admin/hakril-PythonForWindows
1
0
Fork 0
mirror of https://github.com/hakril/PythonForWindows synced 2026-06-08 14:31:45 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
596ab22f1f9ef920b852298a98549d17c42c8de8
hakril-PythonForWindows/docs/build/html/_modules/windows/winobject/process.html
T
hakril 596ab22f1f Update doc
2025-05-15 09:32:55 +02:00

1844 lines
253 KiB
HTML
Raw Blame History

<!DOCTYPE html>
<html lang="en" data-content_root="../../../">
<head>
<meta charset="utf-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
<title>windows.winobject.process &#8212; PythonForWindows 1.0.3 documentation</title>
<link rel="stylesheet" type="text/css" href="../../../_static/pygments.css?v=fa44fd50" />
<link rel="stylesheet" type="text/css" href="../../../_static/classic.css?v=def86cc0" />
<link rel="stylesheet" type="text/css" href="../../../_static/css/mbasic.css?v=957880af" />
<script src="../../../_static/documentation_options.js?v=baaebd52"></script>
<script src="../../../_static/doctools.js?v=9a2dae69"></script>
<script src="../../../_static/sphinx_highlight.js?v=dc90522c"></script>
<link rel="index" title="Index" href="../../../genindex.html" />
<link rel="search" title="Search" href="../../../search.html" />
</head><body>
<div class="related" role="navigation" aria-label="related navigation">
<h3>Navigation</h3>
<ul>
<li class="right" style="margin-right: 10px">
<a href="../../../genindex.html" title="General Index"
accesskey="I">index</a></li>
<li class="right" >
<a href="../../../py-modindex.html" title="Python Module Index"
>modules</a> |</li>
<li class="nav-item nav-item-0"><a href="../../../index.html">PythonForWindows 1.0.3 documentation</a> &#187;</li>
<li class="nav-item nav-item-1"><a href="../../index.html" accesskey="U">Module code</a> &#187;</li>
<li class="nav-item nav-item-this"><a href="">windows.winobject.process</a></li>
</ul>
</div>
<div class="document">
<div class="documentwrapper">
<div class="bodywrapper">
<div class="body" role="main">
<h1>Source code for windows.winobject.process</h1><div class="highlight"><pre>
<span></span><span class="kn">import</span> <span class="nn">sys</span>
<span class="kn">import</span> <span class="nn">ctypes</span>
<span class="kn">import</span> <span class="nn">os</span>
<span class="kn">import</span> <span class="nn">copy</span>
<span class="kn">import</span> <span class="nn">time</span>
<span class="kn">import</span> <span class="nn">struct</span>
<span class="kn">import</span> <span class="nn">itertools</span>
<span class="kn">from</span> <span class="nn">contextlib</span> <span class="kn">import</span> <span class="n">contextmanager</span>
<span class="kn">from</span> <span class="nn">collections</span> <span class="kn">import</span> <span class="n">namedtuple</span>
<span class="kn">import</span> <span class="nn">windows</span>
<span class="kn">import</span> <span class="nn">windows.native_exec.simple_x86</span> <span class="k">as</span> <span class="nn">x86</span>
<span class="kn">import</span> <span class="nn">windows.native_exec.simple_x64</span> <span class="k">as</span> <span class="nn">x64</span>
<span class="kn">import</span> <span class="nn">windows.native_exec.simple_arm64</span> <span class="k">as</span> <span class="nn">arm64</span>
<span class="kn">import</span> <span class="nn">windows.remotectypes</span> <span class="k">as</span> <span class="nn">rctypes</span>
<span class="kn">import</span> <span class="nn">windows.generated_def</span> <span class="k">as</span> <span class="nn">gdef</span>
<span class="kn">from</span> <span class="nn">windows</span> <span class="kn">import</span> <span class="n">injection</span>
<span class="kn">from</span> <span class="nn">windows</span> <span class="kn">import</span> <span class="n">native_exec</span>
<span class="kn">from</span> <span class="nn">windows</span> <span class="kn">import</span> <span class="n">pe_parse</span>
<span class="kn">from</span> <span class="nn">windows</span> <span class="kn">import</span> <span class="n">winproxy</span>
<span class="kn">from</span> <span class="nn">windows</span> <span class="kn">import</span> <span class="n">utils</span>
<span class="kn">from</span> <span class="nn">windows.dbgprint</span> <span class="kn">import</span> <span class="n">dbgprint</span>
<span class="kn">from</span> <span class="nn">windows.generated_def.winstructs</span> <span class="kn">import</span> <span class="o">*</span>
<span class="kn">from</span> <span class="nn">windows.generated_def.ntstatus</span> <span class="kn">import</span> <span class="n">NtStatusException</span>
<span class="kn">from</span> <span class="nn">windows.winobject</span> <span class="kn">import</span> <span class="n">exception</span>
<span class="kn">from</span> <span class="nn">windows.winobject</span> <span class="kn">import</span> <span class="n">apisetmap</span>
<span class="kn">from</span> <span class="nn">windows.winobject</span> <span class="kn">import</span> <span class="n">token</span>
<span class="kn">from</span> <span class="nn">windows</span> <span class="kn">import</span> <span class="n">security</span>
<span class="kn">from</span> <span class="nn">windows.pycompat</span> <span class="kn">import</span> <span class="n">raw_encode</span><span class="p">,</span> <span class="n">raw_decode</span><span class="p">,</span> <span class="n">basestring</span><span class="p">,</span> <span class="n">urepr_encode</span>
<span class="n">TimeInfo</span> <span class="o">=</span> <span class="n">namedtuple</span><span class="p">(</span><span class="s2">&quot;TimeInfo&quot;</span><span class="p">,</span> <span class="p">[</span><span class="s2">&quot;creation&quot;</span><span class="p">,</span> <span class="s2">&quot;exit&quot;</span><span class="p">,</span> <span class="s2">&quot;kernel&quot;</span><span class="p">,</span> <span class="s2">&quot;user&quot;</span><span class="p">])</span>
<span class="sd">&quot;&quot;&quot;Time information about a process&quot;&quot;&quot;</span>
<div class="viewcode-block" id="DeadThread">
<a class="viewcode-back" href="../../../process.html#windows.winobject.process.DeadThread">[docs]</a>
<span class="k">class</span> <span class="nc">DeadThread</span><span class="p">(</span><span class="n">utils</span><span class="o">.</span><span class="n">AutoHandle</span><span class="p">):</span>
<span class="w"> </span><span class="sd">&quot;&quot;&quot;An already dead thread (returned only by API returning a new thread if thread die before being returned)&quot;&quot;&quot;</span>
<span class="k">def</span> <span class="fm">__init__</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">handle</span><span class="p">,</span> <span class="n">tid</span><span class="o">=</span><span class="kc">None</span><span class="p">):</span>
<span class="k">if</span> <span class="n">tid</span> <span class="ow">is</span> <span class="kc">None</span><span class="p">:</span>
<span class="n">tid</span> <span class="o">=</span> <span class="n">WinThread</span><span class="o">.</span><span class="n">_get_thread_id</span><span class="p">(</span><span class="n">handle</span><span class="p">)</span>
<span class="bp">self</span><span class="o">.</span><span class="n">tid</span> <span class="o">=</span> <span class="n">tid</span>
<span class="c1"># set AutoHandle _handle</span>
<span class="bp">self</span><span class="o">.</span><span class="n">_handle</span> <span class="o">=</span> <span class="n">handle</span>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">is_exit</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="w"> </span><span class="sd">&quot;&quot;&quot;``True`` if the thread is terminated</span>
<span class="sd"> :type: :class:`bool`</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">exit_code</span> <span class="o">!=</span> <span class="n">STILL_ACTIVE</span>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">exit_code</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="w"> </span><span class="sd">&quot;&quot;&quot;The exit code of the thread : ``STILL_ACTIVE`` means the process is not dead</span>
<span class="sd"> :type: :class:`int`</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="n">res</span> <span class="o">=</span> <span class="n">DWORD</span><span class="p">()</span>
<span class="n">winproxy</span><span class="o">.</span><span class="n">GetExitCodeThread</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">byref</span><span class="p">(</span><span class="n">res</span><span class="p">))</span>
<span class="k">return</span> <span class="n">res</span><span class="o">.</span><span class="n">value</span></div>
<span class="k">class</span> <span class="nc">Process</span><span class="p">(</span><span class="n">utils</span><span class="o">.</span><span class="n">AutoHandle</span><span class="p">):</span>
<span class="nd">@utils</span><span class="o">.</span><span class="n">fixedproperty</span>
<span class="k">def</span> <span class="nf">is_wow_64</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="w"> </span><span class="sd">&quot;&quot;&quot;``True`` if the process is a SysWow64 process (32bit process on 64bits system).</span>
<span class="sd"> :type: :class:`bool`</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="k">if</span> <span class="ow">not</span> <span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">is_implemented</span><span class="p">(</span><span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">IsWow64Process</span><span class="p">):</span>
<span class="k">return</span> <span class="kc">False</span>
<span class="n">Wow64Process</span> <span class="o">=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">BOOL</span><span class="p">()</span>
<span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">IsWow64Process</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">Wow64Process</span><span class="p">)</span>
<span class="k">return</span> <span class="nb">bool</span><span class="p">(</span><span class="n">Wow64Process</span><span class="p">)</span>
<span class="nd">@utils</span><span class="o">.</span><span class="n">fixedproperty</span>
<span class="k">def</span> <span class="nf">is_wow_64_2</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="k">if</span> <span class="ow">not</span> <span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">is_implemented</span><span class="p">(</span><span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">IsWow64Process2</span><span class="p">):</span>
<span class="k">return</span> <span class="kc">None</span><span class="p">,</span> <span class="kc">None</span>
<span class="n">processMachine</span> <span class="o">=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">USHORT</span><span class="p">()</span>
<span class="n">nativeMachine</span> <span class="o">=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">USHORT</span><span class="p">()</span>
<span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">IsWow64Process2</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">processMachine</span><span class="p">,</span> <span class="n">nativeMachine</span><span class="p">)</span>
<span class="k">return</span> <span class="p">(</span><span class="n">gdef</span><span class="o">.</span><span class="n">IMAGE_FILE_MACHINE_MAPPER</span><span class="p">[</span><span class="n">processMachine</span><span class="o">.</span><span class="n">value</span><span class="p">],</span>
<span class="n">gdef</span><span class="o">.</span><span class="n">IMAGE_FILE_MACHINE_MAPPER</span><span class="p">[</span><span class="n">nativeMachine</span><span class="o">.</span><span class="n">value</span><span class="p">])</span>
<span class="nd">@utils</span><span class="o">.</span><span class="n">fixedproperty</span>
<span class="k">def</span> <span class="nf">bitness</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="w"> </span><span class="sd">&quot;&quot;&quot;The bitness of the process</span>
<span class="sd"> :returns: :class:`int` -- 32 or 64</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">system</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">32</span> <span class="ow">or</span> <span class="bp">self</span><span class="o">.</span><span class="n">is_wow_64</span><span class="p">:</span>
<span class="k">return</span> <span class="mi">32</span>
<span class="k">return</span> <span class="mi">64</span>
<span class="nd">@utils</span><span class="o">.</span><span class="n">fixedproperty</span>
<span class="k">def</span> <span class="nf">architecture</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="c1"># Syswow2 will exactly tell us the architecture</span>
<span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">is_implemented</span><span class="p">(</span><span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">IsWow64Process2</span><span class="p">):</span>
<span class="n">process_machine</span><span class="p">,</span> <span class="n">native_machine</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">is_wow_64_2</span>
<span class="k">if</span> <span class="n">process_machine</span> <span class="o">!=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">IMAGE_FILE_MACHINE_UNKNOWN</span><span class="p">:</span>
<span class="k">return</span> <span class="n">process_machine</span>
<span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">system</span><span class="o">.</span><span class="n">architecture</span> <span class="o">==</span> <span class="n">gdef</span><span class="o">.</span><span class="n">PROCESSOR_ARCHITECTURE_ARM64</span><span class="p">:</span>
<span class="c1"># May be ARM64 or AMD64 as X64TA64 is not considered WOW64</span>
<span class="c1"># ProcessMachineTypeInfo is from build 22000</span>
<span class="c1"># What if not implemented ? parse target main binary PE ?</span>
<span class="n">machine_archi</span> <span class="o">=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">PROCESS_MACHINE_INFORMATION</span><span class="p">()</span>
<span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">GetProcessInformation</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">gdef</span><span class="o">.</span><span class="n">ProcessMachineTypeInfo</span><span class="p">,</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">byref</span><span class="p">(</span><span class="n">machine_archi</span><span class="p">),</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">machine_archi</span><span class="p">))</span>
<span class="k">return</span> <span class="n">gdef</span><span class="o">.</span><span class="n">IMAGE_FILE_MACHINE_MAPPER</span><span class="p">[</span><span class="n">machine_archi</span><span class="o">.</span><span class="n">ProcessMachine</span><span class="p">]</span>
<span class="c1"># No IsWow64Process2 -&gt; No ARM</span>
<span class="c1"># So its up on x86 -&gt; x64 based on process bitness</span>
<span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">32</span><span class="p">:</span>
<span class="k">return</span> <span class="n">gdef</span><span class="o">.</span><span class="n">IMAGE_FILE_MACHINE_I386</span>
<span class="k">return</span> <span class="n">gdef</span><span class="o">.</span><span class="n">IMAGE_FILE_MACHINE_AMD64</span>
<span class="nd">@utils</span><span class="o">.</span><span class="n">fixedproperty</span>
<span class="k">def</span> <span class="nf">_is_x86_on_arm64</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="k">return</span> <span class="p">(</span><span class="n">windows</span><span class="o">.</span><span class="n">system</span><span class="o">.</span><span class="n">architecture</span> <span class="o">==</span> <span class="n">gdef</span><span class="o">.</span><span class="n">PROCESSOR_ARCHITECTURE_ARM64</span> <span class="ow">and</span>
<span class="bp">self</span><span class="o">.</span><span class="n">architecture</span> <span class="o">==</span> <span class="n">gdef</span><span class="o">.</span><span class="n">IMAGE_FILE_MACHINE_I386</span><span class="p">)</span>
<span class="nd">@utils</span><span class="o">.</span><span class="n">fixedproperty</span>
<span class="k">def</span> <span class="nf">_is_x86_on_x64</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="k">return</span> <span class="p">(</span><span class="n">windows</span><span class="o">.</span><span class="n">system</span><span class="o">.</span><span class="n">architecture</span> <span class="o">==</span> <span class="n">gdef</span><span class="o">.</span><span class="n">PROCESSOR_ARCHITECTURE_AMD64</span> <span class="ow">and</span>
<span class="bp">self</span><span class="o">.</span><span class="n">architecture</span> <span class="o">==</span> <span class="n">gdef</span><span class="o">.</span><span class="n">IMAGE_FILE_MACHINE_I386</span><span class="p">)</span>
<span class="nd">@utils</span><span class="o">.</span><span class="n">fixedproperty</span>
<span class="k">def</span> <span class="nf">_is_native_architecture</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="k">return</span> <span class="p">((</span><span class="n">windows</span><span class="o">.</span><span class="n">system</span><span class="o">.</span><span class="n">architecture</span> <span class="o">==</span> <span class="n">gdef</span><span class="o">.</span><span class="n">PROCESSOR_ARCHITECTURE_INTEL</span> <span class="ow">and</span>
<span class="bp">self</span><span class="o">.</span><span class="n">architecture</span> <span class="o">==</span> <span class="n">gdef</span><span class="o">.</span><span class="n">IMAGE_FILE_MACHINE_I386</span><span class="p">)</span> <span class="ow">or</span>
<span class="p">(</span><span class="n">windows</span><span class="o">.</span><span class="n">system</span><span class="o">.</span><span class="n">architecture</span> <span class="o">==</span> <span class="n">gdef</span><span class="o">.</span><span class="n">PROCESSOR_ARCHITECTURE_AMD64</span> <span class="ow">and</span>
<span class="bp">self</span><span class="o">.</span><span class="n">architecture</span> <span class="o">==</span> <span class="n">gdef</span><span class="o">.</span><span class="n">IMAGE_FILE_MACHINE_AMD64</span><span class="p">)</span> <span class="ow">or</span>
