admin/hakril-PythonForWindows
1
0
Fork 0
mirror of https://github.com/hakril/PythonForWindows synced 2026-06-08 14:31:45 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
0cd51a088ef1075c5ad896eb46c4b65e730332bb
hakril-PythonForWindows/docs/build/html/process.html
T

1849 lines
167 KiB
HTML
Raw Blame History

This file contains ambiguous Unicode characters
This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
<!DOCTYPE html>
<html lang="en" data-content_root="./">
<head>
<meta charset="utf-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" /><meta name="viewport" content="width=device-width, initial-scale=1" />
<title>2.1. Processes and Threads &#8212; PythonForWindows 1.0.0 documentation</title>
<link rel="stylesheet" type="text/css" href="_static/pygments.css?v=fa44fd50" />
<link rel="stylesheet" type="text/css" href="_static/classic.css?v=def86cc0" />
<link rel="stylesheet" type="text/css" href="_static/css/mbasic.css?v=957880af" />
<script src="_static/documentation_options.js?v=8d563738"></script>
<script src="_static/doctools.js?v=9a2dae69"></script>
<script src="_static/sphinx_highlight.js?v=dc90522c"></script>
<link rel="index" title="Index" href="genindex.html" />
<link rel="search" title="Search" href="search.html" />
<link rel="next" title="2.4. Token" href="token.html" />
<link rel="prev" title="2. The windows objects" href="winobject.html" />
</head><body>
<div class="related" role="navigation" aria-label="related navigation">
<h3>Navigation</h3>
<ul>
<li class="right" style="margin-right: 10px">
<a href="genindex.html" title="General Index"
accesskey="I">index</a></li>
<li class="right" >
<a href="py-modindex.html" title="Python Module Index"
>modules</a> |</li>
<li class="right" >
<a href="token.html" title="2.4. Token"
accesskey="N">next</a> |</li>
<li class="right" >
<a href="winobject.html" title="2. The windows objects"
accesskey="P">previous</a> |</li>
<li class="nav-item nav-item-0"><a href="index.html">PythonForWindows 1.0.0 documentation</a> &#187;</li>
<li class="nav-item nav-item-1"><a href="winobject.html" accesskey="U"><span class="section-number">2. </span>The <code class="xref py py-mod docutils literal notranslate"><span class="pre">windows</span></code> objects</a> &#187;</li>
<li class="nav-item nav-item-this"><a href=""><span class="section-number">2.1. </span>Processes and Threads</a></li>
</ul>
</div>
<div class="document">
<div class="documentwrapper">
<div class="bodywrapper">
<div class="body" role="main">
<section id="module-windows.winobject.process">
<span id="processes-and-threads"></span><h1><span class="section-number">2.1. </span>Processes and Threads<a class="headerlink" href="#module-windows.winobject.process" title="Link to this heading"></a></h1>
<section id="currentprocess">
<h2><span class="section-number">2.1.1. </span>CurrentProcess<a class="headerlink" href="#currentprocess" title="Link to this heading"></a></h2>
<div class="admonition note">
<p class="admonition-title">Note</p>
<p>See sample <a class="reference internal" href="sample.html#sample-current-process"><span class="std std-ref">windows.current_process</span></a></p>
</div>
<dl class="py class">
<dt class="sig sig-object py" id="windows.winobject.process.CurrentProcess">
<em class="property"><span class="pre">class</span><span class="w"> </span></em><span class="sig-prename descclassname"><span class="pre">windows.winobject.process.</span></span><span class="sig-name descname"><span class="pre">CurrentProcess</span></span><a class="reference internal" href="_modules/windows/winobject/process.html#CurrentProcess"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.winobject.process.CurrentProcess" title="Link to this definition"></a></dt>
<dd><p>Bases: <code class="xref py py-class docutils literal notranslate"><span class="pre">Process</span></code></p>
<p>The current process</p>
<dl class="py method">
<dt class="sig sig-object py" id="windows.winobject.process.CurrentProcess.allocated_memory">
<span class="sig-name descname"><span class="pre">allocated_memory</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">size</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">prot</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">PAGE_EXECUTE_READWRITE(0x40)</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.CurrentProcess.allocated_memory" title="Link to this definition"></a></dt>
<dd><p>ContextManager to allocate memory and free it</p>
<dl class="field-list simple">
<dt class="field-odd">Type<span class="colon">:</span></dt>
<dd class="field-odd"><p><code class="xref py py-class docutils literal notranslate"><span class="pre">int</span></code> – the address of the allocated memory</p>
</dd>
</dl>
</dd></dl>
<dl class="py property">
<dt class="sig sig-object py" id="windows.winobject.process.CurrentProcess.bitness">
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">bitness</span></span><a class="headerlink" href="#windows.winobject.process.CurrentProcess.bitness" title="Link to this definition"></a></dt>
<dd><p>The bitness of the process</p>
<dl class="field-list simple">
<dt class="field-odd">Type<span class="colon">:</span></dt>
<dd class="field-odd"><p><code class="xref py py-class docutils literal notranslate"><span class="pre">int</span></code> – 32 or 64</p>
</dd>
</dl>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.winobject.process.CurrentProcess.create_thread">
<span class="sig-name descname"><span class="pre">create_thread</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">lpStartAddress</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">lpParameter</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">dwCreationFlags</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">0</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/process.html#CurrentProcess.create_thread"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.winobject.process.CurrentProcess.create_thread" title="Link to this definition"></a></dt>
<dd><p>Create a new thread</p>
<dl class="field-list simple">
<dt class="field-odd">Return type<span class="colon">:</span></dt>
<dd class="field-odd"><p><a class="reference internal" href="#windows.winobject.process.WinThread" title="windows.winobject.process.WinThread"><code class="xref py py-class docutils literal notranslate"><span class="pre">WinThread</span></code></a> or <a class="reference internal" href="#windows.winobject.process.DeadThread" title="windows.winobject.process.DeadThread"><code class="xref py py-class docutils literal notranslate"><span class="pre">DeadThread</span></code></a></p>
</dd>
</dl>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.winobject.process.CurrentProcess.execute">
<span class="sig-name descname"><span class="pre">execute</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">code</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">parameter</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">0</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/process.html#CurrentProcess.execute"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.winobject.process.CurrentProcess.execute" title="Link to this definition"></a></dt>
<dd><p>Execute native code <code class="docutils literal notranslate"><span class="pre">code</span></code> in the current thread.</p>
<dl class="field-list simple">
<dt class="field-odd">Return type<span class="colon">:</span></dt>
<dd class="field-odd"><p><code class="xref py py-class docutils literal notranslate"><span class="pre">int</span></code> the return value of the native code</p>
</dd>
</dl>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.winobject.process.CurrentProcess.exit">
<span class="sig-name descname"><span class="pre">exit</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">code</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">0</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/process.html#CurrentProcess.exit"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.winobject.process.CurrentProcess.exit" title="Link to this definition"></a></dt>
<dd><p>Exit the process</p>
</dd></dl>
<dl class="py property">
<dt class="sig sig-object py" id="windows.winobject.process.CurrentProcess.exit_code">
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">exit_code</span></span><a class="headerlink" href="#windows.winobject.process.CurrentProcess.exit_code" title="Link to this definition"></a></dt>
<dd><p>The exit code of the process : <code class="docutils literal notranslate"><span class="pre">STILL_ACTIVE</span></code> means the process is not dead</p>
<dl class="field-list simple">
<dt class="field-odd">Type<span class="colon">:</span></dt>
<dd class="field-odd"><p><code class="xref py py-class docutils literal notranslate"><span class="pre">int</span></code></p>
</dd>
</dl>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.winobject.process.CurrentProcess.get_mapped_filename">
<span class="sig-name descname"><span class="pre">get_mapped_filename</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">addr</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.CurrentProcess.get_mapped_filename" title="Link to this definition"></a></dt>
<dd><p>The filename mapped at address <code class="docutils literal notranslate"><span class="pre">addr</span></code> or <code class="docutils literal notranslate"><span class="pre">None</span></code></p>
<dl class="field-list simple">
<dt class="field-odd">Return type<span class="colon">:</span></dt>
<dd class="field-odd"><p><code class="xref py py-class docutils literal notranslate"><span class="pre">unicode</span></code> or <code class="docutils literal notranslate"><span class="pre">None</span></code></p>
</dd>
</dl>
</dd></dl>
<dl class="py property">
<dt class="sig sig-object py" id="windows.winobject.process.CurrentProcess.handle">
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">handle</span></span><a class="headerlink" href="#windows.winobject.process.CurrentProcess.handle" title="Link to this definition"></a></dt>
<dd><p>An handle on the object</p>
<dl class="field-list">
<dt class="field-odd">Type<span class="colon">:</span></dt>
<dd class="field-odd"><p>HANDLE</p>
<div class="admonition note">
<p class="admonition-title">Note</p>
<p>The handle is automaticaly closed when the object is destroyed</p>
</div>
</dd>
</dl>
</dd></dl>
<dl class="py property">
<dt class="sig sig-object py" id="windows.winobject.process.CurrentProcess.is_exit">
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">is_exit</span></span><a class="headerlink" href="#windows.winobject.process.CurrentProcess.is_exit" title="Link to this definition"></a></dt>
<dd><p><code class="docutils literal notranslate"><span class="pre">True</span></code> if the process is terminated</p>
<dl class="field-list simple">
<dt class="field-odd">Type<span class="colon">:</span></dt>
<dd class="field-odd"><p><code class="xref py py-class docutils literal notranslate"><span class="pre">bool</span></code></p>
</dd>
</dl>
</dd></dl>
<dl class="py property">
<dt class="sig sig-object py" id="windows.winobject.process.CurrentProcess.is_wow_64">
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">is_wow_64</span></span><a class="headerlink" href="#windows.winobject.process.CurrentProcess.is_wow_64" title="Link to this definition"></a></dt>
<dd><p><code class="docutils literal notranslate"><span class="pre">True</span></code> if the process is a SysWow64 process (32bit process on 64bits system).</p>
<dl class="field-list simple">
<dt class="field-odd">Type<span class="colon">:</span></dt>
<dd class="field-odd"><p><code class="xref py py-class docutils literal notranslate"><span class="pre">bool</span></code></p>
</dd>
</dl>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.winobject.process.CurrentProcess.load_library">
<span class="sig-name descname"><span class="pre">load_library</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">dll_path</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/process.html#CurrentProcess.load_library"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.winobject.process.CurrentProcess.load_library" title="Link to this definition"></a></dt>
<dd><p>Load the library in current process</p>
<dl class="field-list simple">
<dt class="field-odd">Return type<span class="colon">:</span></dt>
<dd class="field-odd"><p><a class="reference internal" href="#windows.winobject.process.LoadedModule" title="windows.winobject.process.LoadedModule"><code class="xref py py-class docutils literal notranslate"><span class="pre">LoadedModule</span></code></a></p>
</dd>
</dl>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.winobject.process.CurrentProcess.memory_state">
<span class="sig-name descname"><span class="pre">memory_state</span></span><span class="sig-paren">(</span><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.CurrentProcess.memory_state" title="Link to this definition"></a></dt>
<dd><p>Yield the memory information for the whole address space of the process</p>
<dl class="field-list simple">
<dt class="field-odd">Yield<span class="colon">:</span></dt>
<dd class="field-odd"><p><a class="reference internal" href="winstructs_generated.html#windows.generated_def.winstructs.MEMORY_BASIC_INFORMATION" title="windows.generated_def.winstructs.MEMORY_BASIC_INFORMATION"><code class="xref py py-class docutils literal notranslate"><span class="pre">MEMORY_BASIC_INFORMATION</span></code></a></p>
</dd>
</dl>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.winobject.process.CurrentProcess.open_token">
<span class="sig-name descname"><span class="pre">open_token</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">flags</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">MAXIMUM_ALLOWED(0x2000000)</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.CurrentProcess.open_token" title="Link to this definition"></a></dt>
<dd><p>Open the process Token</p>
<dl class="field-list simple">
<dt class="field-odd">Returns<span class="colon">:</span></dt>
<dd class="field-odd"><p><a class="reference internal" href="token.html#windows.winobject.token.Token" title="windows.winobject.token.Token"><code class="xref py py-class docutils literal notranslate"><span class="pre">Token</span></code></a></p>
</dd>
</dl>
</dd></dl>
<dl class="py property">
<dt class="sig sig-object py" id="windows.winobject.process.CurrentProcess.peb">
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">peb</span></span><a class="headerlink" href="#windows.winobject.process.CurrentProcess.peb" title="Link to this definition"></a></dt>
<dd><p>The Process Environment Block of the current process</p>
<dl class="field-list simple">
<dt class="field-odd">Type<span class="colon">:</span></dt>
<dd class="field-odd"><p><a class="reference internal" href="#windows.winobject.process.PEB" title="windows.winobject.process.PEB"><code class="xref py py-class docutils literal notranslate"><span class="pre">PEB</span></code></a></p>
</dd>
</dl>
</dd></dl>
<dl class="py property">
<dt class="sig sig-object py" id="windows.winobject.process.CurrentProcess.peb_syswow">
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">peb_syswow</span></span><a class="headerlink" href="#windows.winobject.process.CurrentProcess.peb_syswow" title="Link to this definition"></a></dt>
<dd><p>The 64bits PEB of a SysWow64 process</p>
<dl class="field-list simple">
<dt class="field-odd">Type<span class="colon">:</span></dt>
<dd class="field-odd"><p><a class="reference internal" href="#windows.winobject.process.PEB" title="windows.winobject.process.PEB"><code class="xref py py-class docutils literal notranslate"><span class="pre">PEB</span></code></a></p>
</dd>
</dl>
</dd></dl>
<dl class="py property">
<dt class="sig sig-object py" id="windows.winobject.process.CurrentProcess.pid">
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">pid</span></span><a class="headerlink" href="#windows.winobject.process.CurrentProcess.pid" title="Link to this definition"></a></dt>
<dd><p>Process ID</p>
<dl class="field-list simple">
<dt class="field-odd">Type<span class="colon">:</span></dt>
<dd class="field-odd"><p><code class="xref py py-class docutils literal notranslate"><span class="pre">int</span></code></p>
</dd>
</dl>
</dd></dl>
<dl class="py property">
<dt class="sig sig-object py" id="windows.winobject.process.CurrentProcess.ppid">
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">ppid</span></span><a class="headerlink" href="#windows.winobject.process.CurrentProcess.ppid" title="Link to this definition"></a></dt>
<dd><p>Parent Process ID</p>
<dl class="field-list simple">
<dt class="field-odd">Type<span class="colon">:</span></dt>
<dd class="field-odd"><p><code class="xref py py-class docutils literal notranslate"><span class="pre">int</span></code></p>
</dd>
</dl>
</dd></dl>
<dl class="py property">
<dt class="sig sig-object py" id="windows.winobject.process.CurrentProcess.priority">
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">priority</span></span><a class="headerlink" href="#windows.winobject.process.CurrentProcess.priority" title="Link to this definition"></a></dt>
