution-apisetschema-part-ii.html">Runtime DLL name resolution: ApiSetSchema</a>)</p>
|
||
<dl class="py property">
|
||
<dt class="sig sig-object py" id="windows.winobject.apisetmap.ApiSetMap.apisetmap_dict">
|
||
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">apisetmap_dict</span></span><a class="headerlink" href="#windows.winobject.apisetmap.ApiSetMap.apisetmap_dict" title="Link to this definition">¶</a></dt>
|
||
<dd><p>The apisetmap dll-mapping content extracted from memory as a <code class="xref py py-class docutils literal notranslate"><span class="pre">dict</span></code></p>
|
||
<p><code class="docutils literal notranslate"><span class="pre">key</span> <span class="pre">-></span> <span class="pre">value</span> <span class="pre">example</span></code>:</p>
|
||
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="sa">u</span><span class="s1">'ext-ms-win-advapi32-encryptedfile-l1-1-1'</span> <span class="o">-></span> <span class="sa">u</span><span class="s1">'advapi32.dll'</span>
|
||
</pre></div>
|
||
</div>
|
||
</dd></dl>
|
||
|
||
<dl class="py property">
|
||
<dt class="sig sig-object py" id="windows.winobject.apisetmap.ApiSetMap.resolution_dict">
|
||
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">resolution_dict</span></span><a class="headerlink" href="#windows.winobject.apisetmap.ApiSetMap.resolution_dict" title="Link to this definition">¶</a></dt>
|
||
<dd><p>The <code class="xref py py-class docutils literal notranslate"><span class="pre">dict</span></code> based on <a class="reference internal" href="#windows.winobject.apisetmap.ApiSetMap.apisetmap_dict" title="windows.winobject.apisetmap.ApiSetMap.apisetmap_dict"><code class="xref py py-obj docutils literal notranslate"><span class="pre">apisetmap_dict</span></code></a> with only the part checked by <code class="docutils literal notranslate"><span class="pre">Windows</span></code>.</p>
|
||
<p><code class="docutils literal notranslate"><span class="pre">Windows</span></code> does not care about what is after the last <code class="docutils literal notranslate"><span class="pre">-</span></code></p>
|
||
<p><code class="docutils literal notranslate"><span class="pre">key</span> <span class="pre">-></span> <span class="pre">value</span> <span class="pre">example</span></code>:</p>
|
||
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="sa">u</span><span class="s1">'ext-ms-win-advapi32-encryptedfile-l1-1-'</span> <span class="o">-></span> <span class="sa">u</span><span class="s1">'advapi32.dll'</span>
|
||
</pre></div>
|
||
</div>
|
||
</dd></dl>
|
||
|
||
<dl class="py method">
|
||
<dt class="sig sig-object py" id="windows.winobject.apisetmap.ApiSetMap.resolve">
|
||
<span class="sig-name descname"><span class="pre">resolve</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">dllname</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/apisetmap.html#ApiSetMap.resolve"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.winobject.apisetmap.ApiSetMap.resolve" title="Link to this definition">¶</a></dt>
|
||
<dd><p>The method used to resolve a DLL name using the ApiSetMap.
|
||
The behavior should match the non-exported function <code class="docutils literal notranslate"><span class="pre">ntdll!ApiSetResolveToHost</span></code></p>
|
||
</dd></dl>
|
||
|
||
<dl class="py attribute">
|
||
<dt class="sig sig-object py" id="windows.winobject.apisetmap.ApiSetMap.version">
|
||
<span class="sig-name descname"><span class="pre">version</span></span><em class="property"><span class="w"> </span><span class="p"><span class="pre">=</span></span><span class="w"> </span><span class="pre">None</span></em><a class="headerlink" href="#windows.winobject.apisetmap.ApiSetMap.version" title="Link to this definition">¶</a></dt>
|
||
<dd><p>The version of the ApiSetMap</p>
|
||
</dd></dl>
|
||
|
||
</dd></dl>
|
||
|
||
<div class="admonition note">
|
||
<p class="admonition-title">Note</p>
|
||
<p>Currently supported version for the ApiSetMap are 2/4/6</p>
|
||
</div>
|
||
<dl class="py class">
|
||
<dt class="sig sig-object py" id="windows.winobject.apisetmap.ApiSetMapVersion2">
|
||
<em class="property"><span class="pre">class</span><span class="w"> </span></em><span class="sig-prename descclassname"><span class="pre">windows.winobject.apisetmap.</span></span><span class="sig-name descname"><span class="pre">ApiSetMapVersion2</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">base</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/apisetmap.html#ApiSetMapVersion2"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.winobject.apisetmap.ApiSetMapVersion2" title="Link to this definition">¶</a></dt>
|
||
<dd><p>Represent an ApiSetMap version-2</p>
|
||
<dl class="py attribute">
|
||
<dt class="sig sig-object py" id="windows.winobject.apisetmap.ApiSetMapVersion2.version">
|
||
<span class="sig-name descname"><span class="pre">version</span></span><em class="property"><span class="w"> </span><span class="p"><span class="pre">=</span></span><span class="w"> </span><span class="pre">2</span></em><a class="headerlink" href="#windows.winobject.apisetmap.ApiSetMapVersion2.version" title="Link to this definition">¶</a></dt>
|
||
<dd><p>The version of the ApiSetMap</p>
|
||
</dd></dl>
|
||
|
||
</dd></dl>
|
||
|
||
<dl class="py class">
|
||
<dt class="sig sig-object py" id="windows.winobject.apisetmap.ApiSetMapVersion4">
|
||
<em class="property"><span class="pre">class</span><span class="w"> </span></em><span class="sig-prename descclassname"><span class="pre">windows.winobject.apisetmap.</span></span><span class="sig-name descname"><span class="pre">ApiSetMapVersion4</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">base</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/apisetmap.html#ApiSetMapVersion4"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.winobject.apisetmap.ApiSetMapVersion4" title="Link to this definition">¶</a></dt>
|
||
<dd><p>Represent an ApiSetMap version-4</p>
|
||
<dl class="py attribute">
|
||
<dt class="sig sig-object py" id="windows.winobject.apisetmap.ApiSetMapVersion4.version">