<span class="p">(</span><span class="n">windows</span><span class="o">.</span><span class="n">system</span><span class="o">.</span><span class="n">architecture</span> <span class="o">==</span> <span class="n">gdef</span><span class="o">.</span><span class="n">PROCESSOR_ARCHITECTURE_ARM64</span> <span class="ow">and</span>
<span class="bp">self</span><span class="o">.</span><span class="n">architecture</span> <span class="o">==</span> <span class="n">gdef</span><span class="o">.</span><span class="n">IMAGE_FILE_MACHINE_ARM64</span><span class="p">))</span>
<span class="nd">@utils</span><span class="o">.</span><span class="n">fixedpropety</span>
<span class="k">def</span> <span class="nf">limited_handle</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">system</span><span class="o">.</span><span class="n">version</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span> <span class="o">&lt;=</span> <span class="mi">5</span><span class="p">:</span>
<span class="c1"># Windows XP | Serveur 2003</span>
<span class="k">return</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">OpenProcess</span><span class="p">(</span><span class="n">PROCESS_QUERY_INFORMATION</span><span class="p">,</span> <span class="n">dwProcessId</span><span class="o">=</span><span class="bp">self</span><span class="o">.</span><span class="n">pid</span><span class="p">)</span>
<span class="k">return</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">OpenProcess</span><span class="p">(</span><span class="n">PROCESS_QUERY_LIMITED_INFORMATION</span><span class="p">,</span> <span class="n">dwProcessId</span><span class="o">=</span><span class="bp">self</span><span class="o">.</span><span class="n">pid</span><span class="p">)</span>
<span class="nd">@utils</span><span class="o">.</span><span class="n">fixedproperty</span>
<span class="k">def</span> <span class="nf">name</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="w"> </span><span class="sd">&quot;&quot;&quot;Name of the process</span>
<span class="sd"> :type: :class:`str`</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="n">buffer</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">create_unicode_buffer</span><span class="p">(</span><span class="mh">0x1024</span><span class="p">)</span>
<span class="n">rsize</span> <span class="o">=</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">GetProcessImageFileNameW</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">limited_handle</span><span class="p">,</span> <span class="n">buffer</span><span class="p">)</span>
<span class="c1"># GetProcessImageFileNameW returns the fullpath</span>
<span class="k">return</span> <span class="n">buffer</span><span class="p">[:</span><span class="n">rsize</span><span class="p">]</span><span class="o">.</span><span class="n">split</span><span class="p">(</span><span class="s2">&quot;</span><span class="se">\\</span><span class="s2">&quot;</span><span class="p">)[</span><span class="o">-</span><span class="mi">1</span><span class="p">]</span>
<span class="nd">@utils</span><span class="o">.</span><span class="n">fixedproperty</span>
<span class="k">def</span> <span class="nf">ppid</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="w"> </span><span class="sd">&quot;&quot;&quot;Parent Process ID</span>
<span class="sd"> :type: :class:`int`</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">32</span> <span class="ow">and</span> <span class="bp">self</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">64</span><span class="p">:</span>
<span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">_is_x86_on_arm64</span><span class="p">:</span>
<span class="k">raise</span> <span class="ne">NotImplementedError</span><span class="p">(</span><span class="s2">&quot;Crossing heaven gate x86 -&gt; arm64 not implemented&quot;</span><span class="p">)</span>
<span class="n">xtype</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">remotectypes</span><span class="o">.</span><span class="n">transform_type_to_remote64bits</span><span class="p">(</span><span class="n">PROCESS_BASIC_INFORMATION</span><span class="p">)</span>
<span class="c1"># Fuck-it &lt;3</span>
<span class="n">data</span> <span class="o">=</span> <span class="p">(</span><span class="n">ctypes</span><span class="o">.</span><span class="n">c_char</span> <span class="o">*</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">xtype</span><span class="p">))()</span>
<span class="n">windows</span><span class="o">.</span><span class="n">syswow64</span><span class="o">.</span><span class="n">NtQueryInformationProcess_32_to_64</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">limited_handle</span><span class="p">,</span> <span class="n">ProcessInformation</span><span class="o">=</span><span class="n">data</span><span class="p">,</span> <span class="n">ProcessInformationLength</span><span class="o">=</span><span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">xtype</span><span class="p">))</span>
<span class="c1"># Map a remote64bits(PROCESS_BASIC_INFORMATION) at the address of &#39;data&#39;</span>
<span class="n">x</span> <span class="o">=</span> <span class="n">xtype</span><span class="p">(</span><span class="n">ctypes</span><span class="o">.</span><span class="n">addressof</span><span class="p">(</span><span class="n">data</span><span class="p">),</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="p">)</span>
<span class="k">else</span><span class="p">:</span>
<span class="n">information_type</span> <span class="o">=</span> <span class="mi">0</span>
<span class="n">x</span> <span class="o">=</span> <span class="n">PROCESS_BASIC_INFORMATION</span><span class="p">()</span>
<span class="n">winproxy</span><span class="o">.</span><span class="n">NtQueryInformationProcess</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">limited_handle</span><span class="p">,</span> <span class="n">information_type</span><span class="p">,</span> <span class="n">x</span><span class="p">)</span>
<span class="k">return</span> <span class="n">x</span><span class="o">.</span><span class="n">InheritedFromUniqueProcessId</span>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">threads</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="w"> </span><span class="sd">&quot;&quot;&quot;The threads of the process</span>
<span class="sd"> :type: [:class:`WinThread`] -- A list of Thread</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="n">owner_pid</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">pid</span>
<span class="k">return</span> <span class="p">[</span><span class="n">WinThread</span><span class="o">.</span><span class="n">_from_THREADENTRY32</span><span class="p">(</span><span class="n">th</span><span class="p">,</span> <span class="n">owner</span><span class="o">=</span><span class="bp">self</span><span class="p">)</span> <span class="k">for</span> <span class="n">th</span> <span class="ow">in</span> <span class="n">windows</span><span class="o">.</span><span class="n">system</span><span class="o">.</span><span class="n">enumerate_threads_generator</span><span class="p">()</span> <span class="k">if</span> <span class="n">th</span><span class="o">.</span><span class="n">th32OwnerProcessID</span> <span class="o">==</span> <span class="n">owner_pid</span><span class="p">]</span>
<span class="k">def</span> <span class="nf">virtual_alloc</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">size</span><span class="p">):</span>
<span class="k">raise</span> <span class="ne">NotImplementedError</span><span class="p">(</span><span class="s2">&quot;virtual_alloc&quot;</span><span class="p">)</span>
<span class="k">def</span> <span class="nf">virtual_free</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="k">raise</span> <span class="ne">NotImplementedError</span><span class="p">(</span><span class="s2">&quot;virtual_free&quot;</span><span class="p">)</span>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">exit_code</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="w"> </span><span class="sd">&quot;&quot;&quot;The exit code of the process : ``STILL_ACTIVE`` means the process is not dead</span>
<span class="sd"> :type: :class:`int`</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="n">res</span> <span class="o">=</span> <span class="n">DWORD</span><span class="p">()</span>
<span class="n">winproxy</span><span class="o">.</span><span class="n">GetExitCodeProcess</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">byref</span><span class="p">(</span><span class="n">res</span><span class="p">))</span>
<span class="k">return</span> <span class="n">res</span><span class="o">.</span><span class="n">value</span>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">is_exit</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="w"> </span><span class="sd">&quot;&quot;&quot;``True`` if the process is terminated</span>
<span class="sd"> :type: :class:`bool`</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">exit_code</span> <span class="o">!=</span> <span class="n">STILL_ACTIVE</span>
<span class="nd">@contextmanager</span>
<span class="k">def</span> <span class="nf">allocated_memory</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">size</span><span class="p">,</span> <span class="n">prot</span><span class="o">=</span><span class="n">PAGE_EXECUTE_READWRITE</span><span class="p">):</span>
<span class="w"> </span><span class="sd">&quot;&quot;&quot;ContextManager to allocate memory and free it</span>
<span class="sd"> :type: :class:`int` -- the address of the allocated memory</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="n">addr</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">virtual_alloc</span><span class="p">(</span><span class="n">size</span><span class="p">,</span> <span class="n">prot</span><span class="o">=</span><span class="n">prot</span><span class="p">)</span>
<span class="k">try</span><span class="p">:</span>
<span class="k">yield</span> <span class="n">addr</span>
<span class="k">finally</span><span class="p">:</span>
<span class="n">winproxy</span><span class="o">.</span><span class="n">VirtualFreeEx</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">addr</span><span class="p">)</span>
<span class="nd">@contextmanager</span>
<span class="k">def</span> <span class="nf">virtual_protected</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">addr</span><span class="p">,</span> <span class="n">size</span><span class="p">,</span> <span class="n">protect</span><span class="p">):</span>
<span class="w"> </span><span class="sd">&quot;&quot;&quot;A context manager for local virtual_protect (old Protection are restored at exit)&quot;&quot;&quot;</span>
<span class="n">old_protect</span> <span class="o">=</span> <span class="n">DWORD</span><span class="p">()</span>
<span class="bp">self</span><span class="o">.</span><span class="n">virtual_protect</span><span class="p">(</span><span class="n">addr</span><span class="p">,</span> <span class="n">size</span><span class="p">,</span> <span class="n">protect</span><span class="p">,</span> <span class="n">old_protect</span><span class="p">)</span>
<span class="k">try</span><span class="p">:</span>
<span class="k">yield</span> <span class="n">addr</span>
<span class="k">finally</span><span class="p">:</span>
<span class="bp">self</span><span class="o">.</span><span class="n">virtual_protect</span><span class="p">(</span><span class="n">addr</span><span class="p">,</span> <span class="n">size</span><span class="p">,</span> <span class="n">old_protect</span><span class="o">.</span><span class="n">value</span><span class="p">,</span> <span class="n">old_protect</span><span class="p">)</span>
<span class="k">def</span> <span class="nf">virtual_protect</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">addr</span><span class="p">,</span> <span class="n">size</span><span class="p">,</span> <span class="n">protect</span><span class="p">,</span> <span class="n">old_protect</span><span class="o">=</span><span class="kc">None</span><span class="p">):</span>
<span class="w"> </span><span class="sd">&quot;&quot;&quot;Change the access right of one or more page of the process&quot;&quot;&quot;</span>
<span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">32</span> <span class="ow">and</span> <span class="bp">self</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">64</span><span class="p">:</span>
<span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">_is_x86_on_arm64</span><span class="p">:</span>
<span class="k">raise</span> <span class="ne">NotImplementedError</span><span class="p">(</span><span class="s2">&quot;Crossing heaven gate x86 -&gt; arm64 not implemented&quot;</span><span class="p">)</span>
<span class="k">if</span> <span class="n">size</span> <span class="o">&amp;</span> <span class="mh">0x0fff</span><span class="p">:</span>
<span class="n">size</span> <span class="o">=</span> <span class="p">((</span><span class="n">size</span> <span class="o">&gt;&gt;</span> <span class="mi">12</span><span class="p">)</span> <span class="o">+</span> <span class="mi">1</span><span class="p">)</span> <span class="o">&lt;&lt;</span> <span class="mi">12</span>
<span class="k">if</span> <span class="n">old_protect</span> <span class="ow">is</span> <span class="kc">None</span><span class="p">:</span>
<span class="n">old_protect</span> <span class="o">=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">DWORD</span><span class="p">()</span>
<span class="n">xold_protect</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">addressof</span><span class="p">(</span><span class="n">old_protect</span><span class="p">)</span>
<span class="n">xaddr</span> <span class="o">=</span> <span class="n">ULONG64</span><span class="p">(</span><span class="n">addr</span><span class="p">)</span>
<span class="n">addr</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">addressof</span><span class="p">(</span><span class="n">xaddr</span><span class="p">)</span>
<span class="n">xsize</span> <span class="o">=</span> <span class="n">ULONG</span><span class="p">(</span><span class="n">size</span><span class="p">)</span>
<span class="n">size</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">addressof</span><span class="p">(</span><span class="n">xsize</span><span class="p">)</span>
<span class="k">return</span> <span class="n">windows</span><span class="o">.</span><span class="n">syswow64</span><span class="o">.</span><span class="n">NtProtectVirtualMemory_32_to_64</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">addr</span><span class="p">,</span> <span class="n">size</span><span class="p">,</span> <span class="n">protect</span><span class="p">,</span> <span class="n">xold_protect</span><span class="p">)</span>
<span class="k">else</span><span class="p">:</span>
<span class="n">winproxy</span><span class="o">.</span><span class="n">VirtualProtectEx</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">addr</span><span class="p">,</span> <span class="n">size</span><span class="p">,</span> <span class="n">protect</span><span class="p">,</span> <span class="n">old_protect</span><span class="p">)</span>
<span class="k">def</span> <span class="nf">execute</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">code</span><span class="p">,</span> <span class="n">parameter</span><span class="o">=</span><span class="mi">0</span><span class="p">):</span>
<span class="w"> </span><span class="sd">&quot;&quot;&quot;Execute some native code in the context of the process</span>
<span class="sd"> :return: The thread executing the code</span>
<span class="sd"> :rtype: :class:`WinThread` or :class:`DeadThread`</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="n">x</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">virtual_alloc</span><span class="p">(</span><span class="nb">len</span><span class="p">(</span><span class="n">code</span><span class="p">))</span> <span class="c1">#Todo: free this ? when ? how ? reuse ?</span>
<span class="bp">self</span><span class="o">.</span><span class="n">write_memory</span><span class="p">(</span><span class="n">x</span><span class="p">,</span> <span class="n">code</span><span class="p">)</span>
<span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">create_thread</span><span class="p">(</span><span class="n">x</span><span class="p">,</span> <span class="n">parameter</span><span class="p">)</span>
<span class="k">def</span> <span class="nf">query_memory</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">addr</span><span class="p">):</span>
<span class="w"> </span><span class="sd">&quot;&quot;&quot;Query the memory informations about page at ``addr``</span>
<span class="sd"> :rtype: :class:`~windows.generated_def.winstructs.MEMORY_BASIC_INFORMATION`</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">32</span> <span class="ow">and</span> <span class="bp">self</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">64</span><span class="p">:</span>
<span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">_is_x86_on_arm64</span><span class="p">:</span>
<span class="k">raise</span> <span class="ne">NotImplementedError</span><span class="p">(</span><span class="s2">&quot;Crossing heaven gate x86 -&gt; arm64 not implemented&quot;</span><span class="p">)</span>
<span class="n">res</span> <span class="o">=</span> <span class="n">MEMORY_BASIC_INFORMATION64</span><span class="p">()</span>
<span class="k">try</span><span class="p">:</span>
<span class="n">v</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">syswow64</span><span class="o">.</span><span class="n">NtQueryVirtualMemory_32_to_64</span><span class="p">(</span><span class="n">ProcessHandle</span><span class="o">=</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">BaseAddress</span><span class="o">=</span><span class="n">addr</span><span class="p">,</span> <span class="n">MemoryInformationClass</span><span class="o">=</span><span class="n">MemoryBasicInformation</span><span class="p">,</span> <span class="n">MemoryInformation</span><span class="o">=</span><span class="n">res</span><span class="p">)</span>
<span class="k">except</span> <span class="n">NtStatusException</span> <span class="k">as</span> <span class="n">e</span><span class="p">:</span>