<dd></dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.winobject.process.CurrentProcess.query_memory">
<span class="sig-name descname"><span class="pre">query_memory</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">addr</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.CurrentProcess.query_memory" title="Link to this definition"></a></dt>
<dd><p>Query the memory informations about page at <code class="docutils literal notranslate"><span class="pre">addr</span></code></p>
<dl class="field-list simple">
<dt class="field-odd">Return type<span class="colon">:</span></dt>
<dd class="field-odd"><p><a class="reference internal" href="winstructs_generated.html#windows.generated_def.winstructs.MEMORY_BASIC_INFORMATION" title="windows.generated_def.winstructs.MEMORY_BASIC_INFORMATION"><code class="xref py py-class docutils literal notranslate"><span class="pre">MEMORY_BASIC_INFORMATION</span></code></a></p>
</dd>
</dl>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.winobject.process.CurrentProcess.read_byte">
<span class="sig-name descname"><span class="pre">read_byte</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">addr</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.CurrentProcess.read_byte" title="Link to this definition"></a></dt>
<dd><p>Read a <code class="docutils literal notranslate"><span class="pre">CHAR</span></code> at <code class="docutils literal notranslate"><span class="pre">addr</span></code></p>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.winobject.process.CurrentProcess.read_dword">
<span class="sig-name descname"><span class="pre">read_dword</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">addr</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.CurrentProcess.read_dword" title="Link to this definition"></a></dt>
<dd><p>Read a <code class="docutils literal notranslate"><span class="pre">DWORD</span></code> at <code class="docutils literal notranslate"><span class="pre">addr</span></code></p>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.winobject.process.CurrentProcess.read_memory">
<span class="sig-name descname"><span class="pre">read_memory</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">addr</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">size</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/process.html#CurrentProcess.read_memory"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.winobject.process.CurrentProcess.read_memory" title="Link to this definition"></a></dt>
<dd><p>Read <code class="docutils literal notranslate"><span class="pre">size</span></code> from <code class="docutils literal notranslate"><span class="pre">addr</span></code></p>
<dl class="field-list simple">
<dt class="field-odd">Returns<span class="colon">:</span></dt>
<dd class="field-odd"><p>The data read</p>
</dd>
<dt class="field-even">Return type<span class="colon">:</span></dt>
<dd class="field-even"><p><code class="xref py py-class docutils literal notranslate"><span class="pre">str</span></code></p>
</dd>
</dl>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.winobject.process.CurrentProcess.read_ptr">
<span class="sig-name descname"><span class="pre">read_ptr</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">addr</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.CurrentProcess.read_ptr" title="Link to this definition"></a></dt>
<dd><p>Read a <code class="docutils literal notranslate"><span class="pre">PTR</span></code> at <code class="docutils literal notranslate"><span class="pre">addr</span></code></p>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.winobject.process.CurrentProcess.read_qword">
<span class="sig-name descname"><span class="pre">read_qword</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">addr</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.CurrentProcess.read_qword" title="Link to this definition"></a></dt>
<dd><p>Read a <code class="docutils literal notranslate"><span class="pre">ULONG64</span></code> at <code class="docutils literal notranslate"><span class="pre">addr</span></code></p>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.winobject.process.CurrentProcess.read_short">
<span class="sig-name descname"><span class="pre">read_short</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">addr</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.CurrentProcess.read_short" title="Link to this definition"></a></dt>
<dd><p>Read a <code class="docutils literal notranslate"><span class="pre">SHORT</span></code> at <code class="docutils literal notranslate"><span class="pre">addr</span></code></p>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.winobject.process.CurrentProcess.read_string">
<span class="sig-name descname"><span class="pre">read_string</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">addr</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/process.html#CurrentProcess.read_string"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.winobject.process.CurrentProcess.read_string" title="Link to this definition"></a></dt>
<dd><p>Read an ascii string at <code class="docutils literal notranslate"><span class="pre">addr</span></code></p>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.winobject.process.CurrentProcess.read_wstring">
<span class="sig-name descname"><span class="pre">read_wstring</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">addr</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/process.html#CurrentProcess.read_wstring"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.winobject.process.CurrentProcess.read_wstring" title="Link to this definition"></a></dt>
<dd><p>Read a windows UTF16 string at <code class="docutils literal notranslate"><span class="pre">addr</span></code></p>
</dd></dl>
<dl class="py property">
<dt class="sig sig-object py" id="windows.winobject.process.CurrentProcess.threads">
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">threads</span></span><a class="headerlink" href="#windows.winobject.process.CurrentProcess.threads" title="Link to this definition"></a></dt>
<dd><p>The threads of the process</p>
<dl class="field-list simple">
<dt class="field-odd">Type<span class="colon">:</span></dt>
<dd class="field-odd"><p>[<a class="reference internal" href="#windows.winobject.process.WinThread" title="windows.winobject.process.WinThread"><code class="xref py py-class docutils literal notranslate"><span class="pre">WinThread</span></code></a>] – A list of Thread</p>
</dd>
</dl>
</dd></dl>
<dl class="py property">
<dt class="sig sig-object py" id="windows.winobject.process.CurrentProcess.time_info">
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">time_info</span></span><a class="headerlink" href="#windows.winobject.process.CurrentProcess.time_info" title="Link to this definition"></a></dt>
<dd><p>The time information of the process (creation, kernel/user time, exit time)</p>
<dl class="field-list simple">
<dt class="field-odd">Type<span class="colon">:</span></dt>
<dd class="field-odd"><p><code class="xref py py-class docutils literal notranslate"><span class="pre">TimeInfo</span></code></p>
</dd>
</dl>
</dd></dl>
<dl class="py property">
<dt class="sig sig-object py" id="windows.winobject.process.CurrentProcess.token">
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">token</span></span><a class="headerlink" href="#windows.winobject.process.CurrentProcess.token" title="Link to this definition"></a></dt>
<dd><p>The process <a class="reference internal" href="token.html#windows.winobject.token.Token" title="windows.winobject.token.Token"><code class="xref py py-class docutils literal notranslate"><span class="pre">Token</span></code></a></p>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.winobject.process.CurrentProcess.virtual_alloc">
<span class="sig-name descname"><span class="pre">virtual_alloc</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">size</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">prot</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">PAGE_EXECUTE_READWRITE(0x40)</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/process.html#CurrentProcess.virtual_alloc"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.winobject.process.CurrentProcess.virtual_alloc" title="Link to this definition"></a></dt>
<dd><p>Allocate memory in the process</p>
<dl class="field-list simple">
<dt class="field-odd">Returns<span class="colon">:</span></dt>
<dd class="field-odd"><p>The address of the allocated memory</p>
</dd>
<dt class="field-even">Return type<span class="colon">:</span></dt>
<dd class="field-even"><p><code class="xref py py-class docutils literal notranslate"><span class="pre">int</span></code></p>
</dd>
</dl>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.winobject.process.CurrentProcess.virtual_free">
<span class="sig-name descname"><span class="pre">virtual_free</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">addr</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/process.html#CurrentProcess.virtual_free"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.winobject.process.CurrentProcess.virtual_free" title="Link to this definition"></a></dt>
<dd><p>Free memory in the process by virtual_alloc</p>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.winobject.process.CurrentProcess.virtual_protect">
<span class="sig-name descname"><span class="pre">virtual_protect</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">addr</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">size</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">protect</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">old_protect</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">None</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.CurrentProcess.virtual_protect" title="Link to this definition"></a></dt>
<dd><p>Change the access right of one or more page of the process</p>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.winobject.process.CurrentProcess.virtual_protected">
<span class="sig-name descname"><span class="pre">virtual_protected</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">addr</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">size</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">protect</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.CurrentProcess.virtual_protected" title="Link to this definition"></a></dt>
<dd><p>A context manager for local virtual_protect (old Protection are restored at exit)</p>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.winobject.process.CurrentProcess.wait">
<span class="sig-name descname"><span class="pre">wait</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">timeout</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">INFINITE(0xffffffff)</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/process.html#CurrentProcess.wait"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.winobject.process.CurrentProcess.wait" title="Link to this definition"></a></dt>
<dd><p>Raise <code class="xref py py-class docutils literal notranslate"><span class="pre">ValueError</span></code> to prevent deadlock :D</p>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.winobject.process.CurrentProcess.write_byte">
<span class="sig-name descname"><span class="pre">write_byte</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">addr</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">byte</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.CurrentProcess.write_byte" title="Link to this definition"></a></dt>
<dd><p>write a byte at <code class="docutils literal notranslate"><span class="pre">addr</span></code></p>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.winobject.process.CurrentProcess.write_dword">
<span class="sig-name descname"><span class="pre">write_dword</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">addr</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">dword</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.CurrentProcess.write_dword" title="Link to this definition"></a></dt>
<dd><p>write a dword at <code class="docutils literal notranslate"><span class="pre">addr</span></code></p>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.winobject.process.CurrentProcess.write_memory">
<span class="sig-name descname"><span class="pre">write_memory</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">addr</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">data</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/process.html#CurrentProcess.write_memory"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.winobject.process.CurrentProcess.write_memory" title="Link to this definition"></a></dt>
<dd><p>Write data at addr</p>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.winobject.process.CurrentProcess.write_ptr">
<span class="sig-name descname"><span class="pre">write_ptr</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">addr</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">value</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.CurrentProcess.write_ptr" title="Link to this definition"></a></dt>
<dd><p>Write a <code class="docutils literal notranslate"><span class="pre">PTR</span></code> at <code class="docutils literal notranslate"><span class="pre">addr</span></code></p>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.winobject.process.CurrentProcess.write_qword">
<span class="sig-name descname"><span class="pre">write_qword</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">addr</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">qword</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.CurrentProcess.write_qword" title="Link to this definition"></a></dt>
<dd><p>write a qword at <code class="docutils literal notranslate"><span class="pre">addr</span></code></p>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.winobject.process.CurrentProcess.write_short">
<span class="sig-name descname"><span class="pre">write_short</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">addr</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">word</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.CurrentProcess.write_short" title="Link to this definition"></a></dt>
<dd><p>write a word at <code class="docutils literal notranslate"><span class="pre">addr</span></code></p>
</dd></dl>
</dd></dl>
</section>
<section id="currentthread">
<h2><span class="section-number">2.1.2. </span>CurrentThread<a class="headerlink" href="#currentthread" title="Link to this heading"></a></h2>
<dl class="py class">
<dt class="sig sig-object py" id="windows.winobject.process.CurrentThread">
<em class="property"><span class="pre">class</span><span class="w"> </span></em><span class="sig-prename descclassname"><span class="pre">windows.winobject.process.</span></span><span class="sig-name descname"><span class="pre">CurrentThread</span></span><a class="reference internal" href="_modules/windows/winobject/process.html#CurrentThread"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.winobject.process.CurrentThread" title="Link to this definition"></a></dt>
<dd><p>Bases: <code class="xref py py-class docutils literal notranslate"><span class="pre">Thread</span></code></p>
<p>The current thread</p>
<dl class="py method">
<dt class="sig sig-object py" id="windows.winobject.process.CurrentThread.exit">
<span class="sig-name descname"><span class="pre">exit</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">code</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">0</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/process.html#CurrentThread.exit"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.winobject.process.CurrentThread.exit" title="Link to this definition"></a></dt>
<dd><p>Exit the thread</p>
</dd></dl>
<dl class="py property">
<dt class="sig sig-object py" id="windows.winobject.process.CurrentThread.handle">
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">handle</span></span><a class="headerlink" href="#windows.winobject.process.CurrentThread.handle" title="Link to this definition"></a></dt>
<dd><p>An handle on the object</p>
<dl class="field-list">
<dt class="field-odd">Type<span class="colon">:</span></dt>
<dd class="field-odd"><p>HANDLE</p>
<div class="admonition note">
<p class="admonition-title">Note</p>
<p>The handle is automaticaly closed when the object is destroyed</p>
</div>
</dd>
</dl>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.winobject.process.CurrentThread.open_token">
<span class="sig-name descname"><span class="pre">open_token</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">flags</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">MAXIMUM_ALLOWED(0x2000000)</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">as_self</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">False</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.CurrentThread.open_token" title="Link to this definition"></a></dt>
<dd><p>Open the Thread token if any (Impersonation) else return None.