|
||
<span class="sig-name descname"><span class="pre">version</span></span><em class="property"><span class="w"> </span><span class="p"><span class="pre">=</span></span><span class="w"> </span><span class="pre">4</span></em><a class="headerlink" href="#windows.winobject.apisetmap.ApiSetMapVersion4.version" title="Link to this definition">¶</a></dt>
|
||
<dd><p>The version of the ApiSetMap</p>
|
||
</dd></dl>
|
||
|
||
</dd></dl>
|
||
|
||
<dl class="py class">
|
||
<dt class="sig sig-object py" id="windows.winobject.apisetmap.ApiSetMapVersion6">
|
||
<em class="property"><span class="pre">class</span><span class="w"> </span></em><span class="sig-prename descclassname"><span class="pre">windows.winobject.apisetmap.</span></span><span class="sig-name descname"><span class="pre">ApiSetMapVersion6</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">base</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/apisetmap.html#ApiSetMapVersion6"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.winobject.apisetmap.ApiSetMapVersion6" title="Link to this definition">¶</a></dt>
|
||
<dd><p>Represent an ApiSetMap version-6</p>
|
||
<dl class="py attribute">
|
||
<dt class="sig sig-object py" id="windows.winobject.apisetmap.ApiSetMapVersion6.version">
|
||
<span class="sig-name descname"><span class="pre">version</span></span><em class="property"><span class="w"> </span><span class="p"><span class="pre">=</span></span><span class="w"> </span><span class="pre">6</span></em><a class="headerlink" href="#windows.winobject.apisetmap.ApiSetMapVersion6.version" title="Link to this definition">¶</a></dt>
|
||
<dd><p>The version of the ApiSetMap</p>
|
||
</dd></dl>
|
||
|
||
</dd></dl>
|
||
|
||
</section>
|
||
</section>
|
||
<section id="pefile-parsing-loaded-pe">
|
||
<h1><span class="section-number">2.3. </span>PEFile - Parsing loaded PE<a class="headerlink" href="#pefile-parsing-loaded-pe" title="Link to this heading">¶</a></h1>
|
||
<section id="module-windows.pe_parse">
|
||
<span id="windows-pe-parse"></span><h2><span class="section-number">2.3.1. </span><a class="reference internal" href="#module-windows.pe_parse" title="windows.pe_parse"><code class="xref py py-mod docutils literal notranslate"><span class="pre">windows.pe_parse</span></code></a><a class="headerlink" href="#module-windows.pe_parse" title="Link to this heading">¶</a></h2>
|
||
<dl class="py function">
|
||
<dt class="sig sig-object py" id="windows.pe_parse.GetPEFile">
|
||
<span class="sig-prename descclassname"><span class="pre">windows.pe_parse.</span></span><span class="sig-name descname"><span class="pre">GetPEFile</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">baseaddr</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">target</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">None</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">force_bitness</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">None</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/pe_parse.html#GetPEFile"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.pe_parse.GetPEFile" title="Link to this definition">¶</a></dt>
|
||
<dd><p>Returns a <a class="reference internal" href="#windows.pe_parse.PEFile" title="windows.pe_parse.PEFile"><code class="xref py py-class docutils literal notranslate"><span class="pre">PEFile</span></code></a> to explore a PE loaded at <cite>baseaddr</cite> in process <cite>target</cite>.</p>
|
||
<dl class="field-list simple">
|
||
<dt class="field-odd">Return type<span class="colon">:</span></dt>
|
||
<dd class="field-odd"><p><a class="reference internal" href="#windows.pe_parse.PEFile" title="windows.pe_parse.PEFile"><code class="xref py py-class docutils literal notranslate"><span class="pre">PEFile</span></code></a></p>
|
||
</dd>
|
||
</dl>
|
||
<div class="admonition note">
|
||
<p class="admonition-title">Note</p>
|
||
<p>If target is <code class="docutils literal notranslate"><span class="pre">None</span></code> it refers to the current process</p>
|
||
</div>
|
||
</dd></dl>
|
||
|
||
<section id="pefile">
|
||
<h3><span class="section-number">2.3.1.1. </span>PEFile<a class="headerlink" href="#pefile" title="Link to this heading">¶</a></h3>
|
||
<dl class="py class">
|
||
<dt class="sig sig-object py" id="windows.pe_parse.PEFile">
|
||
<em class="property"><span class="pre">class</span><span class="w"> </span></em><span class="sig-prename descclassname"><span class="pre">windows.pe_parse.</span></span><span class="sig-name descname"><span class="pre">PEFile</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">target</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">baseaddr</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">targetedbitness</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">transformers</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/pe_parse.html#PEFile"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.pe_parse.PEFile" title="Link to this definition">¶</a></dt>
|
||
<dd><p>Represent a PE loaded in a process (current or remote)</p>
|
||
<dl class="py property">
|
||
<dt class="sig sig-object py" id="windows.pe_parse.PEFile.export_name">
|
||
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">export_name</span></span><a class="headerlink" href="#windows.pe_parse.PEFile.export_name" title="Link to this definition">¶</a></dt>
|
||
<dd><p>The Name attribute of the <code class="docutils literal notranslate"><span class="pre">EXPORT_DIRECTORY</span></code></p>
|
||
</dd></dl>
|
||
|
||
<dl class="py property">
|
||
<dt class="sig sig-object py" id="windows.pe_parse.PEFile.exports">
|
||
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">exports</span></span><a class="headerlink" href="#windows.pe_parse.PEFile.exports" title="Link to this definition">¶</a></dt>
|
||
<dd><p>The exports of the PE in a dict. Keys are ordinal (<code class="xref py py-class docutils literal notranslate"><span class="pre">int</span></code>) and name (<code class="xref py py-class docutils literal notranslate"><span class="pre">str</span></code>).