<span class="k">if</span> <span class="n">e</span><span class="o">.</span><span class="n">code</span> <span class="o">&amp;</span> <span class="mh">0xffffffff</span> <span class="o">==</span> <span class="mh">0XC000000D</span><span class="p">:</span>
<span class="k">raise</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">WinproxyError</span><span class="p">(</span><span class="s2">&quot;NtQueryVirtualMemory_32_to_64&quot;</span><span class="p">)</span>
<span class="k">raise</span>
<span class="k">return</span> <span class="n">res</span>
<span class="n">info_type</span> <span class="o">=</span> <span class="p">{</span><span class="mi">32</span> <span class="p">:</span> <span class="n">MEMORY_BASIC_INFORMATION32</span><span class="p">,</span> <span class="mi">64</span> <span class="p">:</span> <span class="n">MEMORY_BASIC_INFORMATION64</span><span class="p">}</span>
<span class="n">res</span> <span class="o">=</span> <span class="n">info_type</span><span class="p">[</span><span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">bitness</span><span class="p">]()</span>
<span class="n">ptr</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">cast</span><span class="p">(</span><span class="n">byref</span><span class="p">(</span><span class="n">res</span><span class="p">),</span> <span class="n">POINTER</span><span class="p">(</span><span class="n">MEMORY_BASIC_INFORMATION</span><span class="p">))</span>
<span class="n">winproxy</span><span class="o">.</span><span class="n">VirtualQueryEx</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">addr</span><span class="p">,</span> <span class="n">ptr</span><span class="p">,</span> <span class="n">sizeof</span><span class="p">(</span><span class="n">res</span><span class="p">))</span>
<span class="k">return</span> <span class="n">res</span>
<span class="k">def</span> <span class="nf">memory_state</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="w"> </span><span class="sd">&quot;&quot;&quot;Yield the memory information for the whole address space of the process</span>
<span class="sd"> :yield: :class:`~windows.generated_def.winstructs.MEMORY_BASIC_INFORMATION`</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="n">addr</span> <span class="o">=</span> <span class="mi">0</span>
<span class="n">res</span> <span class="o">=</span> <span class="p">[]</span>
<span class="k">while</span> <span class="kc">True</span><span class="p">:</span>
<span class="k">try</span><span class="p">:</span>
<span class="n">x</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">query_memory</span><span class="p">(</span><span class="n">addr</span><span class="p">)</span>
<span class="k">yield</span> <span class="n">x</span>
<span class="k">except</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">WinproxyError</span><span class="p">:</span>
<span class="k">return</span>
<span class="n">addr</span> <span class="o">+=</span> <span class="n">x</span><span class="o">.</span><span class="n">RegionSize</span>
<span class="k">def</span> <span class="nf">query_working_set</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">64</span> <span class="ow">or</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">64</span><span class="p">:</span>
<span class="n">WSET_BLOCK</span> <span class="o">=</span> <span class="n">EPSAPI_WORKING_SET_BLOCK64</span>
<span class="n">dummy</span> <span class="o">=</span> <span class="n">PSAPI_WORKING_SET_INFORMATION64</span><span class="p">()</span>
<span class="k">else</span><span class="p">:</span>
<span class="n">WSET_BLOCK</span> <span class="o">=</span> <span class="n">EPSAPI_WORKING_SET_BLOCK32</span>
<span class="n">dummy</span> <span class="o">=</span> <span class="n">PSAPI_WORKING_SET_INFORMATION32</span><span class="p">()</span>
<span class="k">try</span><span class="p">:</span>
<span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">QueryWorkingSet</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">byref</span><span class="p">(</span><span class="n">dummy</span><span class="p">),</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">dummy</span><span class="p">))</span>
<span class="k">except</span> <span class="ne">WindowsError</span> <span class="k">as</span> <span class="n">e</span><span class="p">:</span>
<span class="k">if</span> <span class="n">e</span><span class="o">.</span><span class="n">winerror</span> <span class="o">!=</span> <span class="mi">24</span><span class="p">:</span>
<span class="k">raise</span>
<span class="n">NumberOfEntriesType</span> <span class="o">=</span> <span class="p">[</span><span class="n">f</span> <span class="k">for</span> <span class="n">f</span> <span class="ow">in</span> <span class="n">WSET_BLOCK</span><span class="o">.</span><span class="n">_fields_</span> <span class="k">if</span> <span class="n">f</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span> <span class="o">==</span> <span class="s2">&quot;Flags&quot;</span><span class="p">][</span><span class="mi">0</span><span class="p">][</span><span class="mi">1</span><span class="p">]</span>
<span class="k">for</span> <span class="n">i</span> <span class="ow">in</span> <span class="nb">range</span><span class="p">(</span><span class="mi">10</span><span class="p">):</span>
<span class="c1"># use the same type as WSET_BLOCK.Flags</span>
<span class="k">class</span> <span class="nc">GENERATED_PSAPI_WORKING_SET_INFORMATION</span><span class="p">(</span><span class="n">ctypes</span><span class="o">.</span><span class="n">Structure</span><span class="p">):</span>
<span class="n">_fields_</span> <span class="o">=</span> <span class="p">[</span>
<span class="p">(</span><span class="s2">&quot;NumberOfEntries&quot;</span><span class="p">,</span> <span class="n">NumberOfEntriesType</span><span class="p">),</span>
<span class="p">(</span><span class="s2">&quot;WorkingSetInfo&quot;</span><span class="p">,</span> <span class="n">WSET_BLOCK</span> <span class="o">*</span> <span class="n">dummy</span><span class="o">.</span><span class="n">NumberOfEntries</span><span class="p">),</span>
<span class="p">]</span>
<span class="n">res</span> <span class="o">=</span> <span class="n">GENERATED_PSAPI_WORKING_SET_INFORMATION</span><span class="p">()</span>
<span class="k">try</span><span class="p">:</span>
<span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">32</span> <span class="ow">and</span> <span class="bp">self</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">64</span><span class="p">:</span>
<span class="n">windows</span><span class="o">.</span><span class="n">syswow64</span><span class="o">.</span><span class="n">NtQueryVirtualMemory_32_to_64</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="mi">0</span><span class="p">,</span> <span class="n">MemoryWorkingSetList</span><span class="p">,</span> <span class="n">res</span><span class="p">)</span>
<span class="k">else</span><span class="p">:</span>
<span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">QueryWorkingSet</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">byref</span><span class="p">(</span><span class="n">res</span><span class="p">),</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">res</span><span class="p">))</span>
<span class="k">except</span> <span class="ne">WindowsError</span> <span class="k">as</span> <span class="n">e</span><span class="p">:</span>
<span class="k">if</span> <span class="n">e</span><span class="o">.</span><span class="n">winerror</span> <span class="o">!=</span> <span class="mi">24</span><span class="p">:</span>
<span class="k">raise</span>
<span class="n">dummy</span><span class="o">.</span><span class="n">NumberOfEntries</span> <span class="o">=</span> <span class="n">res</span><span class="o">.</span><span class="n">NumberOfEntries</span>
<span class="k">continue</span>
<span class="k">except</span> <span class="n">windows</span><span class="o">.</span><span class="n">generated_def</span><span class="o">.</span><span class="n">ntstatus</span><span class="o">.</span><span class="n">NtStatusException</span> <span class="k">as</span> <span class="n">e</span><span class="p">:</span>
<span class="k">if</span> <span class="n">e</span><span class="o">.</span><span class="n">code</span> <span class="o">!=</span> <span class="n">STATUS_INFO_LENGTH_MISMATCH</span><span class="p">:</span>
<span class="k">raise</span>
<span class="n">dummy</span><span class="o">.</span><span class="n">NumberOfEntries</span> <span class="o">=</span> <span class="n">res</span><span class="o">.</span><span class="n">NumberOfEntries</span>
<span class="k">continue</span>
<span class="k">return</span> <span class="n">res</span><span class="o">.</span><span class="n">WorkingSetInfo</span>
<span class="c1"># Raise ?</span>
<span class="k">return</span> <span class="kc">None</span>
<span class="k">def</span> <span class="nf">query_working_setex</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">addresses</span><span class="p">):</span>
<span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">64</span> <span class="ow">or</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">64</span><span class="p">:</span>
<span class="n">info_type</span> <span class="o">=</span> <span class="n">EPSAPI_WORKING_SET_EX_INFORMATION64</span>
<span class="k">else</span><span class="p">:</span>
<span class="n">info_type</span> <span class="o">=</span> <span class="n">EPSAPI_WORKING_SET_EX_INFORMATION32</span>
<span class="n">info_array</span> <span class="o">=</span> <span class="p">(</span><span class="n">info_type</span> <span class="o">*</span> <span class="nb">len</span><span class="p">(</span><span class="n">addresses</span><span class="p">))()</span>
<span class="k">for</span> <span class="n">i</span><span class="p">,</span> <span class="n">data</span> <span class="ow">in</span> <span class="nb">enumerate</span><span class="p">(</span><span class="n">info_array</span><span class="p">):</span>
<span class="n">info_array</span><span class="p">[</span><span class="n">i</span><span class="p">]</span><span class="o">.</span><span class="n">VirtualAddress</span> <span class="o">=</span> <span class="n">addresses</span><span class="p">[</span><span class="n">i</span><span class="p">]</span>
<span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">32</span> <span class="ow">and</span> <span class="bp">self</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">64</span><span class="p">:</span>
<span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">_is_x86_on_arm64</span><span class="p">:</span>
<span class="k">raise</span> <span class="ne">NotImplementedError</span><span class="p">(</span><span class="s2">&quot;Crossing heaven gate x86 -&gt; arm64 not implemented&quot;</span><span class="p">)</span>
<span class="n">windows</span><span class="o">.</span><span class="n">syswow64</span><span class="o">.</span><span class="n">NtQueryVirtualMemory_32_to_64</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="mi">0</span><span class="p">,</span> <span class="n">MemoryWorkingSetListEx</span><span class="p">,</span> <span class="n">info_array</span><span class="p">)</span>
<span class="k">else</span><span class="p">:</span>
<span class="n">winproxy</span><span class="o">.</span><span class="n">QueryWorkingSetEx</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">byref</span><span class="p">(</span><span class="n">info_array</span><span class="p">),</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">info_array</span><span class="p">))</span>
<span class="k">return</span> <span class="n">info_array</span>
<span class="k">def</span> <span class="nf">get_mapped_filename</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">addr</span><span class="p">):</span>
<span class="w"> </span><span class="sd">&quot;&quot;&quot;The filename mapped at address ``addr`` or ``None``</span>
<span class="sd"> :rtype: :class:`unicode` or ``None``</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="n">buffer_size</span> <span class="o">=</span> <span class="mh">0x1000</span>
<span class="n">buffer</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">c_buffer</span><span class="p">(</span><span class="n">buffer_size</span><span class="p">)</span>
<span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">32</span> <span class="ow">and</span> <span class="bp">self</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">64</span><span class="p">:</span>
<span class="n">target_size</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">c_buffer</span><span class="p">(</span><span class="n">buffer_size</span><span class="p">)</span>
<span class="k">try</span><span class="p">:</span>
<span class="n">windows</span><span class="o">.</span><span class="n">syswow64</span><span class="o">.</span><span class="n">NtQueryVirtualMemory_32_to_64</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">addr</span><span class="p">,</span> <span class="n">MemorySectionName</span><span class="p">,</span> <span class="n">buffer</span><span class="p">,</span> <span class="n">buffer_size</span><span class="p">,</span> <span class="n">target_size</span><span class="p">)</span>
<span class="k">except</span> <span class="n">NtStatusException</span> <span class="k">as</span> <span class="n">e</span><span class="p">:</span>
<span class="k">if</span> <span class="n">e</span><span class="o">.</span><span class="n">code</span> <span class="ow">not</span> <span class="ow">in</span> <span class="p">(</span><span class="n">STATUS_FILE_INVALID</span><span class="p">,</span> <span class="n">STATUS_INVALID_ADDRESS</span><span class="p">):</span>
<span class="k">raise</span>
<span class="k">return</span> <span class="kc">None</span>
<span class="n">remote_winstring</span> <span class="o">=</span> <span class="n">rctypes</span><span class="o">.</span><span class="n">transform_type_to_remote64bits</span><span class="p">(</span><span class="n">gdef</span><span class="o">.</span><span class="n">LSA_UNICODE_STRING</span><span class="p">)</span>
<span class="n">mapped_filename</span> <span class="o">=</span> <span class="n">remote_winstring</span><span class="p">(</span><span class="n">ctypes</span><span class="o">.</span><span class="n">addressof</span><span class="p">(</span><span class="n">buffer</span><span class="p">),</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="p">)</span>
<span class="k">return</span> <span class="n">mapped_filename</span><span class="o">.</span><span class="n">str</span>
<span class="k">try</span><span class="p">:</span>
<span class="n">size</span> <span class="o">=</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">GetMappedFileNameW</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">addr</span><span class="p">,</span> <span class="n">buffer</span><span class="p">,</span> <span class="n">buffer_size</span><span class="p">)</span>
<span class="k">except</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">WinproxyError</span> <span class="k">as</span> <span class="n">e</span><span class="p">:</span>
<span class="k">if</span> <span class="n">e</span><span class="o">.</span><span class="n">winerror</span> <span class="ow">not</span> <span class="ow">in</span> <span class="p">(</span><span class="n">gdef</span><span class="o">.</span><span class="n">ERROR_UNEXP_NET_ERR</span><span class="p">,</span> <span class="n">gdef</span><span class="o">.</span><span class="n">ERROR_FILE_INVALID</span><span class="p">):</span>
<span class="k">raise</span> <span class="c1"># Raise if error type is not expected: detect mapped aborted transaction</span>
<span class="k">return</span> <span class="kc">None</span>
<span class="k">return</span> <span class="n">buffer</span><span class="p">[:</span> <span class="n">size</span> <span class="o">*</span> <span class="mi">2</span><span class="p">]</span><span class="o">.</span><span class="n">decode</span><span class="p">(</span><span class="s2">&quot;utf16&quot;</span><span class="p">)</span>
<span class="k">def</span> <span class="nf">read_byte</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">addr</span><span class="p">):</span>
<span class="w"> </span><span class="sd">&quot;&quot;&quot;Read a ``CHAR`` at ``addr``&quot;&quot;&quot;</span>
<span class="n">sizeof_char</span> <span class="o">=</span> <span class="n">sizeof</span><span class="p">(</span><span class="n">CHAR</span><span class="p">)</span>
<span class="k">return</span> <span class="n">struct</span><span class="o">.</span><span class="n">unpack</span><span class="p">(</span><span class="s2">&quot;&lt;B&quot;</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">read_memory</span><span class="p">(</span><span class="n">addr</span><span class="p">,</span> <span class="n">sizeof_char</span><span class="p">))[</span><span class="mi">0</span><span class="p">]</span>
<span class="k">def</span> <span class="nf">read_short</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">addr</span><span class="p">):</span>
<span class="w"> </span><span class="sd">&quot;&quot;&quot;Read a ``SHORT`` at ``addr``&quot;&quot;&quot;</span>
<span class="n">sizeof_short</span> <span class="o">=</span> <span class="n">sizeof</span><span class="p">(</span><span class="n">ctypes</span><span class="o">.</span><span class="n">c_short</span><span class="p">)</span>
<span class="k">return</span> <span class="n">struct</span><span class="o">.</span><span class="n">unpack</span><span class="p">(</span><span class="s2">&quot;&lt;H&quot;</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">read_memory</span><span class="p">(</span><span class="n">addr</span><span class="p">,</span> <span class="n">sizeof_short</span><span class="p">))[</span><span class="mi">0</span><span class="p">]</span>
<span class="k">def</span> <span class="nf">read_dword</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">addr</span><span class="p">):</span>
<span class="w"> </span><span class="sd">&quot;&quot;&quot;Read a ``DWORD`` at ``addr``&quot;&quot;&quot;</span>
<span class="n">sizeof_dword</span> <span class="o">=</span> <span class="n">sizeof</span><span class="p">(</span><span class="n">DWORD</span><span class="p">)</span>