<code class="docutils literal notranslate"><span class="pre">as_self</span></code> tells which security context should be used</p>
<dl class="field-list simple">
<dt class="field-odd">Returns<span class="colon">:</span></dt>
<dd class="field-odd"><p><a class="reference internal" href="token.html#windows.winobject.token.Token" title="windows.winobject.token.Token"><code class="xref py py-class docutils literal notranslate"><span class="pre">Token</span></code></a></p>
</dd>
</dl>
<div class="admonition note">
<p class="admonition-title">Note</p>
<p>see <a class="reference external" href="https://docs.microsoft.com/en-us/windows/desktop/api/processthreadsapi/nf-processthreadsapi-openthreadtoken">https://docs.microsoft.com/en-us/windows/desktop/api/processthreadsapi/nf-processthreadsapi-openthreadtoken</a></p>
</div>
</dd></dl>
<dl class="py property">
<dt class="sig sig-object py" id="windows.winobject.process.CurrentThread.owner">
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">owner</span></span><a class="headerlink" href="#windows.winobject.process.CurrentThread.owner" title="Link to this definition"></a></dt>
<dd><p>The current process</p>
<dl class="field-list simple">
<dt class="field-odd">Type<span class="colon">:</span></dt>
<dd class="field-odd"><p><a class="reference internal" href="#windows.winobject.process.CurrentProcess" title="windows.winobject.process.CurrentProcess"><code class="xref py py-class docutils literal notranslate"><span class="pre">CurrentProcess</span></code></a></p>
</dd>
</dl>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.winobject.process.CurrentThread.set_token">
<span class="sig-name descname"><span class="pre">set_token</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">token</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.CurrentThread.set_token" title="Link to this definition"></a></dt>
<dd><p>Set the token for the thread (impersonation). Setting the token to None revert the impersonation</p>
</dd></dl>
<dl class="py property">
<dt class="sig sig-object py" id="windows.winobject.process.CurrentThread.tid">
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">tid</span></span><a class="headerlink" href="#windows.winobject.process.CurrentThread.tid" title="Link to this definition"></a></dt>
<dd><p>Thread ID</p>
<dl class="field-list simple">
<dt class="field-odd">Type<span class="colon">:</span></dt>
<dd class="field-odd"><p><code class="xref py py-class docutils literal notranslate"><span class="pre">int</span></code></p>
</dd>
</dl>
</dd></dl>
<dl class="py property">
<dt class="sig sig-object py" id="windows.winobject.process.CurrentThread.token">
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">token</span></span><a class="headerlink" href="#windows.winobject.process.CurrentThread.token" title="Link to this definition"></a></dt>
<dd><p>The thread <a class="reference internal" href="token.html#windows.winobject.token.Token" title="windows.winobject.token.Token"><code class="xref py py-class docutils literal notranslate"><span class="pre">Token</span></code></a></p>
<dl class="field-list simple">
<dt class="field-odd">Getter<span class="colon">:</span></dt>
<dd class="field-odd"><p><a class="reference internal" href="#windows.winobject.process.CurrentThread.open_token" title="windows.winobject.process.CurrentThread.open_token"><code class="xref py py-func docutils literal notranslate"><span class="pre">open_token()</span></code></a></p>
</dd>
<dt class="field-even">Setter<span class="colon">:</span></dt>
<dd class="field-even"><p><a class="reference internal" href="#windows.winobject.process.CurrentThread.set_token" title="windows.winobject.process.CurrentThread.set_token"><code class="xref py py-func docutils literal notranslate"><span class="pre">set_token()</span></code></a></p>
</dd>
</dl>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.winobject.process.CurrentThread.wait">
<span class="sig-name descname"><span class="pre">wait</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">timeout</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">INFINITE(0xffffffff)</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/process.html#CurrentThread.wait"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.winobject.process.CurrentThread.wait" title="Link to this definition"></a></dt>
<dd><p>Raise <code class="xref py py-class docutils literal notranslate"><span class="pre">ValueError</span></code> to prevent deadlock :D</p>
</dd></dl>
</dd></dl>
</section>
<section id="winprocess">
<h2><span class="section-number">2.1.3. </span>WinProcess<a class="headerlink" href="#winprocess" title="Link to this heading"></a></h2>
<div class="admonition note">
<p class="admonition-title">Note</p>
<p>See sample <a class="reference internal" href="sample.html#sample-remote-process"><span class="std std-ref">Remote process : WinProcess</span></a></p>
</div>
<dl class="py class">
<dt class="sig sig-object py" id="windows.winobject.process.WinProcess">
<em class="property"><span class="pre">class</span><span class="w"> </span></em><span class="sig-prename descclassname"><span class="pre">windows.winobject.process.</span></span><span class="sig-name descname"><span class="pre">WinProcess</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">pid</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">None</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">handle</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">None</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">name</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">None</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">ppid</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">None</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/process.html#WinProcess"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.winobject.process.WinProcess" title="Link to this definition"></a></dt>
<dd><p>Bases: <code class="xref py py-class docutils literal notranslate"><span class="pre">Process</span></code></p>
<p>A Process on the system</p>
<dl class="py method">
<dt class="sig sig-object py" id="windows.winobject.process.WinProcess.allocated_memory">
<span class="sig-name descname"><span class="pre">allocated_memory</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">size</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">prot</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">PAGE_EXECUTE_READWRITE(0x40)</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.WinProcess.allocated_memory" title="Link to this definition"></a></dt>
<dd><p>ContextManager to allocate memory and free it</p>
<dl class="field-list simple">
<dt class="field-odd">Type<span class="colon">:</span></dt>
<dd class="field-odd"><p><code class="xref py py-class docutils literal notranslate"><span class="pre">int</span></code> – the address of the allocated memory</p>
</dd>
</dl>
</dd></dl>
<dl class="py property">
<dt class="sig sig-object py" id="windows.winobject.process.WinProcess.bitness">
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">bitness</span></span><a class="headerlink" href="#windows.winobject.process.WinProcess.bitness" title="Link to this definition"></a></dt>
<dd><p>The bitness of the process</p>
<dl class="field-list simple">
<dt class="field-odd">Returns<span class="colon">:</span></dt>
<dd class="field-odd"><p><code class="xref py py-class docutils literal notranslate"><span class="pre">int</span></code> – 32 or 64</p>
</dd>
</dl>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.winobject.process.WinProcess.create_thread">
<span class="sig-name descname"><span class="pre">create_thread</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">addr</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">param</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/process.html#WinProcess.create_thread"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.winobject.process.WinProcess.create_thread" title="Link to this definition"></a></dt>
<dd><p>Create a remote thread</p>
<dl class="field-list simple">
<dt class="field-odd">Return type<span class="colon">:</span></dt>
<dd class="field-odd"><p><a class="reference internal" href="#windows.winobject.process.WinThread" title="windows.winobject.process.WinThread"><code class="xref py py-class docutils literal notranslate"><span class="pre">WinThread</span></code></a> or <a class="reference internal" href="#windows.winobject.process.DeadThread" title="windows.winobject.process.DeadThread"><code class="xref py py-class docutils literal notranslate"><span class="pre">DeadThread</span></code></a></p>
</dd>
</dl>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.winobject.process.WinProcess.execute">
<span class="sig-name descname"><span class="pre">execute</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">code</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">parameter</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">0</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.WinProcess.execute" title="Link to this definition"></a></dt>
<dd><p>Execute some native code in the context of the process</p>
<dl class="field-list simple">
<dt class="field-odd">Returns<span class="colon">:</span></dt>
<dd class="field-odd"><p>The thread executing the code</p>
</dd>
<dt class="field-even">Return type<span class="colon">:</span></dt>
<dd class="field-even"><p><a class="reference internal" href="#windows.winobject.process.WinThread" title="windows.winobject.process.WinThread"><code class="xref py py-class docutils literal notranslate"><span class="pre">WinThread</span></code></a> or <a class="reference internal" href="#windows.winobject.process.DeadThread" title="windows.winobject.process.DeadThread"><code class="xref py py-class docutils literal notranslate"><span class="pre">DeadThread</span></code></a></p>
</dd>
</dl>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.winobject.process.WinProcess.execute_python">
<span class="sig-name descname"><span class="pre">execute_python</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">pycode</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/process.html#WinProcess.execute_python"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.winobject.process.WinProcess.execute_python" title="Link to this definition"></a></dt>
<dd><p>Execute Python code into the remote process.</p>
<p>This function waits for the remote process to end and
raises an exception if the remote thread raised one</p>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.winobject.process.WinProcess.execute_python_unsafe">
<span class="sig-name descname"><span class="pre">execute_python_unsafe</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">pycode</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/process.html#WinProcess.execute_python_unsafe"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.winobject.process.WinProcess.execute_python_unsafe" title="Link to this definition"></a></dt>
<dd><p>Execute Python code into the remote process.</p>
<dl class="field-list simple">
<dt class="field-odd">Return type<span class="colon">:</span></dt>
<dd class="field-odd"><p><dl class="field-list simple">
<dt class="field-odd">rtype<span class="colon">:</span></dt>
<dd class="field-odd"><p><a class="reference internal" href="#windows.winobject.process.WinThread" title="windows.winobject.process.WinThread"><code class="xref py py-class docutils literal notranslate"><span class="pre">WinThread</span></code></a> or <a class="reference internal" href="#windows.winobject.process.DeadThread" title="windows.winobject.process.DeadThread"><code class="xref py py-class docutils literal notranslate"><span class="pre">DeadThread</span></code></a> : The thread executing the python code</p>
</dd>
</dl>
</p>
</dd>
</dl>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.winobject.process.WinProcess.exit">
<span class="sig-name descname"><span class="pre">exit</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">code</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">0</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/process.html#WinProcess.exit"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.winobject.process.WinProcess.exit" title="Link to this definition"></a></dt>
<dd><p>Exit the process</p>
</dd></dl>
<dl class="py property">
<dt class="sig sig-object py" id="windows.winobject.process.WinProcess.exit_code">
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">exit_code</span></span><a class="headerlink" href="#windows.winobject.process.WinProcess.exit_code" title="Link to this definition"></a></dt>
<dd><p>The exit code of the process : <code class="docutils literal notranslate"><span class="pre">STILL_ACTIVE</span></code> means the process is not dead</p>
<dl class="field-list simple">
<dt class="field-odd">Type<span class="colon">:</span></dt>
<dd class="field-odd"><p><code class="xref py py-class docutils literal notranslate"><span class="pre">int</span></code></p>
</dd>
</dl>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.winobject.process.WinProcess.get_mapped_filename">
<span class="sig-name descname"><span class="pre">get_mapped_filename</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">addr</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.WinProcess.get_mapped_filename" title="Link to this definition"></a></dt>
<dd><p>The filename mapped at address <code class="docutils literal notranslate"><span class="pre">addr</span></code> or <code class="docutils literal notranslate"><span class="pre">None</span></code></p>
<dl class="field-list simple">
<dt class="field-odd">Return type<span class="colon">:</span></dt>
<dd class="field-odd"><p><code class="xref py py-class docutils literal notranslate"><span class="pre">unicode</span></code> or <code class="docutils literal notranslate"><span class="pre">None</span></code></p>
</dd>
</dl>
</dd></dl>
<dl class="py property">
<dt class="sig sig-object py" id="windows.winobject.process.WinProcess.handle">
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">handle</span></span><a class="headerlink" href="#windows.winobject.process.WinProcess.handle" title="Link to this definition"></a></dt>
<dd><p>An handle on the object</p>
<dl class="field-list">
<dt class="field-odd">Type<span class="colon">:</span></dt>
<dd class="field-odd"><p>HANDLE</p>
<div class="admonition note">
<p class="admonition-title">Note</p>
<p>The handle is automaticaly closed when the object is destroyed</p>
</div>
</dd>
</dl>
</dd></dl>
<dl class="py property">
<dt class="sig sig-object py" id="windows.winobject.process.WinProcess.is_exit">
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">is_exit</span></span><a class="headerlink" href="#windows.winobject.process.WinProcess.is_exit" title="Link to this definition"></a></dt>
<dd><p><code class="docutils literal notranslate"><span class="pre">True</span></code> if the process is terminated</p>
<dl class="field-list simple">
<dt class="field-odd">Type<span class="colon">:</span></dt>
<dd class="field-odd"><p><code class="xref py py-class docutils literal notranslate"><span class="pre">bool</span></code></p>
</dd>
</dl>
</dd></dl>
<dl class="py property">
<dt class="sig sig-object py" id="windows.winobject.process.WinProcess.is_wow_64">
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">is_wow_64</span></span><a class="headerlink" href="#windows.winobject.process.WinProcess.is_wow_64" title="Link to this definition"></a></dt>
<dd><p><code class="docutils literal notranslate"><span class="pre">True</span></code> if the process is a SysWow64 process (32bit process on 64bits system).</p>
<dl class="field-list simple">
<dt class="field-odd">Type<span class="colon">:</span></dt>
<dd class="field-odd"><p><code class="xref py py-class docutils literal notranslate"><span class="pre">bool</span></code></p>
</dd>
</dl>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.winobject.process.WinProcess.load_library">
<span class="sig-name descname"><span class="pre">load_library</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">dll_path</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/process.html#WinProcess.load_library"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.winobject.process.WinProcess.load_library" title="Link to this definition"></a></dt>
<dd><p>Load the library in remote process</p>
<dl class="field-list simple">
<dt class="field-odd">Return type<span class="colon">:</span></dt>
<dd class="field-odd"><p><a class="reference internal" href="#windows.winobject.process.LoadedModule" title="windows.winobject.process.LoadedModule"><code class="xref py py-class docutils literal notranslate"><span class="pre">LoadedModule</span></code></a></p>
</dd>
</dl>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.winobject.process.WinProcess.memory_state">
<span class="sig-name descname"><span class="pre">memory_state</span></span><span class="sig-paren">(</span><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.WinProcess.memory_state" title="Link to this definition"></a></dt>
<dd><p>Yield the memory information for the whole address space of the process</p>
<dl class="field-list simple">
<dt class="field-odd">Yield<span class="colon">:</span></dt>
<dd class="field-odd"><p><a class="reference internal" href="winstructs_generated.html#windows.generated_def.winstructs.MEMORY_BASIC_INFORMATION" title="windows.generated_def.winstructs.MEMORY_BASIC_INFORMATION"><code class="xref py py-class docutils literal notranslate"><span class="pre">MEMORY_BASIC_INFORMATION</span></code></a></p>
</dd>
</dl>
</dd></dl>
<dl class="py property">
<dt class="sig sig-object py" id="windows.winobject.process.WinProcess.name">
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">name</span></span><a class="headerlink" href="#windows.winobject.process.WinProcess.name" title="Link to this definition"></a></dt>
<dd><p>Name of the process</p>
<dl class="field-list simple">
<dt class="field-odd">Type<span class="colon">:</span></dt>
<dd class="field-odd"><p><code class="xref py py-class docutils literal notranslate"><span class="pre">str</span></code></p>
</dd>
</dl>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.winobject.process.WinProcess.open_token">
<span class="sig-name descname"><span class="pre">open_token</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">flags</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">MAXIMUM_ALLOWED(0x2000000)</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.WinProcess.open_token" title="Link to this definition"></a></dt>
<dd><p>Open the process Token</p>
<dl class="field-list simple">
<dt class="field-odd">Returns<span class="colon">:</span></dt>
<dd class="field-odd"><p><a class="reference internal" href="token.html#windows.winobject.token.Token" title="windows.winobject.token.Token"><code class="xref py py-class docutils literal notranslate"><span class="pre">Token</span></code></a></p>
</dd>
</dl>
</dd></dl>
<dl class="py property">
<dt class="sig sig-object py" id="windows.winobject.process.WinProcess.peb">
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">peb</span></span><a class="headerlink" href="#windows.winobject.process.WinProcess.peb" title="Link to this definition"></a></dt>
<dd><p>The PEB of the process (see <code class="xref py py-mod docutils literal notranslate"><span class="pre">remotectypes</span></code>)</p>
<dl class="field-list simple">
<dt class="field-odd">Type<span class="colon">:</span></dt>
<dd class="field-odd"><p><a class="reference internal" href="#windows.winobject.process.PEB" title="windows.winobject.process.PEB"><code class="xref py py-class docutils literal notranslate"><span class="pre">PEB</span></code></a></p>
</dd>
</dl>
</dd></dl>
<dl class="py property">
<dt class="sig sig-object py" id="windows.winobject.process.WinProcess.peb_addr">
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">peb_addr</span></span><a class="headerlink" href="#windows.winobject.process.WinProcess.peb_addr" title="Link to this definition"></a></dt>
<dd><p>The address of the PEB</p>
<dl class="field-list simple">
<dt class="field-odd">Type<span class="colon">:</span></dt>
<dd class="field-odd"><p><code class="xref py py-class docutils literal notranslate"><span class="pre">int</span></code></p>
</dd>
</dl>
</dd></dl>
<dl class="py property">
<dt class="sig sig-object py" id="windows.winobject.process.WinProcess.peb_syswow">
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">peb_syswow</span></span><a class="headerlink" href="#windows.winobject.process.WinProcess.peb_syswow" title="Link to this definition"></a></dt>
<dd><p>The 64bits PEB of a SysWow64 process</p>
<dl class="field-list simple">
<dt class="field-odd">Type<span class="colon">:</span></dt>
<dd class="field-odd"><p><a class="reference internal" href="#windows.winobject.process.PEB" title="windows.winobject.process.PEB"><code class="xref py py-class docutils literal notranslate"><span class="pre">PEB</span></code></a></p>
</dd>
</dl>
</dd></dl>
<dl class="py property">
<dt class="sig sig-object py" id="windows.winobject.process.WinProcess.pid">
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">pid</span></span><a class="headerlink" href="#windows.winobject.process.WinProcess.pid" title="Link to this definition"></a></dt>
<dd><p>Process ID</p>
<dl class="field-list simple">
<dt class="field-odd">Type<span class="colon">:</span></dt>
<dd class="field-odd"><p><code class="xref py py-class docutils literal notranslate"><span class="pre">int</span></code></p>