|
||
The values are the addresses of the exports.</p>
|
||
<blockquote>
|
||
<div><dl class="field-list simple">
|
||
<dt class="field-odd">type<span class="colon">:</span></dt>
|
||
<dd class="field-odd"><p>{(<code class="xref py py-class docutils literal notranslate"><span class="pre">int</span></code> or <code class="xref py py-class docutils literal notranslate"><span class="pre">str</span></code>) : <code class="xref py py-class docutils literal notranslate"><span class="pre">int</span></code>}</p>
|
||
</dd>
|
||
</dl>
|
||
</div></blockquote>
|
||
</dd></dl>
|
||
|
||
<dl class="py property">
|
||
<dt class="sig sig-object py" id="windows.pe_parse.PEFile.imports">
|
||
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">imports</span></span><a class="headerlink" href="#windows.pe_parse.PEFile.imports" title="Link to this definition">¶</a></dt>
|
||
<dd><p>The imports of the PE in a dict.
|
||
Keys are the names of DLL to import from and values are <code class="xref py py-class docutils literal notranslate"><span class="pre">list</span></code>
|
||
of <a class="reference internal" href="#windows.pe_parse.IATEntry" title="windows.pe_parse.IATEntry"><code class="xref py py-class docutils literal notranslate"><span class="pre">IATEntry</span></code></a></p>
|
||
<blockquote>
|
||
<div><dl class="field-list simple">
|
||
<dt class="field-odd">type<span class="colon">:</span></dt>
|
||
<dd class="field-odd"><p>{<code class="xref py py-class docutils literal notranslate"><span class="pre">str</span></code> : [<a class="reference internal" href="#windows.pe_parse.IATEntry" title="windows.pe_parse.IATEntry"><code class="xref py py-class docutils literal notranslate"><span class="pre">IATEntry</span></code></a>]}</p>
|
||
</dd>
|
||
</dl>
|
||
</div></blockquote>
|
||
</dd></dl>
|
||
|
||
</dd></dl>
|
||
|
||
</section>
|
||
<section id="iatentry">
|
||
<h3><span class="section-number">2.3.1.2. </span>IATEntry<a class="headerlink" href="#iatentry" title="Link to this heading">¶</a></h3>
|
||
<dl class="py class">
|
||
<dt class="sig sig-object py" id="windows.pe_parse.IATEntry">
|
||
<em class="property"><span class="pre">class</span><span class="w"> </span></em><span class="sig-prename descclassname"><span class="pre">windows.pe_parse.</span></span><span class="sig-name descname"><span class="pre">IATEntry</span></span><a class="reference internal" href="_modules/windows/pe_parse.html#IATEntry"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.pe_parse.IATEntry" title="Link to this definition">¶</a></dt>
|
||
<dd><p>Represent an entry in the IAT of a module
|
||
Can be used to get resolved value and setup hook</p>
|
||
<dl class="py data">
|
||
<dt class="sig sig-object py" id="windows.pe_parse.IATEntry.addr">
|
||
<span class="sig-name descname"><span class="pre">addr</span></span><a class="headerlink" href="#windows.pe_parse.IATEntry.addr" title="Link to this definition">¶</a></dt>
|
||
<dd><p><code class="xref py py-class docutils literal notranslate"><span class="pre">int</span></code> : Address of the IAT Entry</p>
|
||
</dd></dl>
|
||
|
||
<dl class="py data">
|
||
<dt class="sig sig-object py" id="windows.pe_parse.IATEntry.ord">
|
||
<span class="sig-name descname"><span class="pre">ord</span></span><a class="headerlink" href="#windows.pe_parse.IATEntry.ord" title="Link to this definition">¶</a></dt>
|
||
<dd><p><code class="xref py py-class docutils literal notranslate"><span class="pre">int</span></code> : Ordinal of the imported function</p>
|
||
</dd></dl>
|
||
|
||
<dl class="py data">
|
||
<dt class="sig sig-object py" id="windows.pe_parse.IATEntry.name">
|
||
<span class="sig-name descname"><span class="pre">name</span></span><a class="headerlink" href="#windows.pe_parse.IATEntry.name" title="Link to this definition">¶</a></dt>
|
||
<dd><p><code class="xref py py-class docutils literal notranslate"><span class="pre">int</span></code> : Name of the imported function</p>
|
||
</dd></dl>
|
||
|
||
<dl class="py data">
|
||
<dt class="sig sig-object py" id="windows.pe_parse.IATEntry.value">
|
||
<span class="sig-name descname"><span class="pre">value</span></span><a class="headerlink" href="#windows.pe_parse.IATEntry.value" title="Link to this definition">¶</a></dt>
|
||
<dd><p><code class="xref py py-class docutils literal notranslate"><span class="pre">int</span></code> : The content (destination) of the IAT entry</p>
|
||
<div class="admonition warning">
|
||
<p class="admonition-title">Warning</p>
|
||
<p><cite>value</cite> is a descriptor. Setting its value will actually CHANGE THE IAT ENTRY, resulting in a segfault if no VirtualProtect have been done.</p>
|
||
</div>
|
||
<div class="admonition note">
|
||
<p class="admonition-title">Note</p>
|
||
<p>See: <a class="reference internal" href="utils.html#windows.utils.VirtualProtected" title="windows.utils.VirtualProtected"><code class="xref py py-class docutils literal notranslate"><span class="pre">windows.utils.VirtualProtected</span></code></a></p>
|
||
</div>
|
||
</dd></dl>
|
||
|
||
<dl class="py method">
|
||
<dt class="sig sig-object py" id="windows.pe_parse.IATEntry.remove_hook">
|
||
<span class="sig-name descname"><span class="pre">remove_hook</span></span><span class="sig-paren">(</span><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/pe_parse.html#IATEntry.remove_hook"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.pe_parse.IATEntry.remove_hook" title="Link to this definition">¶</a></dt>
|
||
<dd><p>Remove the hook on the entry</p>
|
||
</dd></dl>
|
||
|
||
<dl class="py method">
|
||
<dt class="sig sig-object py" id="windows.pe_parse.IATEntry.set_hook">
|
||
<span class="sig-name descname"><span class="pre">set_hook</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">callback</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">types</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">None</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/pe_parse.html#IATEntry.set_hook"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.pe_parse.IATEntry.set_hook" title="Link to this definition">¶</a></dt>