<span class="k">return</span> <span class="n">struct</span><span class="o">.</span><span class="n">unpack</span><span class="p">(</span><span class="s2">&quot;&lt;I&quot;</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">read_memory</span><span class="p">(</span><span class="n">addr</span><span class="p">,</span> <span class="n">sizeof_dword</span><span class="p">))[</span><span class="mi">0</span><span class="p">]</span>
<span class="k">def</span> <span class="nf">read_qword</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">addr</span><span class="p">):</span>
<span class="w"> </span><span class="sd">&quot;&quot;&quot;Read a ``ULONG64`` at ``addr``&quot;&quot;&quot;</span>
<span class="n">sizeof_qword</span> <span class="o">=</span> <span class="n">sizeof</span><span class="p">(</span><span class="n">ULONG64</span><span class="p">)</span>
<span class="k">return</span> <span class="n">struct</span><span class="o">.</span><span class="n">unpack</span><span class="p">(</span><span class="s2">&quot;&lt;Q&quot;</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">read_memory</span><span class="p">(</span><span class="n">addr</span><span class="p">,</span> <span class="n">sizeof_qword</span><span class="p">))[</span><span class="mi">0</span><span class="p">]</span>
<span class="k">def</span> <span class="nf">read_ptr</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">addr</span><span class="p">):</span>
<span class="w"> </span><span class="sd">&quot;&quot;&quot;Read a ``PTR`` at ``addr``&quot;&quot;&quot;</span>
<span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">32</span><span class="p">:</span>
<span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">read_dword</span><span class="p">(</span><span class="n">addr</span><span class="p">)</span>
<span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">read_qword</span><span class="p">(</span><span class="n">addr</span><span class="p">)</span>
<span class="k">def</span> <span class="nf">read_string</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">addr</span><span class="p">):</span>
<span class="w"> </span><span class="sd">&quot;&quot;&quot;Read an ascii string at ``addr``&quot;&quot;&quot;</span>
<span class="n">res</span> <span class="o">=</span> <span class="p">[]</span>
<span class="n">read_size</span> <span class="o">=</span> <span class="mh">0x100</span>
<span class="n">readden</span> <span class="o">=</span> <span class="mi">0</span>
<span class="k">for</span> <span class="n">i</span> <span class="ow">in</span> <span class="n">itertools</span><span class="o">.</span><span class="n">count</span><span class="p">():</span>
<span class="k">try</span><span class="p">:</span>
<span class="n">x</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">read_memory</span><span class="p">(</span><span class="n">addr</span> <span class="o">+</span> <span class="n">readden</span><span class="p">,</span> <span class="n">read_size</span><span class="p">)</span>
<span class="k">except</span> <span class="ne">WindowsError</span> <span class="k">as</span> <span class="n">e</span><span class="p">:</span>
<span class="k">if</span> <span class="n">read_size</span> <span class="o">==</span> <span class="mi">2</span><span class="p">:</span>
<span class="k">raise</span>
<span class="c1"># handle read_wstring at end of page</span>
<span class="c1"># Of read failed: read only the half of size</span>
<span class="c1"># read_size must remain a multiple of 2</span>
<span class="n">read_size</span> <span class="o">=</span> <span class="n">read_size</span> <span class="o">//</span> <span class="mi">2</span>
<span class="k">continue</span>
<span class="n">readden</span> <span class="o">+=</span> <span class="n">read_size</span>
<span class="k">if</span> <span class="sa">b</span><span class="s2">&quot;</span><span class="se">\x00</span><span class="s2">&quot;</span> <span class="ow">in</span> <span class="n">x</span><span class="p">:</span>
<span class="n">res</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">x</span><span class="o">.</span><span class="n">split</span><span class="p">(</span><span class="sa">b</span><span class="s2">&quot;</span><span class="se">\x00</span><span class="s2">&quot;</span><span class="p">,</span> <span class="mi">1</span><span class="p">)[</span><span class="mi">0</span><span class="p">])</span>
<span class="k">break</span>
<span class="n">res</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">x</span><span class="p">)</span>
<span class="k">return</span> <span class="sa">b</span><span class="s2">&quot;&quot;</span><span class="o">.</span><span class="n">join</span><span class="p">(</span><span class="n">res</span><span class="p">)</span><span class="o">.</span><span class="n">decode</span><span class="p">(</span><span class="s2">&quot;ascii&quot;</span><span class="p">)</span>
<span class="k">def</span> <span class="nf">read_wstring</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">addr</span><span class="p">):</span>
<span class="w"> </span><span class="sd">&quot;&quot;&quot;Read a windows UTF16 string at ``addr``&quot;&quot;&quot;</span>
<span class="n">res</span> <span class="o">=</span> <span class="p">[]</span>
<span class="n">read_size</span> <span class="o">=</span> <span class="mh">0x100</span>
<span class="n">readden</span> <span class="o">=</span> <span class="mi">0</span>
<span class="c1"># I am trying to do something smart here..</span>
<span class="k">while</span> <span class="kc">True</span><span class="p">:</span>
<span class="k">try</span><span class="p">:</span>
<span class="n">x</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">read_memory</span><span class="p">(</span><span class="n">addr</span> <span class="o">+</span> <span class="n">readden</span><span class="p">,</span> <span class="n">read_size</span><span class="p">)</span>
<span class="k">except</span> <span class="ne">WindowsError</span> <span class="k">as</span> <span class="n">e</span><span class="p">:</span>
<span class="k">if</span> <span class="n">read_size</span> <span class="o">==</span> <span class="mi">2</span><span class="p">:</span>
<span class="k">raise</span>
<span class="c1"># handle read_wstring at end of page</span>
<span class="c1"># Of read failed: read only the half of size</span>
<span class="c1"># read_size must remain a multiple of 2</span>
<span class="n">read_size</span> <span class="o">=</span> <span class="n">read_size</span> <span class="o">//</span> <span class="mi">2</span>
<span class="k">continue</span>
<span class="n">readden</span> <span class="o">+=</span> <span class="n">read_size</span>
<span class="c1"># Bytearray will work on py2 &amp; py3</span>
<span class="c1"># Py2: bytearray((0, 0)) == b&quot;\x00\x00&quot;</span>
<span class="c1"># Py2: bytearray((0, 0)) == b&quot;\x00\x00&quot;</span>
<span class="n">utf16_chars</span> <span class="o">=</span> <span class="p">[</span><span class="nb">bytearray</span><span class="p">(</span><span class="n">c</span><span class="p">)</span> <span class="k">for</span> <span class="n">c</span> <span class="ow">in</span> <span class="nb">zip</span><span class="p">(</span><span class="o">*</span><span class="p">[</span><span class="nb">iter</span><span class="p">(</span><span class="n">x</span><span class="p">)]</span> <span class="o">*</span> <span class="mi">2</span><span class="p">)]</span>
<span class="k">if</span> <span class="sa">b</span><span class="s2">&quot;</span><span class="se">\x00\x00</span><span class="s2">&quot;</span> <span class="ow">in</span> <span class="n">utf16_chars</span><span class="p">:</span>
<span class="c1"># Translate bytearray to str/bytes for both py2 &amp; py3</span>
<span class="n">res</span><span class="o">.</span><span class="n">extend</span><span class="p">(</span><span class="n">x</span><span class="p">[:</span><span class="n">utf16_chars</span><span class="o">.</span><span class="n">index</span><span class="p">(</span><span class="sa">b</span><span class="s2">&quot;</span><span class="se">\x00\x00</span><span class="s2">&quot;</span><span class="p">)</span> <span class="o">*</span> <span class="mi">2</span><span class="p">])</span>
<span class="k">break</span>
<span class="n">res</span><span class="o">.</span><span class="n">extend</span><span class="p">(</span><span class="n">x</span><span class="p">)</span>
<span class="k">return</span> <span class="nb">bytearray</span><span class="p">(</span><span class="n">res</span><span class="p">)</span><span class="o">.</span><span class="n">decode</span><span class="p">(</span><span class="s2">&quot;utf-16&quot;</span><span class="p">)</span>
<span class="k">def</span> <span class="nf">write_byte</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">addr</span><span class="p">,</span> <span class="n">byte</span><span class="p">):</span>
<span class="w"> </span><span class="sd">&quot;&quot;&quot;write a byte at ``addr``&quot;&quot;&quot;</span>
<span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">write_memory</span><span class="p">(</span><span class="n">addr</span><span class="p">,</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span><span class="s2">&quot;&lt;B&quot;</span><span class="p">,</span> <span class="n">byte</span><span class="p">))</span>
<span class="k">def</span> <span class="nf">write_short</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">addr</span><span class="p">,</span> <span class="n">word</span><span class="p">):</span>
<span class="w"> </span><span class="sd">&quot;&quot;&quot;write a word at ``addr``&quot;&quot;&quot;</span>
<span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">write_memory</span><span class="p">(</span><span class="n">addr</span><span class="p">,</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span><span class="s2">&quot;&lt;H&quot;</span><span class="p">,</span> <span class="n">word</span><span class="p">))</span>
<span class="k">def</span> <span class="nf">write_dword</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">addr</span><span class="p">,</span> <span class="n">dword</span><span class="p">):</span>
<span class="w"> </span><span class="sd">&quot;&quot;&quot;write a dword at ``addr``&quot;&quot;&quot;</span>
<span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">write_memory</span><span class="p">(</span><span class="n">addr</span><span class="p">,</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span><span class="s2">&quot;&lt;I&quot;</span><span class="p">,</span> <span class="n">dword</span><span class="p">))</span>
<span class="k">def</span> <span class="nf">write_qword</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">addr</span><span class="p">,</span> <span class="n">qword</span><span class="p">):</span>
<span class="w"> </span><span class="sd">&quot;&quot;&quot;write a qword at ``addr``&quot;&quot;&quot;</span>
<span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">write_memory</span><span class="p">(</span><span class="n">addr</span><span class="p">,</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span><span class="s2">&quot;&lt;Q&quot;</span><span class="p">,</span> <span class="n">qword</span><span class="p">))</span>
<span class="k">def</span> <span class="nf">write_ptr</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">addr</span><span class="p">,</span> <span class="n">value</span><span class="p">):</span>
<span class="w"> </span><span class="sd">&quot;&quot;&quot;Write a ``PTR`` at ``addr``&quot;&quot;&quot;</span>
<span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">32</span><span class="p">:</span>
<span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">write_dword</span><span class="p">(</span><span class="n">addr</span><span class="p">,</span> <span class="n">value</span><span class="p">)</span>
<span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">write_qword</span><span class="p">(</span><span class="n">addr</span><span class="p">,</span> <span class="n">value</span><span class="p">)</span>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">time_info</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="w"> </span><span class="sd">&quot;&quot;&quot;The time information of the process (creation, kernel/user time, exit time)</span>
<span class="sd"> :type: :class:`TimeInfo`&quot;&quot;&quot;</span>
<span class="n">CreationTime</span> <span class="o">=</span> <span class="n">FILETIME</span><span class="p">()</span>
<span class="n">ExitTime</span> <span class="o">=</span> <span class="n">FILETIME</span><span class="p">()</span>
<span class="n">KernelTime</span> <span class="o">=</span> <span class="n">FILETIME</span><span class="p">()</span>
<span class="n">UserTime</span> <span class="o">=</span> <span class="n">FILETIME</span><span class="p">()</span>
<span class="n">winproxy</span><span class="o">.</span><span class="n">GetProcessTimes</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">limited_handle</span><span class="p">,</span> <span class="n">CreationTime</span><span class="p">,</span> <span class="n">ExitTime</span><span class="p">,</span> <span class="n">KernelTime</span><span class="p">,</span> <span class="n">UserTime</span><span class="p">)</span>
<span class="n">creation</span> <span class="o">=</span> <span class="p">(</span><span class="n">CreationTime</span><span class="o">.</span><span class="n">dwHighDateTime</span> <span class="o">&lt;&lt;</span> <span class="mi">32</span><span class="p">)</span> <span class="o">+</span> <span class="n">CreationTime</span><span class="o">.</span><span class="n">dwLowDateTime</span>
<span class="n">exit</span> <span class="o">=</span> <span class="p">(</span><span class="n">ExitTime</span><span class="o">.</span><span class="n">dwHighDateTime</span> <span class="o">&lt;&lt;</span> <span class="mi">32</span><span class="p">)</span> <span class="o">+</span> <span class="n">ExitTime</span><span class="o">.</span><span class="n">dwLowDateTime</span>
<span class="n">kernel</span> <span class="o">=</span> <span class="p">(</span><span class="n">KernelTime</span><span class="o">.</span><span class="n">dwHighDateTime</span> <span class="o">&lt;&lt;</span> <span class="mi">32</span><span class="p">)</span> <span class="o">+</span> <span class="n">KernelTime</span><span class="o">.</span><span class="n">dwLowDateTime</span>
<span class="n">user</span> <span class="o">=</span> <span class="p">(</span><span class="n">UserTime</span><span class="o">.</span><span class="n">dwHighDateTime</span> <span class="o">&lt;&lt;</span> <span class="mi">32</span><span class="p">)</span> <span class="o">+</span> <span class="n">UserTime</span><span class="o">.</span><span class="n">dwLowDateTime</span>
<span class="k">return</span> <span class="n">TimeInfo</span><span class="p">(</span><span class="n">creation</span><span class="p">,</span> <span class="n">exit</span><span class="p">,</span> <span class="n">kernel</span><span class="p">,</span> <span class="n">user</span><span class="p">)</span>
<span class="n">PRIORITY_CLASS_MAPPER</span> <span class="o">=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">FlagMapper</span><span class="p">(</span>
<span class="n">ABOVE_NORMAL_PRIORITY_CLASS</span><span class="p">,</span>
<span class="n">BELOW_NORMAL_PRIORITY_CLASS</span><span class="p">,</span>
<span class="n">HIGH_PRIORITY_CLASS</span><span class="p">,</span>
<span class="n">IDLE_PRIORITY_CLASS</span><span class="p">,</span>
<span class="n">NORMAL_PRIORITY_CLASS</span><span class="p">,</span>
<span class="n">PROCESS_MODE_BACKGROUND_BEGIN</span><span class="p">,</span>
<span class="n">PROCESS_MODE_BACKGROUND_END</span><span class="p">,</span>
<span class="n">REALTIME_PRIORITY_CLASS</span><span class="p">)</span>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">memory_info</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="n">result</span> <span class="o">=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">PROCESS_MEMORY_COUNTERS_EX</span><span class="p">()</span>
<span class="n">result</span><span class="o">.</span><span class="n">cb</span> <span class="o">=</span> <span class="n">sizeof</span><span class="p">(</span><span class="n">gdef</span><span class="o">.</span><span class="n">PROCESS_MEMORY_COUNTERS_EX</span><span class="p">)</span>
<span class="n">cast_result</span> <span class="o">=</span> <span class="n">cast</span><span class="p">(</span><span class="n">pointer</span><span class="p">(</span><span class="n">result</span><span class="p">),</span> <span class="n">gdef</span><span class="o">.</span><span class="n">PPROCESS_MEMORY_COUNTERS</span><span class="p">)</span>
<span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">GetProcessMemoryInfo</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">limited_handle</span><span class="p">,</span> <span class="n">cast_result</span><span class="p">,</span> <span class="n">result</span><span class="o">.</span><span class="n">cb</span><span class="p">)</span>
<span class="k">return</span> <span class="n">result</span>
<span class="k">def</span> <span class="nf">query_info</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">information_class</span><span class="p">,</span> <span class="n">data</span><span class="o">=</span><span class="kc">None</span><span class="p">):</span>
<span class="n">winproxy</span><span class="o">.</span><span class="n">NtQueryInformationProcess</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">information_class</span><span class="p">,</span> <span class="n">byref</span><span class="p">(</span><span class="n">data</span><span class="p">),</span> <span class="n">sizeof</span><span class="p">(</span><span class="n">data</span><span class="p">))</span>
<span class="k">return</span> <span class="n">data</span>
<span class="k">def</span> <span class="nf">set_info</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">information_class</span><span class="p">,</span> <span class="n">data</span><span class="p">):</span>
<span class="n">winproxy</span><span class="o">.</span><span class="n">NtSetInformationProcess</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">information_class</span><span class="p">,</span> <span class="n">byref</span><span class="p">(</span><span class="n">data</span><span class="p">),</span> <span class="n">sizeof</span><span class="p">(</span><span class="n">data</span><span class="p">))</span>