</dd>
</dl>
</dd></dl>
<dl class="py property">
<dt class="sig sig-object py" id="windows.winobject.process.WinProcess.ppid">
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">ppid</span></span><a class="headerlink" href="#windows.winobject.process.WinProcess.ppid" title="Link to this definition"></a></dt>
<dd><p>Parent Process ID</p>
<dl class="field-list simple">
<dt class="field-odd">Type<span class="colon">:</span></dt>
<dd class="field-odd"><p><code class="xref py py-class docutils literal notranslate"><span class="pre">int</span></code></p>
</dd>
</dl>
</dd></dl>
<dl class="py property">
<dt class="sig sig-object py" id="windows.winobject.process.WinProcess.priority">
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">priority</span></span><a class="headerlink" href="#windows.winobject.process.WinProcess.priority" title="Link to this definition"></a></dt>
<dd></dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.winobject.process.WinProcess.query_memory">
<span class="sig-name descname"><span class="pre">query_memory</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">addr</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.WinProcess.query_memory" title="Link to this definition"></a></dt>
<dd><p>Query the memory informations about page at <code class="docutils literal notranslate"><span class="pre">addr</span></code></p>
<dl class="field-list simple">
<dt class="field-odd">Return type<span class="colon">:</span></dt>
<dd class="field-odd"><p><a class="reference internal" href="winstructs_generated.html#windows.generated_def.winstructs.MEMORY_BASIC_INFORMATION" title="windows.generated_def.winstructs.MEMORY_BASIC_INFORMATION"><code class="xref py py-class docutils literal notranslate"><span class="pre">MEMORY_BASIC_INFORMATION</span></code></a></p>
</dd>
</dl>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.winobject.process.WinProcess.read_byte">
<span class="sig-name descname"><span class="pre">read_byte</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">addr</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.WinProcess.read_byte" title="Link to this definition"></a></dt>
<dd><p>Read a <code class="docutils literal notranslate"><span class="pre">CHAR</span></code> at <code class="docutils literal notranslate"><span class="pre">addr</span></code></p>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.winobject.process.WinProcess.read_dword">
<span class="sig-name descname"><span class="pre">read_dword</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">addr</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.WinProcess.read_dword" title="Link to this definition"></a></dt>
<dd><p>Read a <code class="docutils literal notranslate"><span class="pre">DWORD</span></code> at <code class="docutils literal notranslate"><span class="pre">addr</span></code></p>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.winobject.process.WinProcess.read_memory">
<span class="sig-name descname"><span class="pre">read_memory</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">addr</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">size</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/process.html#WinProcess.read_memory"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.winobject.process.WinProcess.read_memory" title="Link to this definition"></a></dt>
<dd><p>Read <code class="docutils literal notranslate"><span class="pre">size</span></code> from <code class="docutils literal notranslate"><span class="pre">addr</span></code></p>
<dl class="field-list simple">
<dt class="field-odd">Returns<span class="colon">:</span></dt>
<dd class="field-odd"><p>The data read</p>
</dd>
<dt class="field-even">Return type<span class="colon">:</span></dt>
<dd class="field-even"><p><code class="xref py py-class docutils literal notranslate"><span class="pre">str</span></code></p>
</dd>
</dl>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.winobject.process.WinProcess.read_memory_into">
<span class="sig-name descname"><span class="pre">read_memory_into</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">addr</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">struct</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/process.html#WinProcess.read_memory_into"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.winobject.process.WinProcess.read_memory_into" title="Link to this definition"></a></dt>
<dd><p>Read a <code class="xref py py-mod docutils literal notranslate"><span class="pre">ctypes</span></code> struct from <cite>addr</cite></p>
<dl class="field-list simple">
<dt class="field-odd">Returns<span class="colon">:</span></dt>
<dd class="field-odd"><p>struct</p>
</dd>
</dl>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.winobject.process.WinProcess.read_ptr">
<span class="sig-name descname"><span class="pre">read_ptr</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">addr</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.WinProcess.read_ptr" title="Link to this definition"></a></dt>
<dd><p>Read a <code class="docutils literal notranslate"><span class="pre">PTR</span></code> at <code class="docutils literal notranslate"><span class="pre">addr</span></code></p>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.winobject.process.WinProcess.read_qword">
<span class="sig-name descname"><span class="pre">read_qword</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">addr</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.WinProcess.read_qword" title="Link to this definition"></a></dt>
<dd><p>Read a <code class="docutils literal notranslate"><span class="pre">ULONG64</span></code> at <code class="docutils literal notranslate"><span class="pre">addr</span></code></p>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.winobject.process.WinProcess.read_short">
<span class="sig-name descname"><span class="pre">read_short</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">addr</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.WinProcess.read_short" title="Link to this definition"></a></dt>
<dd><p>Read a <code class="docutils literal notranslate"><span class="pre">SHORT</span></code> at <code class="docutils literal notranslate"><span class="pre">addr</span></code></p>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.winobject.process.WinProcess.read_string">
<span class="sig-name descname"><span class="pre">read_string</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">addr</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.WinProcess.read_string" title="Link to this definition"></a></dt>
<dd><p>Read an ascii string at <code class="docutils literal notranslate"><span class="pre">addr</span></code></p>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.winobject.process.WinProcess.read_wstring">
<span class="sig-name descname"><span class="pre">read_wstring</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">addr</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.WinProcess.read_wstring" title="Link to this definition"></a></dt>
<dd><p>Read a windows UTF16 string at <code class="docutils literal notranslate"><span class="pre">addr</span></code></p>
</dd></dl>
<dl class="py property">
<dt class="sig sig-object py" id="windows.winobject.process.WinProcess.threads">
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">threads</span></span><a class="headerlink" href="#windows.winobject.process.WinProcess.threads" title="Link to this definition"></a></dt>
<dd><p>The threads of the process</p>
<dl class="field-list simple">
<dt class="field-odd">Type<span class="colon">:</span></dt>
<dd class="field-odd"><p>[<a class="reference internal" href="#windows.winobject.process.WinThread" title="windows.winobject.process.WinThread"><code class="xref py py-class docutils literal notranslate"><span class="pre">WinThread</span></code></a>] – A list of Thread</p>
</dd>
</dl>
</dd></dl>
<dl class="py property">
<dt class="sig sig-object py" id="windows.winobject.process.WinProcess.time_info">
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">time_info</span></span><a class="headerlink" href="#windows.winobject.process.WinProcess.time_info" title="Link to this definition"></a></dt>
<dd><p>The time information of the process (creation, kernel/user time, exit time)</p>
<dl class="field-list simple">
<dt class="field-odd">Type<span class="colon">:</span></dt>
<dd class="field-odd"><p><code class="xref py py-class docutils literal notranslate"><span class="pre">TimeInfo</span></code></p>
</dd>
</dl>
</dd></dl>
<dl class="py property">
<dt class="sig sig-object py" id="windows.winobject.process.WinProcess.token">
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">token</span></span><a class="headerlink" href="#windows.winobject.process.WinProcess.token" title="Link to this definition"></a></dt>
<dd><p>The process <a class="reference internal" href="token.html#windows.winobject.token.Token" title="windows.winobject.token.Token"><code class="xref py py-class docutils literal notranslate"><span class="pre">Token</span></code></a></p>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.winobject.process.WinProcess.virtual_alloc">
<span class="sig-name descname"><span class="pre">virtual_alloc</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">size</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">prot</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">PAGE_EXECUTE_READWRITE(0x40)</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">addr</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">None</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/process.html#WinProcess.virtual_alloc"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.winobject.process.WinProcess.virtual_alloc" title="Link to this definition"></a></dt>
<dd><p>Allocate memory in the process</p>
<dl class="field-list simple">
<dt class="field-odd">Returns<span class="colon">:</span></dt>
<dd class="field-odd"><p>The address of the allocated memory</p>
</dd>
<dt class="field-even">Return type<span class="colon">:</span></dt>
<dd class="field-even"><p><code class="xref py py-class docutils literal notranslate"><span class="pre">int</span></code></p>
</dd>
</dl>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.winobject.process.WinProcess.virtual_free">
<span class="sig-name descname"><span class="pre">virtual_free</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">addr</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/process.html#WinProcess.virtual_free"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.winobject.process.WinProcess.virtual_free" title="Link to this definition"></a></dt>
<dd><p>Free memory in the process by virtual_alloc</p>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.winobject.process.WinProcess.virtual_protect">
<span class="sig-name descname"><span class="pre">virtual_protect</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">addr</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">size</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">protect</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">old_protect</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">None</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.WinProcess.virtual_protect" title="Link to this definition"></a></dt>
<dd><p>Change the access right of one or more page of the process</p>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.winobject.process.WinProcess.virtual_protected">
<span class="sig-name descname"><span class="pre">virtual_protected</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">addr</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">size</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">protect</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.WinProcess.virtual_protected" title="Link to this definition"></a></dt>
<dd><p>A context manager for local virtual_protect (old Protection are restored at exit)</p>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.winobject.process.WinProcess.wait">
<span class="sig-name descname"><span class="pre">wait</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">timeout</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">INFINITE(0xffffffff)</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.WinProcess.wait" title="Link to this definition"></a></dt>
<dd><p>Wait for the object</p>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.winobject.process.WinProcess.write_byte">
<span class="sig-name descname"><span class="pre">write_byte</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">addr</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">byte</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.WinProcess.write_byte" title="Link to this definition"></a></dt>
<dd><p>write a byte at <code class="docutils literal notranslate"><span class="pre">addr</span></code></p>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.winobject.process.WinProcess.write_dword">
<span class="sig-name descname"><span class="pre">write_dword</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">addr</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">dword</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.WinProcess.write_dword" title="Link to this definition"></a></dt>
<dd><p>write a dword at <code class="docutils literal notranslate"><span class="pre">addr</span></code></p>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.winobject.process.WinProcess.write_memory">
<span class="sig-name descname"><span class="pre">write_memory</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">addr</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">data</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/process.html#WinProcess.write_memory"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.winobject.process.WinProcess.write_memory" title="Link to this definition"></a></dt>
<dd><p>Write <cite>data</cite> at <cite>addr</cite></p>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.winobject.process.WinProcess.write_ptr">
<span class="sig-name descname"><span class="pre">write_ptr</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">addr</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">value</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.WinProcess.write_ptr" title="Link to this definition"></a></dt>
<dd><p>Write a <code class="docutils literal notranslate"><span class="pre">PTR</span></code> at <code class="docutils literal notranslate"><span class="pre">addr</span></code></p>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.winobject.process.WinProcess.write_qword">
<span class="sig-name descname"><span class="pre">write_qword</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">addr</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">qword</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.WinProcess.write_qword" title="Link to this definition"></a></dt>
<dd><p>write a qword at <code class="docutils literal notranslate"><span class="pre">addr</span></code></p>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.winobject.process.WinProcess.write_short">
<span class="sig-name descname"><span class="pre">write_short</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">addr</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">word</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.WinProcess.write_short" title="Link to this definition"></a></dt>
<dd><p>write a word at <code class="docutils literal notranslate"><span class="pre">addr</span></code></p>
</dd></dl>
</dd></dl>
</section>
<section id="winthread">
<h2><span class="section-number">2.1.4. </span>WinThread<a class="headerlink" href="#winthread" title="Link to this heading"></a></h2>
<dl class="py class">
<dt class="sig sig-object py" id="windows.winobject.process.WinThread">
<em class="property"><span class="pre">class</span><span class="w"> </span></em><span class="sig-prename descclassname"><span class="pre">windows.winobject.process.</span></span><span class="sig-name descname"><span class="pre">WinThread</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">tid</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">None</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">handle</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">None</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">owner_pid</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">None</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">owner</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">None</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/process.html#WinThread"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.winobject.process.WinThread" title="Link to this definition"></a></dt>
<dd><p>Bases: <code class="xref py py-class docutils literal notranslate"><span class="pre">Thread</span></code></p>
<p>Represent a thread</p>
<dl class="py property">
<dt class="sig sig-object py" id="windows.winobject.process.WinThread.context">
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">context</span></span><a class="headerlink" href="#windows.winobject.process.WinThread.context" title="Link to this definition"></a></dt>
<dd><p>The context of the thread, type depend of the target process.</p>
<dl class="field-list simple">
<dt class="field-odd">Type<span class="colon">:</span></dt>
<dd class="field-odd"><p><code class="xref py py-class docutils literal notranslate"><span class="pre">windows.exception.ECONTEXT32</span></code> or <code class="xref py py-class docutils literal notranslate"><span class="pre">windows.exception.ECONTEXT64</span></code> or <code class="xref py py-class docutils literal notranslate"><span class="pre">windows.exception.ECONTEXTWOW64</span></code></p>
</dd>
</dl>
</dd></dl>
<dl class="py property">
<dt class="sig sig-object py" id="windows.winobject.process.WinThread.context_syswow">
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">context_syswow</span></span><a class="headerlink" href="#windows.winobject.process.WinThread.context_syswow" title="Link to this definition"></a></dt>
<dd><p>The 64 bits context of a syswow thread.</p>
<dl class="field-list simple">
<dt class="field-odd">Type<span class="colon">:</span></dt>
<dd class="field-odd"><p><code class="xref py py-class docutils literal notranslate"><span class="pre">windows.exception.ECONTEXT64</span></code></p>
</dd>
</dl>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.winobject.process.WinThread.exit">
<span class="sig-name descname"><span class="pre">exit</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">code</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">0</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/process.html#WinThread.exit"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.winobject.process.WinThread.exit" title="Link to this definition"></a></dt>
<dd><p>Exit the thread</p>
</dd></dl>
<dl class="py property">
<dt class="sig sig-object py" id="windows.winobject.process.WinThread.exit_code">
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">exit_code</span></span><a class="headerlink" href="#windows.winobject.process.WinThread.exit_code" title="Link to this definition"></a></dt>
<dd><p>The exit code of the thread : <code class="docutils literal notranslate"><span class="pre">STILL_ACTIVE</span></code> means the process is not dead</p>
<dl class="field-list simple">
<dt class="field-odd">Type<span class="colon">:</span></dt>
<dd class="field-odd"><p><code class="xref py py-class docutils literal notranslate"><span class="pre">int</span></code></p>
</dd>
</dl>
</dd></dl>
<dl class="py property">
<dt class="sig sig-object py" id="windows.winobject.process.WinThread.handle">
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">handle</span></span><a class="headerlink" href="#windows.winobject.process.WinThread.handle" title="Link to this definition"></a></dt>
<dd><p>An handle on the object</p>
<dl class="field-list">
<dt class="field-odd">Type<span class="colon">:</span></dt>
<dd class="field-odd"><p>HANDLE</p>
<div class="admonition note">
<p class="admonition-title">Note</p>
<p>The handle is automaticaly closed when the object is destroyed</p>
</div>
</dd>
</dl>
</dd></dl>
<dl class="py property">
<dt class="sig sig-object py" id="windows.winobject.process.WinThread.is_exit">
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">is_exit</span></span><a class="headerlink" href="#windows.winobject.process.WinThread.is_exit" title="Link to this definition"></a></dt>
<dd><p><code class="docutils literal notranslate"><span class="pre">True</span></code> if the thread is terminated</p>
<dl class="field-list simple">
<dt class="field-odd">Type<span class="colon">:</span></dt>
<dd class="field-odd"><p><code class="xref py py-class docutils literal notranslate"><span class="pre">bool</span></code></p>
</dd>
</dl>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.winobject.process.WinThread.open_token">
<span class="sig-name descname"><span class="pre">open_token</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">flags</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">MAXIMUM_ALLOWED(0x2000000)</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">as_self</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">False</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.WinThread.open_token" title="Link to this definition"></a></dt>
<dd><p>Open the Thread token if any (Impersonation) else return None.