|
||
<dd><p>Setup a hook on the entry and return it.
|
||
You MUST keep a reference to the hook while the hook is enabled.</p>
|
||
<dl class="field-list simple">
|
||
<dt class="field-odd">Parameters<span class="colon">:</span></dt>
|
||
<dd class="field-odd"><p><strong>callback</strong> – <p>the hook</p>
|
||
<div class="admonition note">
|
||
<p class="admonition-title">Note</p>
|
||
<p>see <a class="reference internal" href="iat_hook.html#hook-protocol"><span class="std std-ref">Hook protocol</span></a></p>
|
||
</div>
|
||
</p>
|
||
</dd>
|
||
<dt class="field-even">Return type<span class="colon">:</span></dt>
|
||
<dd class="field-even"><p><a class="reference internal" href="iat_hook.html#windows.hooks.IATHook" title="windows.hooks.IATHook"><code class="xref py py-class docutils literal notranslate"><span class="pre">windows.hooks.IATHook</span></code></a></p>
|
||
</dd>
|
||
</dl>
|
||
<div class="admonition warning">
|
||
<p class="admonition-title">Warning</p>
|
||
<p>This works only for PEFile with the current process as target.</p>
|
||
</div>
|
||
</dd></dl>
|
||
|
||
</dd></dl>
|
||
|
||
</section>
|
||
</section>
|
||
</section>
|
||
|
||
|
||
<div class="clearer"></div>
|
||
</div>
|
||
</div>
|
||
</div>
|
||
<div class="sphinxsidebar" role="navigation" aria-label="main navigation">
|
||
<div class="sphinxsidebarwrapper">
|
||
<div>
|
||
<h3><a href="index.html">Table of Contents</a></h3>
|
||
<ul>
|
||
<li><a class="reference internal" href="#">2.1. Processes and Threads</a><ul>
|
||
<li><a class="reference internal" href="#currentprocess">2.1.1. CurrentProcess</a><ul>
|
||
<li><a class="reference internal" href="#windows.winobject.process.CurrentProcess"><code class="docutils literal notranslate"><span class="pre">CurrentProcess</span></code></a><ul>
|
||
<li><a class="reference internal" href="#windows.winobject.process.CurrentProcess.allocated_memory"><code class="docutils literal notranslate"><span class="pre">allocated_memory()</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.CurrentProcess.bitness"><code class="docutils literal notranslate"><span class="pre">bitness</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.CurrentProcess.create_thread"><code class="docutils literal notranslate"><span class="pre">create_thread()</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.CurrentProcess.execute"><code class="docutils literal notranslate"><span class="pre">execute()</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.CurrentProcess.exit"><code class="docutils literal notranslate"><span class="pre">exit()</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.CurrentProcess.exit_code"><code class="docutils literal notranslate"><span class="pre">exit_code</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.CurrentProcess.get_mapped_filename"><code class="docutils literal notranslate"><span class="pre">get_mapped_filename()</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.CurrentProcess.handle"><code class="docutils literal notranslate"><span class="pre">handle</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.CurrentProcess.is_exit"><code class="docutils literal notranslate"><span class="pre">is_exit</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.CurrentProcess.is_wow_64"><code class="docutils literal notranslate"><span class="pre">is_wow_64</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.CurrentProcess.load_library"><code class="docutils literal notranslate"><span class="pre">load_library()</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.CurrentProcess.memory_state"><code class="docutils literal notranslate"><span class="pre">memory_state()</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.CurrentProcess.open_token"><code class="docutils literal notranslate"><span class="pre">open_token()</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.CurrentProcess.peb"><code class="docutils literal notranslate"><span class="pre">peb</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.CurrentProcess.peb_syswow"><code class="docutils literal notranslate"><span class="pre">peb_syswow</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.CurrentProcess.pid"><code class="docutils literal notranslate"><span class="pre">pid</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.CurrentProcess.ppid"><code class="docutils literal notranslate"><span class="pre">ppid</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.CurrentProcess.priority"><code class="docutils literal notranslate"><span class="pre">priority</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.CurrentProcess.query_memory"><code class="docutils literal notranslate"><span class="pre">query_memory()</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.CurrentProcess.read_byte"><code class="docutils literal notranslate"><span class="pre">read_byte()</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.CurrentProcess.read_dword"><code class="docutils literal notranslate"><span class="pre">read_dword()</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.CurrentProcess.read_memory"><code class="docutils literal notranslate"><span class="pre">read_memory()</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.CurrentProcess.read_ptr"><code class="docutils literal notranslate"><span class="pre">read_ptr()</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.CurrentProcess.read_qword"><code class="docutils literal notranslate"><span class="pre">read_qword()</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.CurrentProcess.read_short"><code class="docutils literal notranslate"><span class="pre">read_short()</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.CurrentProcess.read_string"><code class="docutils literal notranslate"><span class="pre">read_string()</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.CurrentProcess.read_wstring"><code class="docutils literal notranslate"><span class="pre">read_wstring()</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.CurrentProcess.threads"><code