<span class="k">def</span> <span class="nf">get_priority</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">PRIORITY_CLASS_MAPPER</span><span class="p">[</span><span class="n">winproxy</span><span class="o">.</span><span class="n">GetPriorityClass</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">)]</span>
<span class="k">def</span> <span class="nf">set_priority</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">priority</span><span class="p">):</span>
<span class="k">return</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">SetPriorityClass</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">priority</span><span class="p">)</span>
<span class="n">priority</span> <span class="o">=</span> <span class="nb">property</span><span class="p">(</span><span class="n">get_priority</span><span class="p">,</span> <span class="n">set_priority</span><span class="p">)</span>
<span class="w"> </span><span class="sd">&quot;&quot;&quot;The priority of the process&quot;&quot;&quot;</span>
<span class="k">def</span> <span class="nf">open_token</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">flags</span><span class="o">=</span><span class="n">MAXIMUM_ALLOWED</span><span class="p">):</span>
<span class="w"> </span><span class="sd">&quot;&quot;&quot;Open the process Token</span>
<span class="sd"> :returns: :class:`~windows.winobject.token.Token`</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="n">token_handle</span> <span class="o">=</span> <span class="n">HANDLE</span><span class="p">()</span>
<span class="n">winproxy</span><span class="o">.</span><span class="n">OpenProcessToken</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">limited_handle</span><span class="p">,</span> <span class="n">flags</span><span class="p">,</span> <span class="n">byref</span><span class="p">(</span><span class="n">token_handle</span><span class="p">))</span>
<span class="k">return</span> <span class="n">token</span><span class="o">.</span><span class="n">Token</span><span class="p">(</span><span class="n">token_handle</span><span class="o">.</span><span class="n">value</span><span class="p">)</span>
<span class="n">token</span> <span class="o">=</span> <span class="nb">property</span><span class="p">(</span><span class="n">open_token</span><span class="p">,</span> <span class="n">doc</span><span class="o">=</span><span class="s2">&quot;The process :class:`~windows.winobject.token.Token`&quot;</span><span class="p">)</span>
<span class="k">def</span> <span class="nf">get_security_descriptor</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">query_sacl</span><span class="o">=</span><span class="kc">False</span><span class="p">,</span> <span class="n">flags</span><span class="o">=</span><span class="n">security</span><span class="o">.</span><span class="n">SecurityDescriptor</span><span class="o">.</span><span class="n">DEFAULT_SECURITY_INFORMATION</span><span class="p">):</span>
<span class="n">open_flags</span> <span class="o">=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">READ_CONTROL</span>
<span class="k">if</span> <span class="n">query_sacl</span><span class="p">:</span>
<span class="n">open_flags</span> <span class="o">|=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">ACCESS_SYSTEM_SECURITY</span>
<span class="n">tmp_handle</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">OpenProcess</span><span class="p">(</span><span class="n">open_flags</span><span class="p">,</span> <span class="mi">0</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">pid</span><span class="p">)</span>
<span class="k">try</span><span class="p">:</span>
<span class="k">return</span> <span class="n">security</span><span class="o">.</span><span class="n">SecurityDescriptor</span><span class="o">.</span><span class="n">from_handle</span><span class="p">(</span><span class="n">tmp_handle</span><span class="p">,</span> <span class="n">query_sacl</span><span class="o">=</span><span class="n">query_sacl</span><span class="p">,</span> <span class="n">flags</span><span class="o">=</span><span class="n">flags</span><span class="p">,</span> <span class="n">obj_type</span><span class="o">=</span><span class="s2">&quot;process&quot;</span><span class="p">)</span>
<span class="k">finally</span><span class="p">:</span>
<span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">CloseHandle</span><span class="p">(</span><span class="n">tmp_handle</span><span class="p">)</span>
<span class="k">def</span> <span class="nf">set_security_descriptor</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">sd</span><span class="p">):</span>
<span class="k">if</span> <span class="nb">isinstance</span><span class="p">(</span><span class="n">sd</span><span class="p">,</span> <span class="n">basestring</span><span class="p">):</span>
<span class="n">sd</span> <span class="o">=</span> <span class="n">security</span><span class="o">.</span><span class="n">SecurityDescriptor</span><span class="o">.</span><span class="n">from_string</span><span class="p">(</span><span class="n">sd</span><span class="p">)</span>
<span class="n">open_flags</span> <span class="o">=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">WRITE_OWNER</span> <span class="o">|</span> <span class="n">gdef</span><span class="o">.</span><span class="n">WRITE_DAC</span>
<span class="k">if</span> <span class="p">(</span><span class="n">sd</span><span class="o">.</span><span class="n">sacl</span> <span class="ow">and</span>
<span class="nb">any</span><span class="p">(</span><span class="n">ace</span><span class="o">.</span><span class="n">Header</span><span class="o">.</span><span class="n">AceType</span> <span class="o">!=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">SYSTEM_MANDATORY_LABEL_ACE_TYPE</span> <span class="k">for</span> <span class="n">ace</span> <span class="ow">in</span> <span class="n">sd</span><span class="o">.</span><span class="n">sacl</span><span class="p">)):</span>
<span class="c1"># Print error if requested but no SecurityPrivilege ?</span>
<span class="n">open_flags</span> <span class="o">|=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">ACCESS_SYSTEM_SECURITY</span>
<span class="n">tmp_handle</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">OpenProcess</span><span class="p">(</span><span class="n">open_flags</span><span class="p">,</span> <span class="mi">0</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">pid</span><span class="p">)</span>
<span class="k">try</span><span class="p">:</span>
<span class="n">sd</span><span class="o">.</span><span class="n">_apply_to_handle_and_type</span><span class="p">(</span><span class="n">tmp_handle</span><span class="p">,</span> <span class="n">gdef</span><span class="o">.</span><span class="n">SE_KERNEL_OBJECT</span><span class="p">)</span>
<span class="k">finally</span><span class="p">:</span>
<span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">CloseHandle</span><span class="p">(</span><span class="n">tmp_handle</span><span class="p">)</span>
<span class="n">security_descriptor</span> <span class="o">=</span> <span class="nb">property</span><span class="p">(</span><span class="n">get_security_descriptor</span><span class="p">,</span> <span class="n">set_security_descriptor</span><span class="p">)</span>
<span class="nd">@property</span> <span class="c1"># Document ?</span>
<span class="k">def</span> <span class="nf">handles</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="n">pid</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">pid</span>
<span class="k">return</span> <span class="p">[</span><span class="n">h</span> <span class="k">for</span> <span class="n">h</span> <span class="ow">in</span> <span class="n">windows</span><span class="o">.</span><span class="n">system</span><span class="o">.</span><span class="n">handles</span> <span class="k">if</span> <span class="n">h</span><span class="o">.</span><span class="n">dwProcessId</span> <span class="o">==</span> <span class="n">pid</span><span class="p">]</span>
<span class="k">def</span> <span class="fm">__del__</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="c1"># sys.path is not None -&gt; check if python shutdown</span>
<span class="k">if</span> <span class="n">sys</span><span class="o">.</span><span class="n">path</span> <span class="ow">is</span> <span class="ow">not</span> <span class="kc">None</span> <span class="ow">and</span> <span class="nb">hasattr</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="s2">&quot;_limited_handle&quot;</span><span class="p">)</span> <span class="ow">and</span> <span class="bp">self</span><span class="o">.</span><span class="n">_limited_handle</span><span class="p">:</span>
<span class="c1"># Same logic that AutoHandle.__del__ for Process.limited_handle</span>
<span class="c1"># Assert that Process inherit AutoHandle</span>
<span class="c1"># Call super after check as Process could be None during destruction</span>
<span class="nb">super</span><span class="p">(</span><span class="n">Process</span><span class="p">,</span> <span class="bp">self</span><span class="p">)</span><span class="o">.</span><span class="fm">__del__</span><span class="p">()</span>
<span class="c1"># Prevent some bug where dbgprint might be None when __del__ is called in a closing process</span>
<span class="c1"># This line is bad -&gt; it reopens a handle closed by &#39;super(Process, self).__del__()&#39; ._.</span>
<span class="n">dbgprint</span><span class="p">(</span><span class="s2">&quot;Closing limited handle </span><span class="si">{0}</span><span class="s2"> for </span><span class="si">{1}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="nb">hex</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">_limited_handle</span><span class="p">),</span> <span class="bp">self</span><span class="p">),</span> <span class="s2">&quot;HANDLE&quot;</span><span class="p">)</span> <span class="k">if</span> <span class="n">dbgprint</span> <span class="ow">is</span> <span class="ow">not</span> <span class="kc">None</span> <span class="k">else</span> <span class="kc">None</span>
<span class="bp">self</span><span class="o">.</span><span class="n">_close_function</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">_limited_handle</span><span class="p">)</span>
<span class="k">class</span> <span class="nc">Thread</span><span class="p">(</span><span class="n">utils</span><span class="o">.</span><span class="n">AutoHandle</span><span class="p">):</span>
<span class="k">def</span> <span class="nf">open_token</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">flags</span><span class="o">=</span><span class="n">MAXIMUM_ALLOWED</span><span class="p">,</span> <span class="n">as_self</span><span class="o">=</span><span class="kc">False</span><span class="p">):</span>
<span class="w"> </span><span class="sd">&quot;&quot;&quot;Open the Thread token if any (Impersonation) else return None.</span>
<span class="sd"> ``as_self`` tells which security context should be used</span>
<span class="sd"> :returns: :class:`~windows.winobject.token.Token`</span>
<span class="sd"> .. note::</span>
<span class="sd"> see https://docs.microsoft.com/en-us/windows/desktop/api/processthreadsapi/nf-processthreadsapi-openthreadtoken</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="n">token_handle</span> <span class="o">=</span> <span class="n">HANDLE</span><span class="p">()</span>
<span class="k">try</span><span class="p">:</span>
<span class="n">winproxy</span><span class="o">.</span><span class="n">OpenThreadToken</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">flags</span><span class="p">,</span> <span class="n">as_self</span><span class="p">,</span> <span class="n">byref</span><span class="p">(</span><span class="n">token_handle</span><span class="p">))</span>
<span class="k">except</span> <span class="ne">WindowsError</span> <span class="k">as</span> <span class="n">e</span><span class="p">:</span>
<span class="k">if</span> <span class="n">e</span><span class="o">.</span><span class="n">winerror</span> <span class="o">==</span> <span class="n">gdef</span><span class="o">.</span><span class="n">ERROR_NO_TOKEN</span><span class="p">:</span>
<span class="c1"># No token to open: return None</span>
<span class="k">return</span> <span class="kc">None</span>
<span class="k">raise</span>
<span class="k">return</span> <span class="n">token</span><span class="o">.</span><span class="n">Token</span><span class="p">(</span><span class="n">token_handle</span><span class="o">.</span><span class="n">value</span><span class="p">)</span>
<span class="k">def</span> <span class="nf">set_token</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">token</span><span class="p">):</span>
<span class="w"> </span><span class="sd">&quot;&quot;&quot;Set the token for the thread (impersonation). Setting the token to None revert the impersonation&quot;&quot;&quot;</span>
<span class="n">thandle</span> <span class="o">=</span> <span class="nb">getattr</span><span class="p">(</span><span class="n">token</span><span class="p">,</span> <span class="s2">&quot;handle&quot;</span><span class="p">,</span> <span class="n">token</span><span class="p">)</span> <span class="c1"># Accept raw handle &amp; token object</span>
<span class="k">return</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">SetThreadToken</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">thandle</span><span class="p">)</span>
<span class="n">_TOKEN_PROPERTY_DOC</span> <span class="o">=</span> <span class="s2">&quot;&quot;&quot;The thread :class:`~windows.winobject.token.Token`</span>
<span class="s2"> :getter: :func:`open_token`</span>
<span class="s2"> :setter: :func:`set_token`</span>
<span class="s2"> &quot;&quot;&quot;</span>
<span class="n">token</span> <span class="o">=</span> <span class="nb">property</span><span class="p">(</span><span class="n">open_token</span><span class="p">,</span> <span class="n">set_token</span><span class="p">,</span> <span class="n">doc</span><span class="o">=</span><span class="n">_TOKEN_PROPERTY_DOC</span><span class="p">)</span>
<div class="viewcode-block" id="CurrentThread">
<a class="viewcode-back" href="../../../process.html#windows.winobject.process.CurrentThread">[docs]</a>
<span class="k">class</span> <span class="nc">CurrentThread</span><span class="p">(</span><span class="n">Thread</span><span class="p">):</span>
<span class="w"> </span><span class="sd">&quot;&quot;&quot;The current thread&quot;&quot;&quot;</span>
<span class="n">get_teb_code_by_architecture</span> <span class="o">=</span> <span class="p">{</span>
<span class="n">gdef</span><span class="o">.</span><span class="n">IMAGE_FILE_MACHINE_I386</span><span class="p">:</span> <span class="n">x86</span><span class="o">.</span><span class="n">assemble</span><span class="p">(</span><span class="s2">&quot;mov eax, fs:[0x18]; ret&quot;</span><span class="p">),</span>
<span class="n">gdef</span><span class="o">.</span><span class="n">IMAGE_FILE_MACHINE_AMD64</span><span class="p">:</span> <span class="n">x64</span><span class="o">.</span><span class="n">assemble</span><span class="p">(</span><span class="s2">&quot;mov rax, gs:[0x30]; ret&quot;</span><span class="p">),</span>
<span class="n">gdef</span><span class="o">.</span><span class="n">IMAGE_FILE_MACHINE_ARM64</span><span class="p">:</span> <span class="n">arm64</span><span class="o">.</span><span class="n">assemble</span><span class="p">(</span><span class="s2">&quot;mov x0, x18; ret&quot;</span><span class="p">)</span>
<span class="p">}</span>
<span class="nd">@property</span> <span class="c1">#It&#39;s not a fixedproperty because executing thread might change</span>
<span class="k">def</span> <span class="nf">tid</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="w"> </span><span class="sd">&quot;&quot;&quot;Thread ID</span>
<span class="sd"> :type: :class:`int`</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="k">return</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">GetCurrentThreadId</span><span class="p">()</span>
<span class="nd">@property</span> <span class="c1">#It&#39;s not a fixedproperty because executing thread might change</span>
<span class="k">def</span> <span class="nf">teb_base</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="n">get_teb_base_code</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">get_teb_code_by_architecture</span><span class="p">[</span><span class="bp">self</span><span class="o">.</span><span class="n">owner</span><span class="o">.</span><span class="n">architecture</span><span class="p">]</span>
<span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">owner</span><span class="o">.</span><span class="n">execute</span><span class="p">(</span><span class="n">get_teb_base_code</span><span class="p">)</span>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">teb</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="k">return</span> <span class="n">TEB</span><span class="o">.</span><span class="n">from_address</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">teb_base</span><span class="p">)</span>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">owner</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="w"> </span><span class="sd">&quot;&quot;&quot;The current process</span>
<span class="sd"> :type: :class:`CurrentProcess`</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="k">return</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span>
<span class="k">def</span> <span class="nf">_get_handle</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="k">return</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">GetCurrentThread</span><span class="p">()</span>
<span class="k">def</span> <span class="fm">__del__</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="k">pass</span>
<div class="viewcode-block" id="CurrentThread.exit">
<a class="viewcode-back" href="../../../process.html#windows.winobject.process.CurrentThread.exit">[docs]</a>
<span class="k">def</span> <span class="nf">exit</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">code</span><span class="o">=</span><span class="mi">0</span><span class="p">):</span>
<span class="w"> </span><span class="sd">&quot;&quot;&quot;Exit the thread&quot;&quot;&quot;</span>