<code class="docutils literal notranslate"><span class="pre">as_self</span></code> tells which security context should be used</p>
<dl class="field-list simple">
<dt class="field-odd">Returns<span class="colon">:</span></dt>
<dd class="field-odd"><p><a class="reference internal" href="token.html#windows.winobject.token.Token" title="windows.winobject.token.Token"><code class="xref py py-class docutils literal notranslate"><span class="pre">Token</span></code></a></p>
</dd>
</dl>
<div class="admonition note">
<p class="admonition-title">Note</p>
<p>see <a class="reference external" href="https://docs.microsoft.com/en-us/windows/desktop/api/processthreadsapi/nf-processthreadsapi-openthreadtoken">https://docs.microsoft.com/en-us/windows/desktop/api/processthreadsapi/nf-processthreadsapi-openthreadtoken</a></p>
</div>
</dd></dl>
<dl class="py property">
<dt class="sig sig-object py" id="windows.winobject.process.WinThread.owner">
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">owner</span></span><a class="headerlink" href="#windows.winobject.process.WinThread.owner" title="Link to this definition"></a></dt>
<dd><p>The Process owning the thread</p>
<dl class="field-list simple">
<dt class="field-odd">Type<span class="colon">:</span></dt>
<dd class="field-odd"><p><a class="reference internal" href="#windows.winobject.process.WinProcess" title="windows.winobject.process.WinProcess"><code class="xref py py-class docutils literal notranslate"><span class="pre">WinProcess</span></code></a></p>
</dd>
</dl>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.winobject.process.WinThread.resume">
<span class="sig-name descname"><span class="pre">resume</span></span><span class="sig-paren">(</span><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/process.html#WinThread.resume"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.winobject.process.WinThread.resume" title="Link to this definition"></a></dt>
<dd><p>Resume the thread</p>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.winobject.process.WinThread.set_context">
<span class="sig-name descname"><span class="pre">set_context</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">context</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/process.html#WinThread.set_context"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.winobject.process.WinThread.set_context" title="Link to this definition"></a></dt>
<dd><p>Set the thread’s context to <code class="docutils literal notranslate"><span class="pre">context</span></code></p>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.winobject.process.WinThread.set_syswow_context">
<span class="sig-name descname"><span class="pre">set_syswow_context</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">context</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/process.html#WinThread.set_syswow_context"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.winobject.process.WinThread.set_syswow_context" title="Link to this definition"></a></dt>
<dd><p>Set a syswow thread’s 64 context to <code class="docutils literal notranslate"><span class="pre">context</span></code></p>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.winobject.process.WinThread.set_token">
<span class="sig-name descname"><span class="pre">set_token</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">token</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.WinThread.set_token" title="Link to this definition"></a></dt>
<dd><p>Set the token for the thread (impersonation). Setting the token to None revert the impersonation</p>
</dd></dl>
<dl class="py property">
<dt class="sig sig-object py" id="windows.winobject.process.WinThread.start_address">
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">start_address</span></span><a class="headerlink" href="#windows.winobject.process.WinThread.start_address" title="Link to this definition"></a></dt>
<dd><p>The start address of the thread</p>
<dl class="field-list simple">
<dt class="field-odd">Type<span class="colon">:</span></dt>
<dd class="field-odd"><p><code class="xref py py-class docutils literal notranslate"><span class="pre">int</span></code></p>
</dd>
</dl>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.winobject.process.WinThread.suspend">
<span class="sig-name descname"><span class="pre">suspend</span></span><span class="sig-paren">(</span><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/process.html#WinThread.suspend"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.winobject.process.WinThread.suspend" title="Link to this definition"></a></dt>
<dd><p>Suspend the thread</p>
</dd></dl>
<dl class="py property">
<dt class="sig sig-object py" id="windows.winobject.process.WinThread.teb_base">
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">teb_base</span></span><a class="headerlink" href="#windows.winobject.process.WinThread.teb_base" title="Link to this definition"></a></dt>
<dd><p>The address of the thread’s TEB. If the owner is a SysWow64 process, return the TEB32.</p>
<dl class="field-list simple">
<dt class="field-odd">Type<span class="colon">:</span></dt>
<dd class="field-odd"><p><code class="xref py py-class docutils literal notranslate"><span class="pre">int</span></code></p>
</dd>
</dl>
</dd></dl>
<dl class="py property">
<dt class="sig sig-object py" id="windows.winobject.process.WinThread.teb_syswow_base">
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">teb_syswow_base</span></span><a class="headerlink" href="#windows.winobject.process.WinThread.teb_syswow_base" title="Link to this definition"></a></dt>
<dd><p>The address of the thread’s TEB64 for a SysWow64 process</p>
<dl class="field-list simple">
<dt class="field-odd">Type<span class="colon">:</span></dt>
<dd class="field-odd"><p><code class="xref py py-class docutils literal notranslate"><span class="pre">int</span></code></p>
</dd>
</dl>
</dd></dl>
<dl class="py property">
<dt class="sig sig-object py" id="windows.winobject.process.WinThread.tid">
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">tid</span></span><a class="headerlink" href="#windows.winobject.process.WinThread.tid" title="Link to this definition"></a></dt>
<dd><p>Thread ID</p>
<dl class="field-list simple">
<dt class="field-odd">Type<span class="colon">:</span></dt>
<dd class="field-odd"><p><code class="xref py py-class docutils literal notranslate"><span class="pre">int</span></code></p>
</dd>
</dl>
</dd></dl>
<dl class="py property">
<dt class="sig sig-object py" id="windows.winobject.process.WinThread.token">
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">token</span></span><a class="headerlink" href="#windows.winobject.process.WinThread.token" title="Link to this definition"></a></dt>
<dd><p>The thread <a class="reference internal" href="token.html#windows.winobject.token.Token" title="windows.winobject.token.Token"><code class="xref py py-class docutils literal notranslate"><span class="pre">Token</span></code></a></p>
<dl class="field-list simple">
<dt class="field-odd">Getter<span class="colon">:</span></dt>
<dd class="field-odd"><p><a class="reference internal" href="#windows.winobject.process.WinThread.open_token" title="windows.winobject.process.WinThread.open_token"><code class="xref py py-func docutils literal notranslate"><span class="pre">open_token()</span></code></a></p>
</dd>
<dt class="field-even">Setter<span class="colon">:</span></dt>
<dd class="field-even"><p><a class="reference internal" href="#windows.winobject.process.WinThread.set_token" title="windows.winobject.process.WinThread.set_token"><code class="xref py py-func docutils literal notranslate"><span class="pre">set_token()</span></code></a></p>
</dd>
</dl>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.winobject.process.WinThread.wait">
<span class="sig-name descname"><span class="pre">wait</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">timeout</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">INFINITE(0xffffffff)</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.WinThread.wait" title="Link to this definition"></a></dt>
<dd><p>Wait for the object</p>
</dd></dl>
</dd></dl>
<dl class="py class">
<dt class="sig sig-object py" id="windows.winobject.process.DeadThread">
<em class="property"><span class="pre">class</span><span class="w"> </span></em><span class="sig-prename descclassname"><span class="pre">windows.winobject.process.</span></span><span class="sig-name descname"><span class="pre">DeadThread</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">handle</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">tid</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">None</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/process.html#DeadThread"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.winobject.process.DeadThread" title="Link to this definition"></a></dt>
<dd><p>Bases: <code class="xref py py-class docutils literal notranslate"><span class="pre">AutoHandle</span></code></p>
<p>An already dead thread (returned only by API returning a new thread if thread die before being returned)</p>
<dl class="py property">
<dt class="sig sig-object py" id="windows.winobject.process.DeadThread.exit_code">
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">exit_code</span></span><a class="headerlink" href="#windows.winobject.process.DeadThread.exit_code" title="Link to this definition"></a></dt>
<dd><p>The exit code of the thread : <code class="docutils literal notranslate"><span class="pre">STILL_ACTIVE</span></code> means the process is not dead</p>
<dl class="field-list simple">
<dt class="field-odd">Type<span class="colon">:</span></dt>
<dd class="field-odd"><p><code class="xref py py-class docutils literal notranslate"><span class="pre">int</span></code></p>
</dd>
</dl>
</dd></dl>
<dl class="py property">
<dt class="sig sig-object py" id="windows.winobject.process.DeadThread.handle">
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">handle</span></span><a class="headerlink" href="#windows.winobject.process.DeadThread.handle" title="Link to this definition"></a></dt>
<dd><p>An handle on the object</p>
<dl class="field-list">
<dt class="field-odd">Type<span class="colon">:</span></dt>
<dd class="field-odd"><p>HANDLE</p>
<div class="admonition note">
<p class="admonition-title">Note</p>
<p>The handle is automaticaly closed when the object is destroyed</p>
</div>
</dd>
</dl>
</dd></dl>
<dl class="py property">
<dt class="sig sig-object py" id="windows.winobject.process.DeadThread.is_exit">
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">is_exit</span></span><a class="headerlink" href="#windows.winobject.process.DeadThread.is_exit" title="Link to this definition"></a></dt>
<dd><p><code class="docutils literal notranslate"><span class="pre">True</span></code> if the thread is terminated</p>
<dl class="field-list simple">
<dt class="field-odd">Type<span class="colon">:</span></dt>
<dd class="field-odd"><p><code class="xref py py-class docutils literal notranslate"><span class="pre">bool</span></code></p>
</dd>
</dl>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.winobject.process.DeadThread.wait">
<span class="sig-name descname"><span class="pre">wait</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">timeout</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">INFINITE(0xffffffff)</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.DeadThread.wait" title="Link to this definition"></a></dt>
<dd><p>Wait for the object</p>
</dd></dl>
</dd></dl>
</section>
</section>
<section id="peb-exploration">
<h1><span class="section-number">2.2. </span>PEB Exploration<a class="headerlink" href="#peb-exploration" title="Link to this heading"></a></h1>
<p>The <code class="xref py py-mod docutils literal notranslate"><span class="pre">windows</span></code> module is able to parse the PEB of the current process or remote process.