class="docutils literal notranslate"><span class="pre">threads</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.CurrentProcess.time_info"><code class="docutils literal notranslate"><span class="pre">time_info</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.CurrentProcess.token"><code class="docutils literal notranslate"><span class="pre">token</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.CurrentProcess.virtual_alloc"><code class="docutils literal notranslate"><span class="pre">virtual_alloc()</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.CurrentProcess.virtual_free"><code class="docutils literal notranslate"><span class="pre">virtual_free()</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.CurrentProcess.virtual_protect"><code class="docutils literal notranslate"><span class="pre">virtual_protect()</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.CurrentProcess.virtual_protected"><code class="docutils literal notranslate"><span class="pre">virtual_protected()</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.CurrentProcess.wait"><code class="docutils literal notranslate"><span class="pre">wait()</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.CurrentProcess.write_byte"><code class="docutils literal notranslate"><span class="pre">write_byte()</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.CurrentProcess.write_dword"><code class="docutils literal notranslate"><span class="pre">write_dword()</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.CurrentProcess.write_memory"><code class="docutils literal notranslate"><span class="pre">write_memory()</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.CurrentProcess.write_ptr"><code class="docutils literal notranslate"><span class="pre">write_ptr()</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.CurrentProcess.write_qword"><code class="docutils literal notranslate"><span class="pre">write_qword()</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.CurrentProcess.write_short"><code class="docutils literal notranslate"><span class="pre">write_short()</span></code></a></li>
|
||
</ul>
|
||
</li>
|
||
</ul>
|
||
</li>
|
||
<li><a class="reference internal" href="#currentthread">2.1.2. CurrentThread</a><ul>
|
||
<li><a class="reference internal" href="#windows.winobject.process.CurrentThread"><code class="docutils literal notranslate"><span class="pre">CurrentThread</span></code></a><ul>
|
||
<li><a class="reference internal" href="#windows.winobject.process.CurrentThread.exit"><code class="docutils literal notranslate"><span class="pre">exit()</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.CurrentThread.handle"><code class="docutils literal notranslate"><span class="pre">handle</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.CurrentThread.open_token"><code class="docutils literal notranslate"><span class="pre">open_token()</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.CurrentThread.owner"><code class="docutils literal notranslate"><span class="pre">owner</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.CurrentThread.set_token"><code class="docutils literal notranslate"><span class="pre">set_token()</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.CurrentThread.tid"><code class="docutils literal notranslate"><span class="pre">tid</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.CurrentThread.token"><code class="docutils literal notranslate"><span class="pre">token</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.CurrentThread.wait"><code class="docutils literal notranslate"><span class="pre">wait()</span></code></a></li>
|
||
</ul>
|
||
</li>
|
||
</ul>
|
||
</li>
|
||
<li><a class="reference internal" href="#winprocess">2.1.3. WinProcess</a><ul>
|
||
<li><a class="reference internal" href="#windows.winobject.process.WinProcess"><code class="docutils literal notranslate"><span class="pre">WinProcess</span></code></a><ul>
|
||
<li><a class="reference internal" href="#windows.winobject.process.WinProcess.allocated_memory"><code class="docutils literal notranslate"><span class="pre">allocated_memory()</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.WinProcess.bitness"><code class="docutils literal notranslate"><span class="pre">bitness</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.WinProcess.create_thread"><code class="docutils literal notranslate"><span class="pre">create_thread()</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.WinProcess.execute"><code class="docutils literal notranslate"><span class="pre">execute()</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.WinProcess.execute_python"><code class="docutils literal notranslate"><span class="pre">execute_python()</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.WinProcess.execute_python_unsafe"><code class="docutils literal notranslate"><span class="pre">execute_python_unsafe()</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.WinProcess.exit"><code class="docutils literal notranslate"><span class="pre">exit()</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.WinProcess.exit_code"><code class="docutils literal notranslate"><span class="pre">exit_code</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.WinProcess.get_mapped_filename"><code class="docutils literal notranslate"><span class="pre">get_mapped_filename()</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.WinProcess.handle"><code class="docutils literal notranslate"><span class="pre">handle</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.WinProcess.is_exit"><code class="docutils literal notranslate"><span class="pre">is_exit</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.WinProcess.is_wow_64"><code class="docutils literal notranslate"><span class="pre">is_wow_64</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.WinProcess.load_library"><code class="docutils literal notranslate"><span class="pre">load_library()</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.WinProcess.memory_state"><code