<span class="k">return</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">ExitThread</span><span class="p">(</span><span class="n">code</span><span class="p">)</span></div>
<div class="viewcode-block" id="CurrentThread.wait">
<a class="viewcode-back" href="../../../process.html#windows.winobject.process.CurrentThread.wait">[docs]</a>
<span class="k">def</span> <span class="nf">wait</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">timeout</span><span class="o">=</span><span class="n">INFINITE</span><span class="p">):</span>
<span class="w"> </span><span class="sd">&quot;&quot;&quot;Raise :class:`ValueError` to prevent deadlock :D&quot;&quot;&quot;</span>
<span class="k">raise</span> <span class="ne">ValueError</span><span class="p">(</span><span class="s2">&quot;wait() on current thread&quot;</span><span class="p">)</span></div>
</div>
<div class="viewcode-block" id="CurrentProcess">
<a class="viewcode-back" href="../../../process.html#windows.winobject.process.CurrentProcess">[docs]</a>
<span class="k">class</span> <span class="nc">CurrentProcess</span><span class="p">(</span><span class="n">Process</span><span class="p">):</span>
<span class="w"> </span><span class="sd">&quot;&quot;&quot;The current process&quot;&quot;&quot;</span>
<span class="n">allocator</span> <span class="o">=</span> <span class="n">native_exec</span><span class="o">.</span><span class="n">native_function</span><span class="o">.</span><span class="n">allocator</span>
<span class="k">def</span> <span class="nf">_get_handle</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="k">return</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">GetCurrentProcess</span><span class="p">()</span>
<span class="nd">@utils</span><span class="o">.</span><span class="n">fixedproperty</span>
<span class="k">def</span> <span class="nf">limited_handle</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="k">return</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">GetCurrentProcess</span><span class="p">()</span>
<span class="k">def</span> <span class="fm">__del__</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="k">pass</span>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">pid</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="w"> </span><span class="sd">&quot;&quot;&quot;Process ID</span>
<span class="sd"> :type: :class:`int`</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="k">return</span> <span class="n">os</span><span class="o">.</span><span class="n">getpid</span><span class="p">()</span>
<span class="nd">@utils</span><span class="o">.</span><span class="n">fixedproperty</span> <span class="c1"># leave it has fixed property as we don&#39;t care if CurrentProcess is never collected</span>
<span class="k">def</span> <span class="nf">peb</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="w"> </span><span class="sd">&quot;&quot;&quot;The Process Environment Block of the current process</span>
<span class="sd"> :type: :class:`PEB`</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="k">return</span> <span class="n">PEB</span><span class="o">.</span><span class="n">from_address</span><span class="p">(</span><span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">RtlGetCurrentPeb</span><span class="p">())</span>
<span class="nd">@utils</span><span class="o">.</span><span class="n">fixedproperty</span>
<span class="k">def</span> <span class="nf">bitness</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="w"> </span><span class="sd">&quot;&quot;&quot;The bitness of the process</span>
<span class="sd"> :type: :class:`int` -- 32 or 64</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="k">return</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">gdef</span><span class="o">.</span><span class="n">PVOID</span><span class="p">)</span> <span class="o">*</span> <span class="mi">8</span> <span class="c1"># byte to bits</span>
<div class="viewcode-block" id="CurrentProcess.virtual_alloc">
<a class="viewcode-back" href="../../../process.html#windows.winobject.process.CurrentProcess.virtual_alloc">[docs]</a>
<span class="k">def</span> <span class="nf">virtual_alloc</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">size</span><span class="p">,</span> <span class="n">prot</span><span class="o">=</span><span class="n">PAGE_EXECUTE_READWRITE</span><span class="p">):</span>
<span class="w"> </span><span class="sd">&quot;&quot;&quot;Allocate memory in the process</span>
<span class="sd"> :return: The address of the allocated memory</span>
<span class="sd"> :rtype: :class:`int`</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="k">return</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">VirtualAlloc</span><span class="p">(</span><span class="n">dwSize</span><span class="o">=</span><span class="n">size</span><span class="p">,</span> <span class="n">flProtect</span><span class="o">=</span><span class="n">prot</span><span class="p">)</span></div>
<div class="viewcode-block" id="CurrentProcess.virtual_free">
<a class="viewcode-back" href="../../../process.html#windows.winobject.process.CurrentProcess.virtual_free">[docs]</a>
<span class="k">def</span> <span class="nf">virtual_free</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">addr</span><span class="p">):</span>
<span class="w"> </span><span class="sd">&quot;&quot;&quot;Free memory in the process by virtual_alloc&quot;&quot;&quot;</span>
<span class="k">return</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">VirtualFree</span><span class="p">(</span><span class="n">addr</span><span class="p">)</span></div>
<div class="viewcode-block" id="CurrentProcess.write_memory">
<a class="viewcode-back" href="../../../process.html#windows.winobject.process.CurrentProcess.write_memory">[docs]</a>
<span class="k">def</span> <span class="nf">write_memory</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">addr</span><span class="p">,</span> <span class="n">data</span><span class="p">):</span>
<span class="w"> </span><span class="sd">&quot;&quot;&quot;Write data at addr&quot;&quot;&quot;</span>
<span class="n">data</span> <span class="o">=</span> <span class="nb">bytes</span><span class="p">(</span><span class="n">raw_encode</span><span class="p">(</span><span class="n">data</span><span class="p">))</span> <span class="c1"># We should only accept byte, but we are kind and will try to encode to latin-1 for simple ascii compat</span>
<span class="n">ctypes</span><span class="o">.</span><span class="n">memmove</span><span class="p">(</span><span class="n">addr</span><span class="p">,</span> <span class="n">data</span><span class="p">,</span> <span class="nb">len</span><span class="p">(</span><span class="n">data</span><span class="p">))</span>
<span class="k">return</span> <span class="kc">True</span></div>
<div class="viewcode-block" id="CurrentProcess.read_memory">
<a class="viewcode-back" href="../../../process.html#windows.winobject.process.CurrentProcess.read_memory">[docs]</a>
<span class="k">def</span> <span class="nf">read_memory</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">addr</span><span class="p">,</span> <span class="n">size</span><span class="p">):</span>
<span class="w"> </span><span class="sd">&quot;&quot;&quot;Read ``size`` from ``addr``</span>
<span class="sd"> :return: The data read</span>
<span class="sd"> :rtype: :class:`str`</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="n">dbgprint</span><span class="p">(</span><span class="s1">&#39;Read CurrentProcess Memory&#39;</span><span class="p">,</span> <span class="s1">&#39;READMEM&#39;</span><span class="p">)</span>
<span class="n">buffer</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">c_buffer</span><span class="p">(</span><span class="n">size</span><span class="p">)</span>
<span class="n">ctypes</span><span class="o">.</span><span class="n">memmove</span><span class="p">(</span><span class="n">buffer</span><span class="p">,</span> <span class="n">addr</span><span class="p">,</span> <span class="n">size</span><span class="p">)</span>
<span class="k">return</span> <span class="n">buffer</span><span class="p">[:]</span></div>
<div class="viewcode-block" id="CurrentProcess.create_thread">
<a class="viewcode-back" href="../../../process.html#windows.winobject.process.CurrentProcess.create_thread">[docs]</a>
<span class="k">def</span> <span class="nf">create_thread</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">lpStartAddress</span><span class="p">,</span> <span class="n">lpParameter</span><span class="p">,</span> <span class="n">dwCreationFlags</span><span class="o">=</span><span class="mi">0</span><span class="p">):</span>
<span class="w"> </span><span class="sd">&quot;&quot;&quot;Create a new thread</span>
<span class="sd"> :rtype: :class:`WinThread` or :class:`DeadThread`</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="n">handle</span> <span class="o">=</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">CreateThread</span><span class="p">(</span><span class="n">lpStartAddress</span><span class="o">=</span><span class="n">lpStartAddress</span><span class="p">,</span> <span class="n">lpParameter</span><span class="o">=</span><span class="n">lpParameter</span><span class="p">,</span> <span class="n">dwCreationFlags</span><span class="o">=</span><span class="n">dwCreationFlags</span><span class="p">)</span>
<span class="k">return</span> <span class="n">WinThread</span><span class="o">.</span><span class="n">_from_handle</span><span class="p">(</span><span class="n">handle</span><span class="p">)</span></div>
<div class="viewcode-block" id="CurrentProcess.load_library">
<a class="viewcode-back" href="../../../process.html#windows.winobject.process.CurrentProcess.load_library">[docs]</a>
<span class="k">def</span> <span class="nf">load_library</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">dll_path</span><span class="p">):</span>
<span class="w"> </span><span class="sd">&quot;&quot;&quot;Load the library in current process</span>
<span class="sd"> :rtype: :class:`LoadedModule`</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="n">dllbase</span> <span class="o">=</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">LoadLibraryW</span><span class="p">(</span><span class="n">dll_path</span><span class="p">)</span>
<span class="k">return</span> <span class="p">[</span><span class="n">m</span> <span class="k">for</span> <span class="n">m</span> <span class="ow">in</span> <span class="bp">self</span><span class="o">.</span><span class="n">peb</span><span class="o">.</span><span class="n">modules</span> <span class="k">if</span> <span class="n">m</span><span class="o">.</span><span class="n">baseaddr</span> <span class="o">==</span> <span class="n">dllbase</span><span class="p">][</span><span class="mi">0</span><span class="p">]</span></div>
<div class="viewcode-block" id="CurrentProcess.execute">
<a class="viewcode-back" href="../../../process.html#windows.winobject.process.CurrentProcess.execute">[docs]</a>
<span class="k">def</span> <span class="nf">execute</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">code</span><span class="p">,</span> <span class="n">parameter</span><span class="o">=</span><span class="mi">0</span><span class="p">):</span>
<span class="w"> </span><span class="sd">&quot;&quot;&quot;Execute native code ``code`` in the current thread.</span>
<span class="sd"> :rtype: :class:`int` the return value of the native code&quot;&quot;&quot;</span>
<span class="n">f</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">native_exec</span><span class="o">.</span><span class="n">create_function</span><span class="p">(</span><span class="n">code</span><span class="p">,</span> <span class="p">[</span><span class="n">PVOID</span><span class="p">,</span> <span class="n">PVOID</span><span class="p">])</span>
<span class="k">return</span> <span class="n">f</span><span class="p">(</span><span class="n">parameter</span><span class="p">)</span></div>
<div class="viewcode-block" id="CurrentProcess.exit">
<a class="viewcode-back" href="../../../process.html#windows.winobject.process.CurrentProcess.exit">[docs]</a>
<span class="k">def</span> <span class="nf">exit</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">code</span><span class="o">=</span><span class="mi">0</span><span class="p">):</span>
<span class="w"> </span><span class="sd">&quot;&quot;&quot;Exit the process&quot;&quot;&quot;</span>
<span class="k">return</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">ExitProcess</span><span class="p">(</span><span class="n">code</span><span class="p">)</span></div>
<div class="viewcode-block" id="CurrentProcess.wait">
<a class="viewcode-back" href="../../../process.html#windows.winobject.process.CurrentProcess.wait">[docs]</a>
<span class="k">def</span> <span class="nf">wait</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">timeout</span><span class="o">=</span><span class="n">INFINITE</span><span class="p">):</span>
<span class="w"> </span><span class="sd">&quot;&quot;&quot;Raise :class:`ValueError` to prevent deadlock :D&quot;&quot;&quot;</span>
<span class="k">raise</span> <span class="ne">ValueError</span><span class="p">(</span><span class="s2">&quot;wait() on current thread&quot;</span><span class="p">)</span></div>
<span class="nd">@utils</span><span class="o">.</span><span class="n">fixedproperty</span>
<span class="k">def</span> <span class="nf">peb_syswow</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="w"> </span><span class="sd">&quot;&quot;&quot;The 64bits PEB of a SysWow64 process</span>
<span class="sd"> :type: :class:`PEB`</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="k">if</span> <span class="ow">not</span> <span class="bp">self</span><span class="o">.</span><span class="n">is_wow_64</span><span class="p">:</span>
<span class="k">raise</span> <span class="ne">ValueError</span><span class="p">(</span><span class="s2">&quot;Not a syswow process&quot;</span><span class="p">)</span>
<span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">_is_x86_on_arm64</span><span class="p">:</span>
<span class="k">raise</span> <span class="ne">NotImplementedError</span><span class="p">(</span><span class="s2">&quot;Crossing heaven gate x86 -&gt; arm64 not implemented&quot;</span><span class="p">)</span>
<span class="k">return</span> <span class="n">windows</span><span class="o">.</span><span class="n">syswow64</span><span class="o">.</span><span class="n">get_current_process_syswow_peb</span><span class="p">()</span>
<span class="c1"># TODO: use ctypes.string_at / ctypes.wstring_at for read_string / read_wstring ?</span>
<div class="viewcode-block" id="CurrentProcess.read_string">
<a class="viewcode-back" href="../../../process.html#windows.winobject.process.CurrentProcess.read_string">[docs]</a>
<span class="k">def</span> <span class="nf">read_string</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">addr</span><span class="p">):</span>
<span class="k">return</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">string_at</span><span class="p">(</span><span class="n">addr</span><span class="p">)</span> <span class="c1"># Raises WindowsError on fail</span></div>
<div class="viewcode-block" id="CurrentProcess.read_wstring">
<a class="viewcode-back" href="../../../process.html#windows.winobject.process.CurrentProcess.read_wstring">[docs]</a>
<span class="k">def</span> <span class="nf">read_wstring</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">addr</span><span class="p">):</span>
<span class="k">return</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">wstring_at</span><span class="p">(</span><span class="n">addr</span><span class="p">)</span> <span class="c1"># Raises WindowsError on fail</span></div>
</div>
<div class="viewcode-block" id="WinThread">
<a class="viewcode-back" href="../../../process.html#windows.winobject.process.WinThread">[docs]</a>
<span class="k">class</span> <span class="nc">WinThread</span><span class="p">(</span><span class="n">Thread</span><span class="p">):</span>
<span class="w"> </span><span class="sd">&quot;&quot;&quot;Represent a thread &quot;&quot;&quot;</span>
<span class="k">def</span> <span class="fm">__init__</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">tid</span><span class="o">=</span><span class="kc">None</span><span class="p">,</span> <span class="n">handle</span><span class="o">=</span><span class="kc">None</span><span class="p">,</span> <span class="n">owner_pid</span><span class="o">=</span><span class="kc">None</span><span class="p">,</span> <span class="n">owner</span><span class="o">=</span><span class="kc">None</span><span class="p">):</span>
<span class="k">if</span> <span class="n">tid</span> <span class="ow">is</span> <span class="kc">None</span> <span class="ow">and</span> <span class="n">handle</span> <span class="ow">is</span> <span class="kc">None</span><span class="p">:</span>
<span class="k">raise</span> <span class="ne">ValueError</span><span class="p">(</span><span class="s2">&quot;Need at least &lt;pid&gt; or &lt;handle&gt; to create a </span><span class="si">{0}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="nb">type</span><span class="p">(</span><span class="bp">self</span><span class="p">)</span><span class="o">.</span><span class="vm">__name__</span><span class="p">))</span>
<span class="k">if</span> <span class="n">tid</span> <span class="ow">is</span> <span class="ow">not</span> <span class="kc">None</span><span class="p">:</span> <span class="bp">self</span><span class="o">.</span><span class="n">_tid</span> <span class="o">=</span> <span class="n">tid</span>
<span class="k">if</span> <span class="n">handle</span> <span class="ow">is</span> <span class="ow">not</span> <span class="kc">None</span><span class="p">:</span> <span class="bp">self</span><span class="o">.</span><span class="n">_handle</span> <span class="o">=</span> <span class="n">handle</span>
<span class="k">if</span> <span class="n">owner</span> <span class="ow">is</span> <span class="ow">not</span> <span class="kc">None</span><span class="p">:</span> <span class="bp">self</span><span class="o">.</span><span class="n">_owner</span> <span class="o">=</span> <span class="n">owner</span>