The <a class="reference internal" href="#windows.winobject.process.PEB" title="windows.winobject.process.PEB"><code class="xref py py-class docutils literal notranslate"><span class="pre">PEB</span></code></a> is accessible via <code class="docutils literal notranslate"><span class="pre">process.peb</span></code> and is of type <a class="reference internal" href="#windows.winobject.process.PEB" title="windows.winobject.process.PEB"><code class="xref py py-class docutils literal notranslate"><span class="pre">PEB</span></code></a>.</p>
<div class="admonition note">
<p class="admonition-title">Note</p>
<p>See sample <a class="reference internal" href="sample.html#sample-peb-exploration"><span class="std std-ref">PEB exploration</span></a></p>
</div>
<section id="peb">
<h2><span class="section-number">2.2.1. </span>PEB<a class="headerlink" href="#peb" title="Link to this heading"></a></h2>
<dl class="py class">
<dt class="sig sig-object py" id="windows.winobject.process.PEB">
<em class="property"><span class="pre">class</span><span class="w"> </span></em><span class="sig-prename descclassname"><span class="pre">windows.winobject.process.</span></span><span class="sig-name descname"><span class="pre">PEB</span></span><a class="reference internal" href="_modules/windows/winobject/process.html#PEB"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.winobject.process.PEB" title="Link to this definition"></a></dt>
<dd><p>The PEB (Process Environment Block) of the current process</p>
<dl class="py property">
<dt class="sig sig-object py" id="windows.winobject.process.PEB.apisetmap">
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">apisetmap</span></span><a class="headerlink" href="#windows.winobject.process.PEB.apisetmap" title="Link to this definition"></a></dt>
<dd><p>The <a class="reference internal" href="#windows.winobject.apisetmap.ApiSetMap" title="windows.winobject.apisetmap.ApiSetMap"><code class="xref py py-class docutils literal notranslate"><span class="pre">ApiSetMap</span></code></a> of the process</p>
<dl class="field-list simple">
<dt class="field-odd">Return type<span class="colon">:</span></dt>
<dd class="field-odd"><p>A subclass of <a class="reference internal" href="#windows.winobject.apisetmap.ApiSetMap" title="windows.winobject.apisetmap.ApiSetMap"><code class="xref py py-class docutils literal notranslate"><span class="pre">ApiSetMap</span></code></a></p>
</dd>
<dt class="field-even">Raise<span class="colon">:</span></dt>
<dd class="field-even"><p><code class="xref py py-class docutils literal notranslate"><span class="pre">NotImplementedError</span></code> – Before <code class="docutils literal notranslate"><span class="pre">6.2</span></code> ApiSetMap did not exist</p>
</dd>
<dt class="field-odd">Raise<span class="colon">:</span></dt>
<dd class="field-odd"><p><code class="xref py py-class docutils literal notranslate"><span class="pre">NotImplementedError</span></code> – Not implemented for remote process</p>
</dd>
</dl>
</dd></dl>
<dl class="py property">
<dt class="sig sig-object py" id="windows.winobject.process.PEB.commandline">
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">commandline</span></span><a class="headerlink" href="#windows.winobject.process.PEB.commandline" title="Link to this definition"></a></dt>
<dd><p>The CommandLine of the PEB</p>
<dl class="field-list simple">
<dt class="field-odd">Type<span class="colon">:</span></dt>
<dd class="field-odd"><p><a class="reference internal" href="winstructs_generated.html#windows.generated_def.winstructs.LSA_UNICODE_STRING" title="windows.generated_def.winstructs.LSA_UNICODE_STRING"><code class="xref py py-class docutils literal notranslate"><span class="pre">LSA_UNICODE_STRING</span></code></a></p>
</dd>
</dl>
</dd></dl>
<dl class="py property">
<dt class="sig sig-object py" id="windows.winobject.process.PEB.exe">
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">exe</span></span><a class="headerlink" href="#windows.winobject.process.PEB.exe" title="Link to this definition"></a></dt>
<dd><p>The executable of the process, as pointed by PEB.ImageBaseAddress</p>
<dl class="field-list simple">
<dt class="field-odd">Type<span class="colon">:</span></dt>
<dd class="field-odd"><p><a class="reference internal" href="#windows.pe_parse.PEFile" title="windows.pe_parse.PEFile"><code class="xref py py-class docutils literal notranslate"><span class="pre">windows.pe_parse.PEFile</span></code></a></p>
</dd>
</dl>
</dd></dl>
<dl class="py property">
<dt class="sig sig-object py" id="windows.winobject.process.PEB.imagepath">
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">imagepath</span></span><a class="headerlink" href="#windows.winobject.process.PEB.imagepath" title="Link to this definition"></a></dt>
<dd><p>The ImagePathName of the PEB</p>
<dl class="field-list simple">
<dt class="field-odd">Type<span class="colon">:</span></dt>
<dd class="field-odd"><p><a class="reference internal" href="winstructs_generated.html#windows.generated_def.winstructs.LSA_UNICODE_STRING" title="windows.generated_def.winstructs.LSA_UNICODE_STRING"><code class="xref py py-class docutils literal notranslate"><span class="pre">LSA_UNICODE_STRING</span></code></a></p>
</dd>
</dl>
</dd></dl>
<dl class="py property">
<dt class="sig sig-object py" id="windows.winobject.process.PEB.modules">
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">modules</span></span><a class="headerlink" href="#windows.winobject.process.PEB.modules" title="Link to this definition"></a></dt>
<dd><p>The loaded modules present in the PEB</p>
<dl class="field-list simple">
<dt class="field-odd">Type<span class="colon">:</span></dt>
<dd class="field-odd"><p>[<a class="reference internal" href="#windows.winobject.process.LoadedModule" title="windows.winobject.process.LoadedModule"><code class="xref py py-class docutils literal notranslate"><span class="pre">LoadedModule</span></code></a>] – List of loaded modules</p>
</dd>
</dl>
</dd></dl>
</dd></dl>
</section>
<section id="loadedmodule">
<h2><span class="section-number">2.2.2. </span>LoadedModule<a class="headerlink" href="#loadedmodule" title="Link to this heading"></a></h2>
<dl class="py class">
<dt class="sig sig-object py" id="windows.winobject.process.LoadedModule">
<em class="property"><span class="pre">class</span><span class="w"> </span></em><span class="sig-prename descclassname"><span class="pre">windows.winobject.process.</span></span><span class="sig-name descname"><span class="pre">LoadedModule</span></span><a class="reference internal" href="_modules/windows/winobject/process.html#LoadedModule"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.winobject.process.LoadedModule" title="Link to this definition"></a></dt>
<dd><p>An entry in the PEB Ldr list</p>
<dl class="py property">
<dt class="sig sig-object py" id="windows.winobject.process.LoadedModule.baseaddr">
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">baseaddr</span></span><a class="headerlink" href="#windows.winobject.process.LoadedModule.baseaddr" title="Link to this definition"></a></dt>
<dd><p>Base address of the module</p>
<dl class="field-list simple">
<dt class="field-odd">Type<span class="colon">:</span></dt>
<dd class="field-odd"><p><code class="xref py py-class docutils literal notranslate"><span class="pre">int</span></code></p>
</dd>
</dl>
</dd></dl>
<dl class="py property">
<dt class="sig sig-object py" id="windows.winobject.process.LoadedModule.fullname">
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">fullname</span></span><a class="headerlink" href="#windows.winobject.process.LoadedModule.fullname" title="Link to this definition"></a></dt>
<dd><p>Full name of the module (path)</p>
<dl class="field-list simple">
<dt class="field-odd">Type<span class="colon">:</span></dt>
<dd class="field-odd"><p><code class="xref py py-class docutils literal notranslate"><span class="pre">str</span></code></p>
</dd>
</dl>
</dd></dl>
<dl class="py property">
<dt class="sig sig-object py" id="windows.winobject.process.LoadedModule.name">
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">name</span></span><a class="headerlink" href="#windows.winobject.process.LoadedModule.name" title="Link to this definition"></a></dt>
<dd><p>Name of the module</p>
<dl class="field-list simple">
<dt class="field-odd">Type<span class="colon">:</span></dt>
<dd class="field-odd"><p><code class="xref py py-class docutils literal notranslate"><span class="pre">str</span></code></p>
</dd>
</dl>
</dd></dl>
<dl class="py property">
<dt class="sig sig-object py" id="windows.winobject.process.LoadedModule.pe">
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">pe</span></span><a class="headerlink" href="#windows.winobject.process.LoadedModule.pe" title="Link to this definition"></a></dt>
<dd><p>A PE representation of the module</p>
<dl class="field-list simple">
<dt class="field-odd">Type<span class="colon">:</span></dt>
<dd class="field-odd"><p><a class="reference internal" href="#windows.pe_parse.PEFile" title="windows.pe_parse.PEFile"><code class="xref py py-class docutils literal notranslate"><span class="pre">windows.pe_parse.PEFile</span></code></a></p>
</dd>
</dl>
</dd></dl>
</dd></dl>
</section>
<section id="apisetmap">
<h2><span class="section-number">2.2.3. </span>ApiSetMap<a class="headerlink" href="#apisetmap" title="Link to this heading"></a></h2>
<div class="admonition note">
<p class="admonition-title">Note</p>
<p>see sample <a class="reference internal" href="sample.html#sample-apisetmap"><span class="std std-ref">ApiSetMap</span></a></p>
</div>
<dl class="py class">
<dt class="sig sig-object py" id="windows.winobject.apisetmap.ApiSetMap">
<em class="property"><span class="pre">class</span><span class="w"> </span></em><span class="sig-prename descclassname"><span class="pre">windows.winobject.apisetmap.</span></span><span class="sig-name descname"><span class="pre">ApiSetMap</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">base</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/apisetmap.html#ApiSetMap"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.winobject.apisetmap.ApiSetMap" title="Link to this definition"></a></dt>
<dd><p>The base class for the ApiSeMap
(see <a class="reference external" href="https://blog.quarkslab.com/runtime-dll-name-resolution-apisetschema-part-ii.html">Runtime DLL name resolution: ApiSetSchema</a>)</p>
<dl class="py property">
<dt class="sig sig-object py" id="windows.winobject.apisetmap.ApiSetMap.apisetmap_dict">
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">apisetmap_dict</span></span><a class="headerlink" href="#windows.winobject.apisetmap.ApiSetMap.apisetmap_dict" title="Link to this definition"></a></dt>
<dd><p>The apisetmap dll-mapping content extracted from memory as a <code class="xref py py-class docutils literal notranslate"><span class="pre">dict</span></code></p>
<p><code class="docutils literal notranslate"><span class="pre">key</span> <span class="pre">-&gt;</span> <span class="pre">value</span> <span class="pre">example</span></code>:</p>
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="sa">u</span><span class="s1">&#39;ext-ms-win-advapi32-encryptedfile-l1-1-1&#39;</span> <span class="o">-&gt;</span> <span class="sa">u</span><span class="s1">&#39;advapi32.dll&#39;</span>
</pre></div>
</div>
</dd></dl>
<dl class="py property">
<dt class="sig sig-object py" id="windows.winobject.apisetmap.ApiSetMap.resolution_dict">
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">resolution_dict</span></span><a class="headerlink" href="#windows.winobject.apisetmap.ApiSetMap.resolution_dict" title="Link to this definition"></a></dt>
<dd><p>The <code class="xref py py-class docutils literal notranslate"><span class="pre">dict</span></code> based on <a class="reference internal" href="#windows.winobject.apisetmap.ApiSetMap.apisetmap_dict" title="windows.winobject.apisetmap.ApiSetMap.apisetmap_dict"><code class="xref py py-obj docutils literal notranslate"><span class="pre">apisetmap_dict</span></code></a> with only the part checked by <code class="docutils literal notranslate"><span class="pre">Windows</span></code>.</p>
<p><code class="docutils literal notranslate"><span class="pre">Windows</span></code> does not care about what is after the last <code class="docutils literal notranslate"><span class="pre">-</span></code></p>
<p><code class="docutils literal notranslate"><span class="pre">key</span> <span class="pre">-&gt;</span> <span class="pre">value</span> <span class="pre">example</span></code>:</p>
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="sa">u</span><span class="s1">&#39;ext-ms-win-advapi32-encryptedfile-l1-1-&#39;</span> <span class="o">-&gt;</span> <span class="sa">u</span><span class="s1">&#39;advapi32.dll&#39;</span>
</pre></div>
</div>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.winobject.apisetmap.ApiSetMap.resolve">
<span class="sig-name descname"><span class="pre">resolve</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">dllname</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/apisetmap.html#ApiSetMap.resolve"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.winobject.apisetmap.ApiSetMap.resolve" title="Link to this definition"></a></dt>
<dd><p>The method used to resolve a DLL name using the ApiSetMap.
The behavior should match the non-exported function <code class="docutils literal notranslate"><span class="pre">ntdll!ApiSetResolveToHost</span></code></p>
</dd></dl>
<dl class="py attribute">
<dt class="sig sig-object py" id="windows.winobject.apisetmap.ApiSetMap.version">
<span class="sig-name descname"><span class="pre">version</span></span><em class="property"><span class="w"> </span><span class="p"><span class="pre">=</span></span><span class="w"> </span><span class="pre">None</span></em><a class="headerlink" href="#windows.winobject.apisetmap.ApiSetMap.version" title="Link to this definition"></a></dt>
<dd><p>The version of the ApiSetMap</p>
</dd></dl>
</dd></dl>
<div class="admonition note">
<p class="admonition-title">Note</p>
<p>Currently supported version for the ApiSetMap are 2/4/6</p>
</div>
<dl class="py class">
<dt class="sig sig-object py" id="windows.winobject.apisetmap.ApiSetMapVersion2">
<em class="property"><span class="pre">class</span><span class="w"> </span></em><span class="sig-prename descclassname"><span class="pre">windows.winobject.apisetmap.</span></span><span class="sig-name descname"><span class="pre">ApiSetMapVersion2</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">base</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/apisetmap.html#ApiSetMapVersion2"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.winobject.apisetmap.ApiSetMapVersion2" title="Link to this definition"></a></dt>
<dd><p>Represent an ApiSetMap version-2</p>
<dl class="py attribute">
<dt class="sig sig-object py" id="windows.winobject.apisetmap.ApiSetMapVersion2.version">
<span class="sig-name descname"><span class="pre">version</span></span><em class="property"><span class="w"> </span><span class="p"><span class="pre">=</span></span><span class="w"> </span><span class="pre">2</span></em><a class="headerlink" href="#windows.winobject.apisetmap.ApiSetMapVersion2.version" title="Link to this definition"></a></dt>
<dd><p>The version of the ApiSetMap</p>
</dd></dl>
</dd></dl>
<dl class="py class">
<dt class="sig sig-object py" id="windows.winobject.apisetmap.ApiSetMapVersion4">
<em class="property"><span class="pre">class</span><span class="w"> </span></em><span class="sig-prename descclassname"><span class="pre">windows.winobject.apisetmap.</span></span><span class="sig-name descname"><span class="pre">ApiSetMapVersion4</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">base</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/apisetmap.html#ApiSetMapVersion4"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.winobject.apisetmap.ApiSetMapVersion4" title="Link to this definition"></a></dt>
<dd><p>Represent an ApiSetMap version-4</p>
<dl class="py attribute">
<dt class="sig sig-object py" id="windows.winobject.apisetmap.ApiSetMapVersion4.version">
<span class="sig-name descname"><span class="pre">version</span></span><em class="property"><span class="w"> </span><span class="p"><span class="pre">=</span></span><span class="w"> </span><span class="pre">4</span></em><a class="headerlink" href="#windows.winobject.apisetmap.ApiSetMapVersion4.version" title="Link to this definition"></a></dt>
<dd><p>The version of the ApiSetMap</p>
</dd></dl>
</dd></dl>
<dl class="py class">
<dt class="sig sig-object py" id="windows.winobject.apisetmap.ApiSetMapVersion6">
<em class="property"><span class="pre">class</span><span class="w"> </span></em><span class="sig-prename descclassname"><span class="pre">windows.winobject.apisetmap.</span></span><span class="sig-name descname"><span class="pre">ApiSetMapVersion6</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">base</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/apisetmap.html#ApiSetMapVersion6"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.winobject.apisetmap.ApiSetMapVersion6" title="Link to this definition"></a></dt>
<dd><p>Represent an ApiSetMap version-6</p>
<dl class="py attribute">
<dt class="sig sig-object py" id="windows.winobject.apisetmap.ApiSetMapVersion6.version">
<span class="sig-name descname"><span class="pre">version</span></span><em class="property"><span class="w"> </span><span class="p"><span class="pre">=</span></span><span class="w"> </span><span class="pre">6</span></em><a class="headerlink" href="#windows.winobject.apisetmap.ApiSetMapVersion6.version" title="Link to this definition"></a></dt>
<dd><p>The version of the ApiSetMap</p>
</dd></dl>
</dd></dl>
</section>
</section>
<section id="pefile-parsing-loaded-pe">
<h1><span class="section-number">2.3. </span>PEFile - Parsing loaded PE<a class="headerlink" href="#pefile-parsing-loaded-pe" title="Link to this heading"></a></h1>
<section id="module-windows.pe_parse">
<span id="windows-pe-parse"></span><h2><span class="section-number">2.3.1. </span><a class="reference internal" href="#module-windows.pe_parse" title="windows.pe_parse"><code class="xref py py-mod docutils literal notranslate"><span class="pre">windows.pe_parse</span></code></a><a class="headerlink" href="#module-windows.pe_parse" title="Link to this heading"></a></h2>
<dl class="py function">
<dt class="sig sig-object py" id="windows.pe_parse.GetPEFile">
<span class="sig-prename descclassname"><span class="pre">windows.pe_parse.</span></span><span class="sig-name descname"><span class="pre">GetPEFile</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">baseaddr</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">target</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">None</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">force_bitness</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">None</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/pe_parse.html#GetPEFile"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.pe_parse.GetPEFile" title="Link to this definition"></a></dt>
<dd><p>Returns a <a class="reference internal" href="#windows.pe_parse.PEFile" title="windows.pe_parse.PEFile"><code class="xref py py-class docutils literal notranslate"><span class="pre">PEFile</span></code></a> to explore a PE loaded at <cite>baseaddr</cite> in process <cite>target</cite>.</p>
<dl class="field-list simple">
<dt class="field-odd">Return type<span class="colon">:</span></dt>
<dd class="field-odd"><p><a class="reference internal" href="#windows.pe_parse.PEFile" title="windows.pe_parse.PEFile"><code class="xref py py-class docutils literal notranslate"><span class="pre">PEFile</span></code></a></p>
</dd>
</dl>
<div class="admonition note">
<p class="admonition-title">Note</p>
<p>If target is <code class="docutils literal notranslate"><span class="pre">None</span></code> it refers to the current process</p>
</div>
</dd></dl>
<section id="pefile">
<h3><span class="section-number">2.3.1.1. </span>PEFile<a class="headerlink" href="#pefile" title="Link to this heading"></a></h3>
<dl class="py class">
<dt class="sig sig-object py" id="windows.pe_parse.PEFile">
<em class="property"><span class="pre">class</span><span class="w"> </span></em><span class="sig-prename descclassname"><span class="pre">windows.pe_parse.</span></span><span class="sig-name descname"><span class="pre">PEFile</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">target</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">baseaddr</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">targetedbitness</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">transformers</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/pe_parse.html#PEFile"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.pe_parse.PEFile" title="Link to this definition"></a></dt>
<dd><p>Represent a PE loaded in a process (current or remote)</p>
<dl class="py property">
<dt class="sig sig-object py" id="windows.pe_parse.PEFile.export_name">
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">export_name</span></span><a class="headerlink" href="#windows.pe_parse.PEFile.export_name" title="Link to this definition"></a></dt>
<dd><p>The Name attribute of the <code class="docutils literal notranslate"><span class="pre">EXPORT_DIRECTORY</span></code></p>
</dd></dl>
<dl class="py property">
<dt class="sig sig-object py" id="windows.pe_parse.PEFile.exports">
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">exports</span></span><a class="headerlink" href="#windows.pe_parse.PEFile.exports" title="Link to this definition"></a></dt>
<dd><p>The exports of the PE in a dict. Keys are ordinal (<code class="xref py py-class docutils literal notranslate"><span class="pre">int</span></code>) and name (<code class="xref py py-class docutils literal notranslate"><span class="pre">str</span></code>).