class="docutils literal notranslate"><span class="pre">memory_state()</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.WinProcess.name"><code class="docutils literal notranslate"><span class="pre">name</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.WinProcess.open_token"><code class="docutils literal notranslate"><span class="pre">open_token()</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.WinProcess.peb"><code class="docutils literal notranslate"><span class="pre">peb</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.WinProcess.peb_addr"><code class="docutils literal notranslate"><span class="pre">peb_addr</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.WinProcess.peb_syswow"><code class="docutils literal notranslate"><span class="pre">peb_syswow</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.WinProcess.pid"><code class="docutils literal notranslate"><span class="pre">pid</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.WinProcess.ppid"><code class="docutils literal notranslate"><span class="pre">ppid</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.WinProcess.priority"><code class="docutils literal notranslate"><span class="pre">priority</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.WinProcess.query_memory"><code class="docutils literal notranslate"><span class="pre">query_memory()</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.WinProcess.read_byte"><code class="docutils literal notranslate"><span class="pre">read_byte()</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.WinProcess.read_dword"><code class="docutils literal notranslate"><span class="pre">read_dword()</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.WinProcess.read_memory"><code class="docutils literal notranslate"><span class="pre">read_memory()</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.WinProcess.read_memory_into"><code class="docutils literal notranslate"><span class="pre">read_memory_into()</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.WinProcess.read_ptr"><code class="docutils literal notranslate"><span class="pre">read_ptr()</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.WinProcess.read_qword"><code class="docutils literal notranslate"><span class="pre">read_qword()</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.WinProcess.read_short"><code class="docutils literal notranslate"><span class="pre">read_short()</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.WinProcess.read_string"><code class="docutils literal notranslate"><span class="pre">read_string()</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.WinProcess.read_wstring"><code class="docutils literal notranslate"><span class="pre">read_wstring()</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.WinProcess.threads"><code class="docutils literal notranslate"><span class="pre">threads</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.WinProcess.time_info"><code class="docutils literal notranslate"><span class="pre">time_info</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.WinProcess.token"><code class="docutils literal notranslate"><span class="pre">token</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.WinProcess.virtual_alloc"><code class="docutils literal notranslate"><span class="pre">virtual_alloc()</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.WinProcess.virtual_free"><code class="docutils literal notranslate"><span class="pre">virtual_free()</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.WinProcess.virtual_protect"><code class="docutils literal notranslate"><span class="pre">virtual_protect()</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.WinProcess.virtual_protected"><code class="docutils literal notranslate"><span class="pre">virtual_protected()</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.WinProcess.wait"><code class="docutils literal notranslate"><span class="pre">wait()</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.WinProcess.write_byte"><code class="docutils literal notranslate"><span class="pre">write_byte()</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.WinProcess.write_dword"><code class="docutils literal notranslate"><span class="pre">write_dword()</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.WinProcess.write_memory"><code class="docutils literal notranslate"><span class="pre">write_memory()</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.WinProcess.write_ptr"><code class="docutils literal notranslate"><span class="pre">write_ptr()</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.WinProcess.write_qword"><code class="docutils literal notranslate"><span class="pre">write_qword()</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.WinProcess.write_short"><code class="docutils literal notranslate"><span class="pre">write_short()</span></code></a></li>
|
||
</ul>
|
||
</li>
|
||
</ul>
|
||
</li>
|
||
<li><a class="reference internal" href="#winthread">2.1.4. WinThread</a><ul>
|
||
<li><a class="reference internal" href="#windows.winobject.process.WinThread"><code class="docutils literal notranslate"><span class="pre">WinThread</span></code></a><ul>
|
||