<span class="k">if</span> <span class="n">owner_pid</span> <span class="ow">is</span> <span class="ow">not</span> <span class="kc">None</span><span class="p">:</span> <span class="bp">self</span><span class="o">.</span><span class="n">_owner_pid</span> <span class="o">=</span> <span class="n">owner_pid</span>
<span class="k">if</span> <span class="n">owner_pid</span> <span class="ow">is</span> <span class="kc">None</span> <span class="ow">and</span> <span class="n">owner</span><span class="p">:</span>
<span class="bp">self</span><span class="o">.</span><span class="n">_owner_pid</span> <span class="o">=</span> <span class="n">owner</span><span class="o">.</span><span class="n">pid</span>
<span class="nd">@classmethod</span>
<span class="k">def</span> <span class="nf">_from_THREADENTRY32</span><span class="p">(</span><span class="bp">cls</span><span class="p">,</span> <span class="n">entry</span><span class="p">,</span> <span class="n">owner</span><span class="o">=</span><span class="kc">None</span><span class="p">):</span>
<span class="n">tid</span> <span class="o">=</span> <span class="n">entry</span><span class="o">.</span><span class="n">th32ThreadID</span>
<span class="n">owner_pid</span> <span class="o">=</span> <span class="n">entry</span><span class="o">.</span><span class="n">th32OwnerProcessID</span>
<span class="k">return</span> <span class="bp">cls</span><span class="p">(</span><span class="n">tid</span><span class="o">=</span><span class="n">tid</span><span class="p">,</span> <span class="n">owner_pid</span><span class="o">=</span><span class="n">owner_pid</span><span class="p">,</span> <span class="n">owner</span><span class="o">=</span><span class="n">owner</span><span class="p">)</span>
<span class="nd">@classmethod</span>
<span class="k">def</span> <span class="nf">_from_handle</span><span class="p">(</span><span class="bp">cls</span><span class="p">,</span> <span class="n">handle</span><span class="p">):</span>
<span class="c1"># Create a DeadThread if thread is already dead ?</span>
<span class="k">return</span> <span class="n">WinThread</span><span class="p">(</span><span class="n">handle</span><span class="o">=</span><span class="n">handle</span><span class="p">)</span>
<span class="nd">@utils</span><span class="o">.</span><span class="n">fixedproperty</span>
<span class="k">def</span> <span class="nf">tid</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="w"> </span><span class="sd">&quot;&quot;&quot;Thread ID</span>
<span class="sd"> :type: :class:`int`&quot;&quot;&quot;</span>
<span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">_get_thread_id</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">)</span>
<span class="nd">@utils</span><span class="o">.</span><span class="n">fixedproperty</span>
<span class="k">def</span> <span class="nf">owner_pid</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="n">res</span> <span class="o">=</span> <span class="n">THREAD_BASIC_INFORMATION</span><span class="p">()</span>
<span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">NtQueryInformationThread</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">ThreadBasicInformation</span><span class="p">,</span> <span class="n">byref</span><span class="p">(</span><span class="n">res</span><span class="p">),</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">res</span><span class="p">))</span>
<span class="n">owner_id</span> <span class="o">=</span> <span class="n">res</span><span class="o">.</span><span class="n">ClientId</span><span class="o">.</span><span class="n">UniqueProcess</span>
<span class="k">return</span> <span class="n">owner_id</span>
<span class="nd">@utils</span><span class="o">.</span><span class="n">fixedproperty</span>
<span class="k">def</span> <span class="nf">owner</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="w"> </span><span class="sd">&quot;&quot;&quot;The Process owning the thread</span>
<span class="sd"> :type: :class:`WinProcess`</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="k">return</span> <span class="n">WinProcess</span><span class="p">(</span><span class="n">pid</span><span class="o">=</span><span class="bp">self</span><span class="o">.</span><span class="n">owner_pid</span><span class="p">)</span>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">context</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="w"> </span><span class="sd">&quot;&quot;&quot;The context of the thread, type depend of the target process.</span>
<span class="sd"> :type: :class:`windows.exception.ECONTEXT32` or :class:`windows.exception.ECONTEXT64` or :class:`windows.exception.ECONTEXTWOW64`</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">owner</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">32</span> <span class="ow">and</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">64</span><span class="p">:</span>
<span class="c1"># Wow64</span>
<span class="n">x</span> <span class="o">=</span> <span class="n">exception</span><span class="o">.</span><span class="n">ECONTEXTWOW64</span><span class="p">()</span>
<span class="n">x</span><span class="o">.</span><span class="n">ContextFlags</span> <span class="o">=</span> <span class="n">CONTEXT_ALL</span>
<span class="n">winproxy</span><span class="o">.</span><span class="n">Wow64GetThreadContext</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">x</span><span class="p">)</span>
<span class="k">return</span> <span class="n">x</span>
<span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">owner</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">64</span> <span class="ow">and</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">32</span><span class="p">:</span>
<span class="n">x</span> <span class="o">=</span> <span class="n">exception</span><span class="o">.</span><span class="n">ECONTEXT64</span><span class="o">.</span><span class="n">new_aligned</span><span class="p">()</span>
<span class="n">x</span><span class="o">.</span><span class="n">ContextFlags</span> <span class="o">=</span> <span class="n">CONTEXT_ALL</span>
<span class="n">windows</span><span class="o">.</span><span class="n">syswow64</span><span class="o">.</span><span class="n">NtGetContextThread_32_to_64</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">x</span><span class="p">)</span>
<span class="k">return</span> <span class="n">x</span>
<span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">owner</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">32</span><span class="p">:</span>
<span class="n">x</span> <span class="o">=</span> <span class="n">exception</span><span class="o">.</span><span class="n">ECONTEXT32</span><span class="p">()</span>
<span class="k">else</span><span class="p">:</span>
<span class="n">x</span> <span class="o">=</span> <span class="n">exception</span><span class="o">.</span><span class="n">ECONTEXT64</span><span class="o">.</span><span class="n">new_aligned</span><span class="p">()</span>
<span class="n">x</span><span class="o">.</span><span class="n">ContextFlags</span> <span class="o">=</span> <span class="n">CONTEXT_ALL</span>
<span class="n">winproxy</span><span class="o">.</span><span class="n">GetThreadContext</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">x</span><span class="p">)</span>
<span class="k">return</span> <span class="n">x</span>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">context_syswow</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="w"> </span><span class="sd">&quot;&quot;&quot;The 64 bits context of a syswow thread.</span>
<span class="sd"> :type: :class:`windows.exception.ECONTEXT64`</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="k">if</span> <span class="ow">not</span> <span class="bp">self</span><span class="o">.</span><span class="n">owner</span><span class="o">.</span><span class="n">is_wow_64</span><span class="p">:</span>
<span class="k">raise</span> <span class="ne">ValueError</span><span class="p">(</span><span class="s2">&quot;Not a syswow process&quot;</span><span class="p">)</span>
<span class="n">x</span> <span class="o">=</span> <span class="n">exception</span><span class="o">.</span><span class="n">ECONTEXT64</span><span class="o">.</span><span class="n">new_aligned</span><span class="p">()</span>
<span class="n">x</span><span class="o">.</span><span class="n">ContextFlags</span> <span class="o">=</span> <span class="n">CONTEXT_ALL</span>
<span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">64</span><span class="p">:</span>
<span class="n">winproxy</span><span class="o">.</span><span class="n">GetThreadContext</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">x</span><span class="p">)</span>
<span class="k">else</span><span class="p">:</span>
<span class="n">windows</span><span class="o">.</span><span class="n">syswow64</span><span class="o">.</span><span class="n">NtGetContextThread_32_to_64</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">x</span><span class="p">)</span>
<span class="k">return</span> <span class="n">x</span>
<div class="viewcode-block" id="WinThread.set_context">
<a class="viewcode-back" href="../../../process.html#windows.winobject.process.WinThread.set_context">[docs]</a>
<span class="k">def</span> <span class="nf">set_context</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">context</span><span class="p">):</span>
<span class="w"> </span><span class="sd">&quot;&quot;&quot;Set the thread&#39;s context to ``context``&quot;&quot;&quot;</span>
<span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">owner</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">bitness</span><span class="p">:</span>
<span class="k">return</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">SetThreadContext</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">context</span><span class="p">)</span>
<span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">64</span> <span class="ow">and</span> <span class="bp">self</span><span class="o">.</span><span class="n">owner</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">32</span><span class="p">:</span>
<span class="k">return</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">Wow64SetThreadContext</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">context</span><span class="p">)</span>
<span class="k">return</span> <span class="n">windows</span><span class="o">.</span><span class="n">syswow64</span><span class="o">.</span><span class="n">NtSetContextThread_32_to_64</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">byref</span><span class="p">(</span><span class="n">context</span><span class="p">))</span></div>
<div class="viewcode-block" id="WinThread.set_syswow_context">
<a class="viewcode-back" href="../../../process.html#windows.winobject.process.WinThread.set_syswow_context">[docs]</a>
<span class="k">def</span> <span class="nf">set_syswow_context</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">context</span><span class="p">):</span>
<span class="w"> </span><span class="sd">&quot;&quot;&quot;Set a syswow thread&#39;s 64 context to ``context``&quot;&quot;&quot;</span>
<span class="k">if</span> <span class="ow">not</span> <span class="bp">self</span><span class="o">.</span><span class="n">owner</span><span class="o">.</span><span class="n">is_wow_64</span><span class="p">:</span>
<span class="k">raise</span> <span class="ne">ValueError</span><span class="p">(</span><span class="s2">&quot;Not a syswow process&quot;</span><span class="p">)</span>
<span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">64</span><span class="p">:</span>
<span class="k">return</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">SetThreadContext</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">context</span><span class="p">)</span>
<span class="k">return</span> <span class="n">windows</span><span class="o">.</span><span class="n">syswow64</span><span class="o">.</span><span class="n">NtSetContextThread_32_to_64</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">byref</span><span class="p">(</span><span class="n">context</span><span class="p">))</span></div>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">start_address</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="w"> </span><span class="sd">&quot;&quot;&quot;The start address of the thread</span>
<span class="sd"> :type: :class:`int`</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">32</span> <span class="ow">and</span> <span class="bp">self</span><span class="o">.</span><span class="n">owner</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">64</span><span class="p">:</span>
<span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">_is_x86_on_arm64</span><span class="p">:</span>
<span class="k">raise</span> <span class="ne">NotImplementedError</span><span class="p">(</span><span class="s2">&quot;Crossing heaven gate x86 -&gt; arm64 not implemented&quot;</span><span class="p">)</span>
<span class="n">res</span> <span class="o">=</span> <span class="n">ULONGLONG</span><span class="p">()</span>
<span class="n">windows</span><span class="o">.</span><span class="n">syswow64</span><span class="o">.</span><span class="n">NtQueryInformationThread_32_to_64</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">ThreadQuerySetWin32StartAddress</span><span class="p">,</span> <span class="n">byref</span><span class="p">(</span><span class="n">res</span><span class="p">),</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">res</span><span class="p">))</span>
<span class="k">return</span> <span class="n">res</span><span class="o">.</span><span class="n">value</span>
<span class="n">res_size</span> <span class="o">=</span> <span class="nb">max</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">owner</span><span class="o">.</span><span class="n">bitness</span><span class="p">,</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">bitness</span><span class="p">)</span>
<span class="k">if</span> <span class="n">res_size</span> <span class="o">==</span> <span class="mi">32</span><span class="p">:</span>
<span class="n">res</span> <span class="o">=</span> <span class="n">ULONG</span><span class="p">()</span>
<span class="k">else</span><span class="p">:</span>
<span class="n">res</span> <span class="o">=</span> <span class="n">ULONGLONG</span><span class="p">()</span>
<span class="n">winproxy</span><span class="o">.</span><span class="n">NtQueryInformationThread</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">ThreadQuerySetWin32StartAddress</span><span class="p">,</span> <span class="n">byref</span><span class="p">(</span><span class="n">res</span><span class="p">),</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">res</span><span class="p">))</span>
<span class="k">return</span> <span class="n">res</span><span class="o">.</span><span class="n">value</span>
<span class="k">def</span> <span class="nf">_get_principal_teb_addr</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="c1"># Returns the 64bits TEB on a 64bits computer (syswow process or not)</span>
<span class="c1"># Returns the 32bits TEB on a 32bits computer</span>
<span class="c1"># If we are wow64 process its means we either</span>
<span class="c1"># - Want the TEB of a 64b process</span>
<span class="c1"># - Want the TEB64 of a Wowprocess</span>
<span class="c1"># It&#39;s the same code for both</span>
<span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">_is_x86_on_arm64</span><span class="p">:</span>
<span class="k">raise</span> <span class="ne">NotImplementedError</span><span class="p">(</span><span class="s2">&quot;Crossing heaven gate x86 -&gt; arm64 not implemented&quot;</span><span class="p">)</span>
<span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">is_wow_64</span><span class="p">:</span>
<span class="n">restype</span> <span class="o">=</span> <span class="n">rctypes</span><span class="o">.</span><span class="n">transform_type_to_remote64bits</span><span class="p">(</span><span class="n">THREAD_BASIC_INFORMATION</span><span class="p">)</span>
<span class="n">ressize</span> <span class="o">=</span> <span class="p">(</span><span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">restype</span><span class="p">))</span>
<span class="c1"># Manual aligned allocation :DDDD</span>
<span class="n">nb_qword</span> <span class="o">=</span> <span class="nb">int</span><span class="p">((</span><span class="n">ressize</span> <span class="o">+</span> <span class="mi">8</span><span class="p">)</span> <span class="o">/</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">ULONGLONG</span><span class="p">))</span>
<span class="n">buffer</span> <span class="o">=</span> <span class="p">(</span><span class="n">nb_qword</span> <span class="o">*</span> <span class="n">ULONGLONG</span><span class="p">)()</span>
<span class="n">struct_address</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">addressof</span><span class="p">(</span><span class="n">buffer</span><span class="p">)</span>
<span class="k">if</span> <span class="p">(</span><span class="n">struct_address</span> <span class="o">&amp;</span> <span class="mh">0xf</span><span class="p">)</span> <span class="ow">not</span> <span class="ow">in</span> <span class="p">[</span><span class="mi">0</span><span class="p">,</span> <span class="mi">8</span><span class="p">]:</span>
<span class="k">raise</span> <span class="ne">ValueError</span><span class="p">(</span><span class="s2">&quot;ULONGLONG array not aligned on 8&quot;</span><span class="p">)</span>
<span class="n">windows</span><span class="o">.</span><span class="n">syswow64</span><span class="o">.</span><span class="n">NtQueryInformationThread_32_to_64</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">ThreadBasicInformation</span><span class="p">,</span> <span class="n">struct_address</span><span class="p">,</span> <span class="n">ressize</span><span class="p">)</span>
<span class="k">return</span> <span class="n">restype</span><span class="p">(</span><span class="n">struct_address</span><span class="p">,</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="p">)</span><span class="o">.</span><span class="n">TebBaseAddress</span>
<span class="n">res</span> <span class="o">=</span> <span class="n">THREAD_BASIC_INFORMATION</span><span class="p">()</span>