The values are the addresses of the exports.</p>
<blockquote>
<div><dl class="field-list simple">
<dt class="field-odd">type<span class="colon">:</span></dt>
<dd class="field-odd"><p>{(<code class="xref py py-class docutils literal notranslate"><span class="pre">int</span></code> or <code class="xref py py-class docutils literal notranslate"><span class="pre">str</span></code>) : <code class="xref py py-class docutils literal notranslate"><span class="pre">int</span></code>}</p>
</dd>
</dl>
</div></blockquote>
</dd></dl>
<dl class="py property">
<dt class="sig sig-object py" id="windows.pe_parse.PEFile.imports">
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">imports</span></span><a class="headerlink" href="#windows.pe_parse.PEFile.imports" title="Link to this definition"></a></dt>
<dd><p>The imports of the PE in a dict.
Keys are the names of DLL to import from and values are <code class="xref py py-class docutils literal notranslate"><span class="pre">list</span></code>
of <a class="reference internal" href="#windows.pe_parse.IATEntry" title="windows.pe_parse.IATEntry"><code class="xref py py-class docutils literal notranslate"><span class="pre">IATEntry</span></code></a></p>
<blockquote>
<div><dl class="field-list simple">
<dt class="field-odd">type<span class="colon">:</span></dt>
<dd class="field-odd"><p>{<code class="xref py py-class docutils literal notranslate"><span class="pre">str</span></code> : [<a class="reference internal" href="#windows.pe_parse.IATEntry" title="windows.pe_parse.IATEntry"><code class="xref py py-class docutils literal notranslate"><span class="pre">IATEntry</span></code></a>]}</p>
</dd>
</dl>
</div></blockquote>
</dd></dl>
</dd></dl>
</section>
<section id="iatentry">
<h3><span class="section-number">2.3.1.2. </span>IATEntry<a class="headerlink" href="#iatentry" title="Link to this heading"></a></h3>
<dl class="py class">
<dt class="sig sig-object py" id="windows.pe_parse.IATEntry">
<em class="property"><span class="pre">class</span><span class="w"> </span></em><span class="sig-prename descclassname"><span class="pre">windows.pe_parse.</span></span><span class="sig-name descname"><span class="pre">IATEntry</span></span><a class="reference internal" href="_modules/windows/pe_parse.html#IATEntry"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.pe_parse.IATEntry" title="Link to this definition"></a></dt>
<dd><p>Represent an entry in the IAT of a module
Can be used to get resolved value and setup hook</p>
<dl class="py data">
<dt class="sig sig-object py" id="windows.pe_parse.IATEntry.addr">
<span class="sig-name descname"><span class="pre">addr</span></span><a class="headerlink" href="#windows.pe_parse.IATEntry.addr" title="Link to this definition"></a></dt>
<dd><p><code class="xref py py-class docutils literal notranslate"><span class="pre">int</span></code> : Address of the IAT Entry</p>
</dd></dl>
<dl class="py data">
<dt class="sig sig-object py" id="windows.pe_parse.IATEntry.ord">
<span class="sig-name descname"><span class="pre">ord</span></span><a class="headerlink" href="#windows.pe_parse.IATEntry.ord" title="Link to this definition"></a></dt>
<dd><p><code class="xref py py-class docutils literal notranslate"><span class="pre">int</span></code> : Ordinal of the imported function</p>
</dd></dl>
<dl class="py data">
<dt class="sig sig-object py" id="windows.pe_parse.IATEntry.name">
<span class="sig-name descname"><span class="pre">name</span></span><a class="headerlink" href="#windows.pe_parse.IATEntry.name" title="Link to this definition"></a></dt>
<dd><p><code class="xref py py-class docutils literal notranslate"><span class="pre">int</span></code> : Name of the imported function</p>
</dd></dl>
<dl class="py data">
<dt class="sig sig-object py" id="windows.pe_parse.IATEntry.value">
<span class="sig-name descname"><span class="pre">value</span></span><a class="headerlink" href="#windows.pe_parse.IATEntry.value" title="Link to this definition"></a></dt>
<dd><p><code class="xref py py-class docutils literal notranslate"><span class="pre">int</span></code> : The content (destination) of the IAT entry</p>
<div class="admonition warning">
<p class="admonition-title">Warning</p>
<p><cite>value</cite> is a descriptor. Setting its value will actually CHANGE THE IAT ENTRY, resulting in a segfault if no VirtualProtect have been done.</p>
</div>
<div class="admonition note">
<p class="admonition-title">Note</p>
<p>See: <a class="reference internal" href="utils.html#windows.utils.VirtualProtected" title="windows.utils.VirtualProtected"><code class="xref py py-class docutils literal notranslate"><span class="pre">windows.utils.VirtualProtected</span></code></a></p>
</div>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.pe_parse.IATEntry.remove_hook">
<span class="sig-name descname"><span class="pre">remove_hook</span></span><span class="sig-paren">(</span><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/pe_parse.html#IATEntry.remove_hook"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.pe_parse.IATEntry.remove_hook" title="Link to this definition"></a></dt>
<dd><p>Remove the hook on the entry</p>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.pe_parse.IATEntry.set_hook">
<span class="sig-name descname"><span class="pre">set_hook</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">callback</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">types</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">None</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/pe_parse.html#IATEntry.set_hook"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.pe_parse.IATEntry.set_hook" title="Link to this definition"></a></dt>
<dd><p>Setup a hook on the entry and return it.
You MUST keep a reference to the hook while the hook is enabled.</p>
<dl class="field-list simple">
<dt class="field-odd">Parameters<span class="colon">:</span></dt>
<dd class="field-odd"><p><strong>callback</strong> – <p>the hook</p>
<div class="admonition note">
<p class="admonition-title">Note</p>
<p>see <a class="reference internal" href="iat_hook.html#hook-protocol"><span class="std std-ref">Hook protocol</span></a></p>
</div>
</p>
</dd>
<dt class="field-even">Return type<span class="colon">:</span></dt>
<dd class="field-even"><p><a class="reference internal" href="iat_hook.html#windows.hooks.IATHook" title="windows.hooks.IATHook"><code class="xref py py-class docutils literal notranslate"><span class="pre">windows.hooks.IATHook</span></code></a></p>
</dd>
</dl>
<div class="admonition warning">
<p class="admonition-title">Warning</p>
<p>This works only for PEFile with the current process as target.</p>
</div>
</dd></dl>
</dd></dl>
</section>
</section>
</section>
<div class="clearer"></div>
</div>
</div>
</div>
<div class="sphinxsidebar" role="navigation" aria-label="main navigation">
<div class="sphinxsidebarwrapper">
<div>
<h3><a href="index.html">Table of Contents</a></h3>
<ul>
<li><a class="reference internal" href="#">2.1. Processes and Threads</a><ul>
<li><a class="reference internal" href="#currentprocess">2.1.1. CurrentProcess</a><ul>
<li><a class="reference internal" href="#windows.winobject.process.CurrentProcess"><code class="docutils literal notranslate"><span class="pre">CurrentProcess</span></code></a><ul>
<li><a class="reference internal" href="#windows.winobject.process.CurrentProcess.allocated_memory"><code class="docutils literal notranslate"><span class="pre">allocated_memory()</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.CurrentProcess.bitness"><code class="docutils literal notranslate"><span class="pre">bitness</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.CurrentProcess.create_thread"><code class="docutils literal notranslate"><span class="pre">create_thread()</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.CurrentProcess.execute"><code class="docutils literal notranslate"><span class="pre">execute()</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.CurrentProcess.exit"><code class="docutils literal notranslate"><span class="pre">exit()</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.CurrentProcess.exit_code"><code class="docutils literal notranslate"><span class="pre">exit_code</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.CurrentProcess.get_mapped_filename"><code class="docutils literal notranslate"><span class="pre">get_mapped_filename()</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.CurrentProcess.handle"><code class="docutils literal notranslate"><span class="pre">handle</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.CurrentProcess.is_exit"><code class="docutils literal notranslate"><span class="pre">is_exit</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.CurrentProcess.is_wow_64"><code class="docutils literal notranslate"><span class="pre">is_wow_64</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.CurrentProcess.load_library"><code class="docutils literal notranslate"><span class="pre">load_library()</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.CurrentProcess.memory_state"><code class="docutils literal notranslate"><span class="pre">memory_state()</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.CurrentProcess.open_token"><code class="docutils literal notranslate"><span class="pre">open_token()</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.CurrentProcess.peb"><code class="docutils literal notranslate"><span class="pre">peb</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.CurrentProcess.peb_syswow"><code class="docutils literal notranslate"><span class="pre">peb_syswow</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.CurrentProcess.pid"><code class="docutils literal notranslate"><span class="pre">pid</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.CurrentProcess.ppid"><code class="docutils literal notranslate"><span class="pre">ppid</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.CurrentProcess.priority"><code class="docutils literal notranslate"><span class="pre">priority</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.CurrentProcess.query_memory"><code class="docutils literal notranslate"><span class="pre">query_memory()</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.CurrentProcess.read_byte"><code class="docutils literal notranslate"><span class="pre">read_byte()</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.CurrentProcess.read_dword"><code class="docutils literal notranslate"><span class="pre">read_dword()</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.CurrentProcess.read_memory"><code class="docutils literal notranslate"><span class="pre">read_memory()</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.CurrentProcess.read_ptr"><code class="docutils literal notranslate"><span class="pre">read_ptr()</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.CurrentProcess.read_qword"><code class="docutils literal notranslate"><span class="pre">read_qword()</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.CurrentProcess.read_short"><code class="docutils literal notranslate"><span class="pre">read_short()</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.CurrentProcess.read_string"><code class="docutils literal notranslate"><span class="pre">read_string()</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.CurrentProcess.read_wstring"><code class="docutils literal notranslate"><span class="pre">read_wstring()</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.CurrentProcess.threads"><code class="docutils literal notranslate"><span class="pre">threads</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.CurrentProcess.time_info"><code class="docutils literal notranslate"><span class="pre">time_info</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.CurrentProcess.token"><code class="docutils literal notranslate"><span class="pre">token</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.CurrentProcess.virtual_alloc"><code class="docutils literal notranslate"><span class="pre">virtual_alloc()</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.CurrentProcess.virtual_free"><code class="docutils literal notranslate"><span class="pre">virtual_free()</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.CurrentProcess.virtual_protect"><code class="docutils literal notranslate"><span class="pre">virtual_protect()</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.CurrentProcess.virtual_protected"><code class="docutils literal notranslate"><span class="pre">virtual_protected()</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.CurrentProcess.wait"><code class="docutils literal notranslate"><span class="pre">wait()</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.CurrentProcess.write_byte"><code class="docutils literal notranslate"><span class="pre">write_byte()</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.CurrentProcess.write_dword"><code class="docutils literal notranslate"><span class="pre">write_dword()</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.CurrentProcess.write_memory"><code class="docutils literal notranslate"><span class="pre">write_memory()</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.CurrentProcess.write_ptr"><code class="docutils literal notranslate"><span class="pre">write_ptr()</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.CurrentProcess.write_qword"><code class="docutils literal notranslate"><span class="pre">write_qword()</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.CurrentProcess.write_short"><code class="docutils literal notranslate"><span class="pre">write_short()</span></code></a></li>
</ul>
</li>
</ul>
</li>
<li><a class="reference internal" href="#currentthread">2.1.2. CurrentThread</a><ul>
<li><a class="reference internal" href="#windows.winobject.process.CurrentThread"><code class="docutils literal notranslate"><span class="pre">CurrentThread</span></code></a><ul>
<li><a class="reference internal" href="#windows.winobject.process.CurrentThread.exit"><code class="docutils literal notranslate"><span class="pre">exit()</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.CurrentThread.handle"><code class="docutils literal notranslate"><span class="pre">handle</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.CurrentThread.open_token"><code class="docutils literal notranslate"><span class="pre">open_token()</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.CurrentThread.owner"><code class="docutils literal notranslate"><span class="pre">owner</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.CurrentThread.set_token"><code class="docutils literal notranslate"><span class="pre">set_token()</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.CurrentThread.tid"><code class="docutils literal notranslate"><span class="pre">tid</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.CurrentThread.token"><code class="docutils literal notranslate"><span class="pre">token</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.CurrentThread.wait"><code class="docutils literal notranslate"><span class="pre">wait()</span></code></a></li>
</ul>
</li>
</ul>
</li>
<li><a class="reference internal" href="#winprocess">2.1.3. WinProcess</a><ul>
<li><a class="reference internal" href="#windows.winobject.process.WinProcess"><code class="docutils literal notranslate"><span class="pre">WinProcess</span></code></a><ul>