<li><a class="reference internal" href="#windows.winobject.process.WinThread.context"><code class="docutils literal notranslate"><span class="pre">context</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.WinThread.context_syswow"><code class="docutils literal notranslate"><span class="pre">context_syswow</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.WinThread.exit"><code class="docutils literal notranslate"><span class="pre">exit()</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.WinThread.exit_code"><code class="docutils literal notranslate"><span class="pre">exit_code</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.WinThread.handle"><code class="docutils literal notranslate"><span class="pre">handle</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.WinThread.is_exit"><code class="docutils literal notranslate"><span class="pre">is_exit</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.WinThread.open_token"><code class="docutils literal notranslate"><span class="pre">open_token()</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.WinThread.owner"><code class="docutils literal notranslate"><span class="pre">owner</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.WinThread.resume"><code class="docutils literal notranslate"><span class="pre">resume()</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.WinThread.set_context"><code class="docutils literal notranslate"><span class="pre">set_context()</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.WinThread.set_syswow_context"><code class="docutils literal notranslate"><span class="pre">set_syswow_context()</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.WinThread.set_token"><code class="docutils literal notranslate"><span class="pre">set_token()</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.WinThread.start_address"><code class="docutils literal notranslate"><span class="pre">start_address</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.WinThread.suspend"><code class="docutils literal notranslate"><span class="pre">suspend()</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.WinThread.teb_base"><code class="docutils literal notranslate"><span class="pre">teb_base</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.WinThread.teb_syswow_base"><code class="docutils literal notranslate"><span class="pre">teb_syswow_base</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.WinThread.tid"><code class="docutils literal notranslate"><span class="pre">tid</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.WinThread.token"><code class="docutils literal notranslate"><span class="pre">token</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.WinThread.wait"><code class="docutils literal notranslate"><span class="pre">wait()</span></code></a></li>
|
||
</ul>
|
||
</li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.DeadThread"><code class="docutils literal notranslate"><span class="pre">DeadThread</span></code></a><ul>
|
||
<li><a class="reference internal" href="#windows.winobject.process.DeadThread.exit_code"><code class="docutils literal notranslate"><span class="pre">exit_code</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.DeadThread.handle"><code class="docutils literal notranslate"><span class="pre">handle</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.DeadThread.is_exit"><code class="docutils literal notranslate"><span class="pre">is_exit</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.DeadThread.wait"><code class="docutils literal notranslate"><span class="pre">wait()</span></code></a></li>
|
||
</ul>
|
||
</li>
|
||
</ul>
|
||
</li>
|
||
</ul>
|
||
</li>
|
||
<li><a class="reference internal" href="#peb-exploration">2.2. PEB Exploration</a><ul>
|
||
<li><a class="reference internal" href="#peb">2.2.1. PEB</a><ul>
|
||
<li><a class="reference internal" href="#windows.winobject.process.PEB"><code class="docutils literal notranslate"><span class="pre">PEB</span></code></a><ul>
|
||
<li><a class="reference internal" href="#windows.winobject.process.PEB.apisetmap"><code class="docutils literal notranslate"><span class="pre">apisetmap</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.PEB.commandline"><code class="docutils literal notranslate"><span class="pre">commandline</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.PEB.exe"><code class="docutils literal notranslate"><span class="pre">exe</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.PEB.imagepath"><code class="docutils literal notranslate"><span class="pre">imagepath</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.PEB.modules"><code class="docutils literal notranslate"><span class="pre">modules</span></code></a></li>
|
||
</ul>
|
||
</li>
|
||
</ul>
|
||
</li>
|
||
<li><a class="reference internal" href="#loadedmodule">2.2.2. LoadedModule</a><ul>
|
||
<li><a class="reference internal" href="#windows.winobject.process.LoadedModule"><code class="docutils literal notranslate"><span class="pre">LoadedModule</span></code></a><ul>
|
||
<li><a class="reference internal" href="#windows.winobject.process.LoadedModule.baseaddr"><code class="docutils literal notranslate"><span class="pre">baseaddr</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.LoadedModule.fullname"><code class="docutils literal notranslate"><span class="pre">fullname</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.LoadedModule.name"><code class="docutils literal notranslate"><span class="pre">name</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.process.LoadedModule.pe"><code class="docutils literal notranslate"><span class="pre">pe</span></code></a></li>
|
||
</ul>
|
||
</li>
|
||
</ul>
|
||
</li>
|
||
<li><a class="reference internal" href="#apisetmap">2.2.3. ApiSetMap</a><ul>
|
||
<li><a class="reference internal" href="#windows.winobject.apisetmap.ApiSetMap"><code class="docutils literal notranslate"><span class="pre">ApiSetMap</span></code></a><ul>
|
||
<li><a class="reference internal" href="#windows.winobject.apisetmap.ApiSetMap.apisetmap_dict"><code class="docutils literal notranslate"><span class="pre">apisetmap_dict</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.apisetmap.ApiSetMap.resolution_dict"><code class="docutils literal notranslate"><span class="pre">resolution_dict</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.apisetmap.ApiSetMap.resolve"><code class="docutils literal notranslate"><span class="pre">resolve()</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.winobject.apisetmap.ApiSetMap.version"><code class="docutils literal notranslate"><span class="pre">version</span></code></a></li>
|
||
</ul>
|
||
</li>
|
||
<li><a class="reference internal" href="#windows.winobject.apisetmap.ApiSetMapVersion2"><code class="docutils literal notranslate"><span class="pre">ApiSetMapVersion2</span></code></a><ul>
|
||
<li><a class="reference internal" href="#windows.winobject.apisetmap.ApiSetMapVersion2.version"><code class="docutils literal notranslate"><span class="pre">version</span></code></a></li>
|
||
</ul>
|
||
</li>
|
||
<li><a class="reference internal" href="#windows.winobject.apisetmap.ApiSetMapVersion4"><code class="docutils literal notranslate"><span class="pre">ApiSetMapVersion4</span></code></a><ul>
|
||
<li><a class="reference internal" href="#windows.winobject.apisetmap.ApiSetMapVersion4.version"><code class="docutils literal notranslate"><span class="pre">version</span></code></a></li>
|
||
</ul>
|
||
</li>
|
||
<li><a class="reference internal" href="#windows.winobject.apisetmap.ApiSetMapVersion6"><code class="docutils literal notranslate"><span class="pre">ApiSetMapVersion6</span></code></a><ul>
|
||
<li><a class="reference internal" href="#windows.winobject.apisetmap.ApiSetMapVersion6.version"><code class="docutils literal notranslate"><span class="pre">version</span></code></a></li>
|
||
</ul>
|
||
</li>
|
||
</ul>
|
||
</li>
|
||
</ul>
|
||
</li>
|
||
<li><a class="reference internal" href="#pefile-parsing-loaded-pe">2.3. PEFile - Parsing loaded PE</a><ul>
|
||
<li><a class="reference internal" href="#module-windows.pe_parse">2.3.1. <code class="xref py py-mod docutils literal notranslate"><span class="pre">windows.pe_parse</span></code></a><ul>
|
||
<li><a class="reference internal" href="#windows.pe_parse.GetPEFile"><code class="docutils literal notranslate"><span class="pre">GetPEFile()</span></code></a></li>
|
||
<li><a class="reference internal" href="#pefile">2.3.1.1. PEFile</a><ul>
|
||
<li><a class="reference internal" href="#windows.pe_parse.PEFile"><code class="docutils literal notranslate"><span class="pre">PEFile</span></code></a><ul>
|
||
<li><a class="reference internal" href="#windows.pe_parse.PEFile.export_name"><code class="docutils literal notranslate"><span class="pre">export_name</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.pe_parse.PEFile.exports"><code class="docutils literal notranslate"><span class="pre">exports</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.pe_parse.PEFile.imports"><code class="docutils literal notranslate"><span class="pre">imports</span></code></a></li>
|
||
</ul>
|
||
</li>
|
||
</ul>
|
||
</li>
|
||
<li><a class="reference internal" href="#iatentry">2.3.1.2. IATEntry</a><ul>
|
||
<li><a class="reference internal" href="#windows.pe_parse.IATEntry"><code class="docutils literal notranslate"><span class="pre">IATEntry</span></code></a><ul>
|
||
<li><a class="reference internal" href="#windows.pe_parse.IATEntry.addr"><code class="docutils literal notranslate"><span class="pre">addr</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.pe_parse.IATEntry.ord"><code class="docutils literal notranslate"><span class="pre">ord</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.pe_parse.IATEntry.name"><code class="docutils literal notranslate"><span class="pre">name</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.pe_parse.IATEntry.value"><code class="docutils literal notranslate"><span class="pre">value</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.pe_parse.IATEntry.remove_hook"><code class="docutils literal notranslate"><span class="pre">remove_hook()</span></code></a></li>
|
||
<li><a class="reference internal" href="#windows.pe_parse.IATEntry.set_hook"><code class="docutils literal notranslate"><span class="pre">set_hook()</span></code></a></li>
|
||
</ul>
|
||
</li>
|
||
</ul>
|
||
</li>
|
||
</ul>
|
||
</li>
|
||
</ul>
|
||
</li>
|
||
</ul>
|
||
|
||
</div>
|
||
<div>
|
||
<h4>Previous topic</h4>
|
||
<p class="topless"><a href="winobject.html"
|
||
title="previous chapter"><span class="section-number">2. </span>The <code class="xref py py-mod docutils literal notranslate"><span class="pre">windows</span></code> objects</a></p>
|
||
</div>
|
||
<div>
|
||
<h4>Next topic</h4>
|
||
<p class="topless"><a href="token.html"
|
||
title="next chapter"><span class="section-number">2.4. </span>Token</a></p>
|
||
</div>
|
||
<div role="note" aria-label="source link">
|
||
<h3>This Page</h3>
|
||
<ul class="this-page-menu">
|
||
<li><a href="_sources/process.rst.txt"
|
||
rel="nofollow">Show Source</a></li>
|
||
</ul>
|
||
</div>
|
||
<search id="searchbox" style="display: none" role="search">
|
||
<h3 id="searchlabel">Quick search</h3>
|
||
<div class="searchformwrapper">
|
||
<form class="search" action="search.html" method="get">
|
||
<input type="text" name="q" aria-labelledby="searchlabel" autocomplete="off" autocorrect="off" autocapitalize="off" spellcheck="false"/>
|
||
<input type="submit" value="Go" />
|
||
</form>
|
||
</div>
|
||
</search>
|
||
<script>document.getElementById('searchbox').style.display = "block"</script>
|
||
</div>
|
||
</div>
|
||
<div class="clearer"></div>
|
||
</div>
|
||
<div class="related" role="navigation" aria-label="related navigation">
|
||
<h3>Navigation</h3>
|
||
<ul>
|
||
<li class="right" style="margin-right: 10px">
|
||
<a href="genindex.html" title="General Index"
|
||
>index</a></li>
|
||
<li class="right" >
|
||
<a href="py-modindex.html" title="Python Module Index"
|
||
>modules</a> |</li>
|
||
<li class="right" >
|
||
<a href="token.html" title="2.4. Token"
|
||
>next</a> |</li>
|
||
<li class="right" >
|
||
<a href="winobject.html" title="2. The windows objects"
|
||
>previous</a> |</li>
|
||
<li class="nav-item nav-item-0"><a href="index.html">PythonForWindows 1.0.3 documentation</a> »</li>
|
||
<li class="nav-item nav-item-1"><a href="winobject.html" ><span class="section-number">2. </span>The <code class="xref py py-mod docutils literal notranslate"><span class="pre">windows</span></code> objects</a> »</li>
|
||
<li class="nav-item nav-item-this"><a href=""><span class="section-number">2.1. </span>Processes and Threads</a></li>
|
||
</ul>
|
||
</div>
|
||
<div class="footer" role="contentinfo">
|
||
© Copyright 2015-2020, Clement Rouault.
|
||
Created using <a href="https://www.sphinx-doc.org/">Sphinx</a> 7.3.7.
|
||
</div>
|
||
</body>
|
||
</html> |