<li><a class="reference internal" href="#windows.winobject.process.WinProcess.allocated_memory"><code class="docutils literal notranslate"><span class="pre">allocated_memory()</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.WinProcess.bitness"><code class="docutils literal notranslate"><span class="pre">bitness</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.WinProcess.create_thread"><code class="docutils literal notranslate"><span class="pre">create_thread()</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.WinProcess.execute"><code class="docutils literal notranslate"><span class="pre">execute()</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.WinProcess.execute_python"><code class="docutils literal notranslate"><span class="pre">execute_python()</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.WinProcess.execute_python_unsafe"><code class="docutils literal notranslate"><span class="pre">execute_python_unsafe()</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.WinProcess.exit"><code class="docutils literal notranslate"><span class="pre">exit()</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.WinProcess.exit_code"><code class="docutils literal notranslate"><span class="pre">exit_code</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.WinProcess.get_mapped_filename"><code class="docutils literal notranslate"><span class="pre">get_mapped_filename()</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.WinProcess.handle"><code class="docutils literal notranslate"><span class="pre">handle</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.WinProcess.is_exit"><code class="docutils literal notranslate"><span class="pre">is_exit</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.WinProcess.is_wow_64"><code class="docutils literal notranslate"><span class="pre">is_wow_64</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.WinProcess.load_library"><code class="docutils literal notranslate"><span class="pre">load_library()</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.WinProcess.memory_state"><code class="docutils literal notranslate"><span class="pre">memory_state()</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.WinProcess.name"><code class="docutils literal notranslate"><span class="pre">name</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.WinProcess.open_token"><code class="docutils literal notranslate"><span class="pre">open_token()</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.WinProcess.peb"><code class="docutils literal notranslate"><span class="pre">peb</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.WinProcess.peb_addr"><code class="docutils literal notranslate"><span class="pre">peb_addr</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.WinProcess.peb_syswow"><code class="docutils literal notranslate"><span class="pre">peb_syswow</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.WinProcess.pid"><code class="docutils literal notranslate"><span class="pre">pid</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.WinProcess.ppid"><code class="docutils literal notranslate"><span class="pre">ppid</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.WinProcess.priority"><code class="docutils literal notranslate"><span class="pre">priority</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.WinProcess.query_memory"><code class="docutils literal notranslate"><span class="pre">query_memory()</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.WinProcess.read_byte"><code class="docutils literal notranslate"><span class="pre">read_byte()</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.WinProcess.read_dword"><code class="docutils literal notranslate"><span class="pre">read_dword()</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.WinProcess.read_memory"><code class="docutils literal notranslate"><span class="pre">read_memory()</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.WinProcess.read_memory_into"><code class="docutils literal notranslate"><span class="pre">read_memory_into()</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.WinProcess.read_ptr"><code class="docutils literal notranslate"><span class="pre">read_ptr()</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.WinProcess.read_qword"><code class="docutils literal notranslate"><span class="pre">read_qword()</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.WinProcess.read_short"><code class="docutils literal notranslate"><span class="pre">read_short()</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.WinProcess.read_string"><code class="docutils literal notranslate"><span class="pre">read_string()</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.WinProcess.read_wstring"><code class="docutils literal notranslate"><span class="pre">read_wstring()</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.WinProcess.threads"><code class="docutils literal notranslate"><span class="pre">threads</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.WinProcess.time_info"><code class="docutils literal notranslate"><span class="pre">time_info</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.WinProcess.token"><code class="docutils literal notranslate"><span class="pre">token</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.WinProcess.virtual_alloc"><code class="docutils literal notranslate"><span class="pre">virtual_alloc()</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.WinProcess.virtual_free"><code class="docutils literal notranslate"><span class="pre">virtual_free()</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.WinProcess.virtual_protect"><code class="docutils literal notranslate"><span class="pre">virtual_protect()</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.WinProcess.virtual_protected"><code class="docutils literal notranslate"><span class="pre">virtual_protected()</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.WinProcess.wait"><code class="docutils literal notranslate"><span class="pre">wait()</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.WinProcess.write_byte"><code class="docutils literal notranslate"><span class="pre">write_byte()</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.WinProcess.write_dword"><code class="docutils literal notranslate"><span class="pre">write_dword()</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.WinProcess.write_memory"><code class="docutils literal notranslate"><span class="pre">write_memory()</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.WinProcess.write_ptr"><code class="docutils literal notranslate"><span class="pre">write_ptr()</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.WinProcess.write_qword"><code class="docutils literal notranslate"><span class="pre">write_qword()</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.WinProcess.write_short"><code class="docutils literal notranslate"><span class="pre">write_short()</span></code></a></li>
</ul>
</li>
</ul>
</li>
<li><a class="reference internal" href="#winthread">2.1.4. WinThread</a><ul>
<li><a class="reference internal" href="#windows.winobject.process.WinThread"><code class="docutils literal notranslate"><span class="pre">WinThread</span></code></a><ul>
<li><a class="reference internal" href="#windows.winobject.process.WinThread.context"><code class="docutils literal notranslate"><span class="pre">context</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.WinThread.context_syswow"><code class="docutils literal notranslate"><span class="pre">context_syswow</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.WinThread.exit"><code class="docutils literal notranslate"><span class="pre">exit()</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.WinThread.exit_code"><code class="docutils literal notranslate"><span class="pre">exit_code</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.WinThread.handle"><code class="docutils literal notranslate"><span class="pre">handle</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.WinThread.is_exit"><code class="docutils literal notranslate"><span class="pre">is_exit</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.WinThread.open_token"><code class="docutils literal notranslate"><span class="pre">open_token()</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.WinThread.owner"><code class="docutils literal notranslate"><span class="pre">owner</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.WinThread.resume"><code class="docutils literal notranslate"><span class="pre">resume()</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.WinThread.set_context"><code class="docutils literal notranslate"><span class="pre">set_context()</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.WinThread.set_syswow_context"><code class="docutils literal notranslate"><span class="pre">set_syswow_context()</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.WinThread.set_token"><code class="docutils literal notranslate"><span class="pre">set_token()</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.WinThread.start_address"><code class="docutils literal notranslate"><span class="pre">start_address</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.WinThread.suspend"><code class="docutils literal notranslate"><span class="pre">suspend()</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.WinThread.teb_base"><code class="docutils literal notranslate"><span class="pre">teb_base</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.WinThread.teb_syswow_base"><code class="docutils literal notranslate"><span class="pre">teb_syswow_base</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.WinThread.tid"><code class="docutils literal notranslate"><span class="pre">tid</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.WinThread.token"><code class="docutils literal notranslate"><span class="pre">token</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.WinThread.wait"><code class="docutils literal notranslate"><span class="pre">wait()</span></code></a></li>
</ul>
</li>
<li><a class="reference internal" href="#windows.winobject.process.DeadThread"><code class="docutils literal notranslate"><span class="pre">DeadThread</span></code></a><ul>
<li><a class="reference internal" href="#windows.winobject.process.DeadThread.exit_code"><code class="docutils literal notranslate"><span class="pre">exit_code</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.DeadThread.handle"><code class="docutils literal notranslate"><span class="pre">handle</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.DeadThread.is_exit"><code class="docutils literal notranslate"><span class="pre">is_exit</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.DeadThread.wait"><code class="docutils literal notranslate"><span class="pre">wait()</span></code></a></li>
</ul>
</li>
</ul>
</li>
</ul>
</li>
<li><a class="reference internal" href="#peb-exploration">2.2. PEB Exploration</a><ul>
<li><a class="reference internal" href="#peb">2.2.1. PEB</a><ul>
<li><a class="reference internal" href="#windows.winobject.process.PEB"><code class="docutils literal notranslate"><span class="pre">PEB</span></code></a><ul>
<li><a class="reference internal" href="#windows.winobject.process.PEB.apisetmap"><code class="docutils literal notranslate"><span class="pre">apisetmap</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.PEB.commandline"><code class="docutils literal notranslate"><span class="pre">commandline</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.PEB.exe"><code class="docutils literal notranslate"><span class="pre">exe</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.PEB.imagepath"><code class="docutils literal notranslate"><span class="pre">imagepath</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.PEB.modules"><code class="docutils literal notranslate"><span class="pre">modules</span></code></a></li>
</ul>
</li>
</ul>
</li>
<li><a class="reference internal" href="#loadedmodule">2.2.2. LoadedModule</a><ul>
<li><a class="reference internal" href="#windows.winobject.process.LoadedModule"><code class="docutils literal notranslate"><span class="pre">LoadedModule</span></code></a><ul>
<li><a class="reference internal" href="#windows.winobject.process.LoadedModule.baseaddr"><code class="docutils literal notranslate"><span class="pre">baseaddr</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.LoadedModule.fullname"><code class="docutils literal notranslate"><span class="pre">fullname</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.LoadedModule.name"><code class="docutils literal notranslate"><span class="pre">name</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.process.LoadedModule.pe"><code class="docutils literal notranslate"><span class="pre">pe</span></code></a></li>
</ul>
</li>
</ul>
</li>
<li><a class="reference internal" href="#apisetmap">2.2.3. ApiSetMap</a><ul>
<li><a class="reference internal" href="#windows.winobject.apisetmap.ApiSetMap"><code class="docutils literal notranslate"><span class="pre">ApiSetMap</span></code></a><ul>
<li><a class="reference internal" href="#windows.winobject.apisetmap.ApiSetMap.apisetmap_dict"><code class="docutils literal notranslate"><span class="pre">apisetmap_dict</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.apisetmap.ApiSetMap.resolution_dict"><code class="docutils literal notranslate"><span class="pre">resolution_dict</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.apisetmap.ApiSetMap.resolve"><code class="docutils literal notranslate"><span class="pre">resolve()</span></code></a></li>
<li><a class="reference internal" href="#windows.winobject.apisetmap.ApiSetMap.version"><code class="docutils literal notranslate"><span class="pre">version</span></code></a></li>
</ul>
</li>
<li><a class="reference internal" href="#windows.winobject.apisetmap.ApiSetMapVersion2"><code class="docutils literal notranslate"><span class="pre">ApiSetMapVersion2</span></code></a><ul>
<li><a class="reference internal" href="#windows.winobject.apisetmap.ApiSetMapVersion2.version"><code class="docutils literal notranslate"><span class="pre">version</span></code></a></li>
</ul>
</li>
<li><a class="reference internal" href="#windows.winobject.apisetmap.ApiSetMapVersion4"><code class="docutils literal notranslate"><span class="pre">ApiSetMapVersion4</span></code></a><ul>
<li><a class="reference internal" href="#windows.winobject.apisetmap.ApiSetMapVersion4.version"><code class="docutils literal notranslate"><span class="pre">version</span></code></a></li>
</ul>
</li>
<li><a class="reference internal" href="#windows.winobject.apisetmap.ApiSetMapVersion6"><code class="docutils literal notranslate"><span class="pre">ApiSetMapVersion6</span></code></a><ul>
<li><a class="reference internal" href="#windows.winobject.apisetmap.ApiSetMapVersion6.version"><code class="docutils literal notranslate"><span class="pre">version</span></code></a></li>
</ul>
</li>
</ul>
</li>
</ul>
</li>
<li><a class="reference internal" href="#pefile-parsing-loaded-pe">2.3. PEFile - Parsing loaded PE</a><ul>
<li><a class="reference internal" href="#module-windows.pe_parse">2.3.1. <code class="xref py py-mod docutils literal notranslate"><span class="pre">windows.pe_parse</span></code></a><ul>
<li><a class="reference internal" href="#windows.pe_parse.GetPEFile"><code class="docutils literal notranslate"><span class="pre">GetPEFile()</span></code></a></li>
<li><a class="reference internal" href="#pefile">2.3.1.1. PEFile</a><ul>
<li><a class="reference internal" href="#windows.pe_parse.PEFile"><code class="docutils literal notranslate"><span class="pre">PEFile</span></code></a><ul>
<li><a class="reference internal" href="#windows.pe_parse.PEFile.export_name"><code class="docutils literal notranslate"><span class="pre">export_name</span></code></a></li>
<li><a class="reference internal" href="#windows.pe_parse.PEFile.exports"><code class="docutils literal notranslate"><span class="pre">exports</span></code></a></li>
<li><a class="reference internal" href="#windows.pe_parse.PEFile.imports"><code class="docutils literal notranslate"><span class="pre">imports</span></code></a></li>
</ul>
</li>
</ul>
</li>
<li><a class="reference internal" href="#iatentry">2.3.1.2. IATEntry</a><ul>
<li><a class="reference internal" href="#windows.pe_parse.IATEntry"><code class="docutils literal notranslate"><span class="pre">IATEntry</span></code></a><ul>
<li><a class="reference internal" href="#windows.pe_parse.IATEntry.addr"><code class="docutils literal notranslate"><span class="pre">addr</span></code></a></li>
<li><a class="reference internal" href="#windows.pe_parse.IATEntry.ord"><code class="docutils literal notranslate"><span class="pre">ord</span></code></a></li>
<li><a class="reference internal" href="#windows.pe_parse.IATEntry.name"><code class="docutils literal notranslate"><span class="pre">name</span></code></a></li>
<li><a class="reference internal" href="#windows.pe_parse.IATEntry.value"><code class="docutils literal notranslate"><span class="pre">value</span></code></a></li>
<li><a class="reference internal" href="#windows.pe_parse.IATEntry.remove_hook"><code class="docutils literal notranslate"><span class="pre">remove_hook()</span></code></a></li>
<li><a class="reference internal" href="#windows.pe_parse.IATEntry.set_hook"><code class="docutils literal notranslate"><span class="pre">set_hook()</span></code></a></li>
</ul>
</li>
</ul>
</li>
</ul>
</li>
</ul>
</li>
</ul>
</div>
<div>
<h4>Previous topic</h4>
<p class="topless"><a href="winobject.html"
title="previous chapter"><span class="section-number">2. </span>The <code class="xref py py-mod docutils literal notranslate"><span class="pre">windows</span></code> objects</a></p>
</div>
<div>
<h4>Next topic</h4>
<p class="topless"><a href="token.html"
title="next chapter"><span class="section-number">2.4. </span>Token</a></p>
</div>
<div role="note" aria-label="source link">
<h3>This Page</h3>
<ul class="this-page-menu">
<li><a href="_sources/process.rst.txt"
rel="nofollow">Show Source</a></li>
</ul>
</div>
<search id="searchbox" style="display: none" role="search">
<h3 id="searchlabel">Quick search</h3>
<div class="searchformwrapper">
<form class="search" action="search.html" method="get">
<input type="text" name="q" aria-labelledby="searchlabel" autocomplete="off" autocorrect="off" autocapitalize="off" spellcheck="false"/>
<input type="submit" value="Go" />
</form>
</div>
</search>
<script>document.getElementById('searchbox').style.display = "block"</script>
</div>
</div>
<div class="clearer"></div>
</div>
<div class="related" role="navigation" aria-label="related navigation">
<h3>Navigation</h3>
<ul>
<li class="right" style="margin-right: 10px">
<a href="genindex.html" title="General Index"
>index</a></li>
<li class="right" >
<a href="py-modindex.html" title="Python Module Index"
>modules</a> |</li>
<li class="right" >
<a href="token.html" title="2.4. Token"
>next</a> |</li>
<li class="right" >
<a href="winobject.html" title="2. The windows objects"
>previous</a> |</li>
<li class="nav-item nav-item-0"><a href="index.html">PythonForWindows 1.0.0 documentation</a> &#187;</li>
<li class="nav-item nav-item-1"><a href="winobject.html" ><span class="section-number">2. </span>The <code class="xref py py-mod docutils literal notranslate"><span class="pre">windows</span></code> objects</a> &#187;</li>
<li class="nav-item nav-item-this"><a href=""><span class="section-number">2.1. </span>Processes and Threads</a></li>
</ul>
</div>
<div class="footer" role="contentinfo">
&#169; Copyright 2015-2020, Clement Rouault.
Created using <a href="https://www.sphinx-doc.org/">Sphinx</a> 7.3.7.
</div>
</body>
</html>
Reference in New Issue View Git Blame Copy Permalink