<span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">NtQueryInformationThread</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">ThreadBasicInformation</span><span class="p">,</span> <span class="n">byref</span><span class="p">(</span><span class="n">res</span><span class="p">),</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">res</span><span class="p">))</span>
<span class="k">return</span> <span class="n">res</span><span class="o">.</span><span class="n">TebBaseAddress</span>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">teb_base</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="w"> </span><span class="sd">&quot;&quot;&quot;The address of the thread&#39;s TEB. If the owner is a SysWow64 process, return the TEB32.</span>
<span class="sd"> :type: :class:`int`</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="n">main_teb_addr</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">_get_principal_teb_addr</span><span class="p">()</span>
<span class="k">if</span> <span class="ow">not</span> <span class="bp">self</span><span class="o">.</span><span class="n">owner</span><span class="o">.</span><span class="n">is_wow_64</span><span class="p">:</span>
<span class="k">return</span> <span class="n">main_teb_addr</span>
<span class="c1"># TEB32 is pointed at the begining of the TEB64</span>
<span class="c1"># TebBase-&gt;NtTib.ExceptionList = (PVOID)Teb32Base;</span>
<span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">owner</span><span class="o">.</span><span class="n">read_dword</span><span class="p">(</span><span class="n">main_teb_addr</span><span class="p">)</span>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">teb</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">owner</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">32</span><span class="p">:</span>
<span class="k">return</span> <span class="n">RemoteTEB32</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">teb_base</span><span class="p">,</span> <span class="n">target</span><span class="o">=</span><span class="bp">self</span><span class="o">.</span><span class="n">owner</span><span class="p">)</span>
<span class="k">return</span> <span class="n">RemoteTEB64</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">teb_base</span><span class="p">,</span> <span class="n">target</span><span class="o">=</span><span class="bp">self</span><span class="o">.</span><span class="n">owner</span><span class="p">)</span>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">teb_syswow_base</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="w"> </span><span class="sd">&quot;&quot;&quot;The address of the thread&#39;s TEB64 for a SysWow64 process</span>
<span class="sd"> :type: :class:`int`</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="k">if</span> <span class="ow">not</span> <span class="bp">self</span><span class="o">.</span><span class="n">owner</span><span class="o">.</span><span class="n">is_wow_64</span><span class="p">:</span>
<span class="k">raise</span> <span class="ne">ValueError</span><span class="p">(</span><span class="s2">&quot;Not a syswow process&quot;</span><span class="p">)</span>
<span class="c1"># just return the main TEB</span>
<span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">_get_principal_teb_addr</span><span class="p">()</span>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">teb_syswow</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">64</span><span class="p">:</span>
<span class="k">return</span> <span class="n">RemoteTEB64</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">teb_syswow_base</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">owner</span><span class="p">)</span>
<span class="k">else</span><span class="p">:</span> <span class="c1">#current is 32bits</span>
<span class="k">return</span> <span class="n">RemoteTEB64</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">teb_syswow_base</span><span class="p">,</span> <span class="n">windows</span><span class="o">.</span><span class="n">syswow64</span><span class="o">.</span><span class="n">ReadSyswow64Process</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">owner</span><span class="p">))</span>
<div class="viewcode-block" id="WinThread.exit">
<a class="viewcode-back" href="../../../process.html#windows.winobject.process.WinThread.exit">[docs]</a>
<span class="k">def</span> <span class="nf">exit</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">code</span><span class="o">=</span><span class="mi">0</span><span class="p">):</span>
<span class="w"> </span><span class="sd">&quot;&quot;&quot;Exit the thread&quot;&quot;&quot;</span>
<span class="k">return</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">TerminateThread</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">code</span><span class="p">)</span></div>
<div class="viewcode-block" id="WinThread.resume">
<a class="viewcode-back" href="../../../process.html#windows.winobject.process.WinThread.resume">[docs]</a>
<span class="k">def</span> <span class="nf">resume</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="w"> </span><span class="sd">&quot;&quot;&quot;Resume the thread&quot;&quot;&quot;</span>
<span class="k">return</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">ResumeThread</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">)</span></div>
<div class="viewcode-block" id="WinThread.suspend">
<a class="viewcode-back" href="../../../process.html#windows.winobject.process.WinThread.suspend">[docs]</a>
<span class="k">def</span> <span class="nf">suspend</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="w"> </span><span class="sd">&quot;&quot;&quot;Suspend the thread&quot;&quot;&quot;</span>
<span class="k">return</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">SuspendThread</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">)</span></div>
<span class="k">def</span> <span class="nf">_get_handle</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="k">return</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">OpenThread</span><span class="p">(</span><span class="n">dwThreadId</span><span class="o">=</span><span class="bp">self</span><span class="o">.</span><span class="n">tid</span><span class="p">)</span>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">is_exit</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="w"> </span><span class="sd">&quot;&quot;&quot;``True`` if the thread is terminated</span>
<span class="sd"> :type: :class:`bool`</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">exit_code</span> <span class="o">!=</span> <span class="n">STILL_ACTIVE</span>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">exit_code</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="w"> </span><span class="sd">&quot;&quot;&quot;The exit code of the thread : ``STILL_ACTIVE`` means the process is not dead</span>
<span class="sd"> :type: :class:`int`</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="n">res</span> <span class="o">=</span> <span class="n">DWORD</span><span class="p">()</span>
<span class="n">winproxy</span><span class="o">.</span><span class="n">GetExitCodeThread</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">byref</span><span class="p">(</span><span class="n">res</span><span class="p">))</span>
<span class="k">return</span> <span class="n">res</span><span class="o">.</span><span class="n">value</span>
<span class="k">def</span> <span class="fm">__repr__</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="n">owner</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">owner</span>
<span class="k">if</span> <span class="n">owner</span> <span class="ow">is</span> <span class="kc">None</span><span class="p">:</span>
<span class="n">owner_name</span> <span class="o">=</span> <span class="s2">&quot;&lt;Dead process with pid </span><span class="si">{0}</span><span class="s2">&gt;&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="nb">hex</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">th32OwnerProcessID</span><span class="p">))</span>
<span class="k">else</span><span class="p">:</span>
<span class="k">try</span><span class="p">:</span>
<span class="n">owner_name</span> <span class="o">=</span> <span class="n">owner</span><span class="o">.</span><span class="n">name</span>
<span class="k">except</span> <span class="ne">EnvironmentError</span><span class="p">:</span>
<span class="n">owner_name</span> <span class="o">=</span> <span class="s2">&quot;!cannot-retrieve-owner-name&quot;</span>
<span class="k">return</span> <span class="n">urepr_encode</span><span class="p">(</span><span class="sa">u</span><span class="s1">&#39;&lt;</span><span class="si">{0}</span><span class="s1"> </span><span class="si">{1}</span><span class="s1"> owner &quot;</span><span class="si">{2}</span><span class="s1">&quot; at </span><span class="si">{3}</span><span class="s1">&gt;&#39;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="vm">__class__</span><span class="o">.</span><span class="vm">__name__</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">tid</span><span class="p">,</span> <span class="n">owner_name</span><span class="p">,</span> <span class="nb">hex</span><span class="p">(</span><span class="nb">id</span><span class="p">(</span><span class="bp">self</span><span class="p">))))</span>
<span class="nd">@staticmethod</span>
<span class="k">def</span> <span class="nf">_get_thread_id_by_api</span><span class="p">(</span><span class="n">handle</span><span class="p">):</span>
<span class="k">return</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">GetThreadId</span><span class="p">(</span><span class="n">handle</span><span class="p">)</span>
<span class="nd">@staticmethod</span>
<span class="k">def</span> <span class="nf">_get_thread_id_manual</span><span class="p">(</span><span class="n">handle</span><span class="p">):</span>
<span class="n">res</span> <span class="o">=</span> <span class="n">THREAD_BASIC_INFORMATION</span><span class="p">()</span>
<span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">NtQueryInformationThread</span><span class="p">(</span><span class="n">handle</span><span class="p">,</span> <span class="n">ThreadBasicInformation</span><span class="p">,</span> <span class="n">byref</span><span class="p">(</span><span class="n">res</span><span class="p">),</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">res</span><span class="p">))</span>
<span class="n">id2</span> <span class="o">=</span> <span class="n">res</span><span class="o">.</span><span class="n">ClientId</span><span class="o">.</span><span class="n">UniqueThread</span>
<span class="k">return</span> <span class="n">id2</span>
<span class="k">if</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">is_implemented</span><span class="p">(</span><span class="n">winproxy</span><span class="o">.</span><span class="n">GetThreadId</span><span class="p">):</span>
<span class="n">_get_thread_id</span> <span class="o">=</span> <span class="n">_get_thread_id_by_api</span>
<span class="k">else</span><span class="p">:</span>
<span class="n">_get_thread_id</span> <span class="o">=</span> <span class="n">_get_thread_id_manual</span></div>
<div class="viewcode-block" id="WinProcess">
<a class="viewcode-back" href="../../../process.html#windows.winobject.process.WinProcess">[docs]</a>
<span class="k">class</span> <span class="nc">WinProcess</span><span class="p">(</span><span class="n">Process</span><span class="p">):</span>
<span class="w"> </span><span class="sd">&quot;&quot;&quot;A Process on the system&quot;&quot;&quot;</span>
<span class="k">def</span> <span class="fm">__init__</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">pid</span><span class="o">=</span><span class="kc">None</span><span class="p">,</span> <span class="n">handle</span><span class="o">=</span><span class="kc">None</span><span class="p">,</span> <span class="n">name</span><span class="o">=</span><span class="kc">None</span><span class="p">,</span> <span class="n">ppid</span><span class="o">=</span><span class="kc">None</span><span class="p">):</span>
<span class="k">if</span> <span class="n">pid</span> <span class="ow">is</span> <span class="kc">None</span> <span class="ow">and</span> <span class="n">handle</span> <span class="ow">is</span> <span class="kc">None</span><span class="p">:</span>
<span class="k">raise</span> <span class="ne">ValueError</span><span class="p">(</span><span class="s2">&quot;Need at least &lt;pid&gt; or &lt;handle&gt; to create a </span><span class="si">{0}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="nb">type</span><span class="p">(</span><span class="bp">self</span><span class="p">)</span><span class="o">.</span><span class="vm">__name__</span><span class="p">))</span>
<span class="k">if</span> <span class="n">pid</span> <span class="ow">is</span> <span class="ow">not</span> <span class="kc">None</span><span class="p">:</span> <span class="bp">self</span><span class="o">.</span><span class="n">_pid</span> <span class="o">=</span> <span class="n">pid</span>
<span class="k">if</span> <span class="n">handle</span> <span class="ow">is</span> <span class="ow">not</span> <span class="kc">None</span><span class="p">:</span> <span class="bp">self</span><span class="o">.</span><span class="n">_handle</span> <span class="o">=</span> <span class="n">handle</span>
<span class="k">if</span> <span class="n">name</span> <span class="ow">is</span> <span class="ow">not</span> <span class="kc">None</span><span class="p">:</span> <span class="bp">self</span><span class="o">.</span><span class="n">_name</span> <span class="o">=</span> <span class="n">name</span>
<span class="k">if</span> <span class="n">ppid</span> <span class="ow">is</span> <span class="ow">not</span> <span class="kc">None</span><span class="p">:</span> <span class="bp">self</span><span class="o">.</span><span class="n">_ppid</span> <span class="o">=</span> <span class="n">ppid</span>
<span class="nd">@staticmethod</span>
<span class="k">def</span> <span class="nf">_from_handle</span><span class="p">(</span><span class="n">handle</span><span class="p">):</span>
<span class="c1">#pid = winproxy.GetProcessId(handle)</span>
<span class="c1">#proc = [p for p in windows.system.processes if p.pid == pid][0]</span>
<span class="c1">#proc._handle = handle</span>
<span class="c1">#dbgprint(&quot;Process {0} from handle {1}&quot;.format(proc, hex(handle)), &quot;HANDLE&quot;)</span>
<span class="k">return</span> <span class="n">WinProcess</span><span class="p">(</span><span class="n">handle</span><span class="o">=</span><span class="n">handle</span><span class="p">)</span>
<span class="nd">@classmethod</span>
<span class="k">def</span> <span class="nf">_from_PROCESSENTRY32W</span><span class="p">(</span><span class="bp">cls</span><span class="p">,</span> <span class="n">entry</span><span class="p">):</span>
<span class="n">name</span> <span class="o">=</span> <span class="n">entry</span><span class="o">.</span><span class="n">szExeFile</span>
<span class="n">pid</span> <span class="o">=</span> <span class="n">entry</span><span class="o">.</span><span class="n">th32ProcessID</span>
<span class="n">ppid</span> <span class="o">=</span> <span class="n">entry</span><span class="o">.</span><span class="n">th32ParentProcessID</span>
<span class="k">return</span> <span class="bp">cls</span><span class="p">(</span><span class="n">pid</span><span class="o">=</span><span class="n">pid</span><span class="p">,</span> <span class="n">name</span><span class="o">=</span><span class="n">name</span><span class="p">,</span> <span class="n">ppid</span><span class="o">=</span><span class="n">ppid</span><span class="p">)</span>
<span class="nd">@utils</span><span class="o">.</span><span class="n">fixedproperty</span>
<span class="k">def</span> <span class="nf">pid</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="w"> </span><span class="sd">&quot;&quot;&quot;Process ID</span>
<span class="sd"> :type: :class:`int`</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="k">return</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">GetProcessId</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">)</span>
<span class="k">def</span> <span class="nf">_get_handle</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="k">return</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">OpenProcess</span><span class="p">(</span><span class="n">dwProcessId</span><span class="o">=</span><span class="bp">self</span><span class="o">.</span><span class="n">pid</span><span class="p">)</span>
<span class="k">def</span> <span class="fm">__repr__</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="k">try</span><span class="p">:</span>
<span class="n">exe_name</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">name</span>
<span class="k">except</span> <span class="ne">WindowsError</span> <span class="k">as</span> <span class="n">e</span><span class="p">:</span>
<span class="n">exe_name</span> <span class="o">=</span> <span class="sa">u</span><span class="s2">&quot;!cannot-retrieve-name&quot;</span>
<span class="k">try</span><span class="p">:</span>
<span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">is_exit</span><span class="p">:</span>
<span class="k">return</span> <span class="n">urepr_encode</span><span class="p">(</span><span class="sa">u</span><span class="s1">&#39;&lt;</span><span class="si">{0}</span><span class="s1"> &quot;</span><span class="si">{1}</span><span class="s1">&quot; pid </span><span class="si">{2}</span><span class="s1"> (DEAD) at </span><span class="si">{3}</span><span class="s1">&gt;&#39;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="vm">__class__</span><span class="o">.</span><span class="vm">__name__</span><span class="p">,</span> <span class="n">exe_name</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">pid</span><span class="p">,</span> <span class="nb">hex</span><span class="p">(</span><span class="nb">id</span><span class="p">(</span><span class="bp">self</span><span class="p">))))</span>
<span class="k">except</span> <span class="ne">WindowsError</span><span class="p">:</span> <span class="c1"># Cannot open process</span>
<span class="k">pass</span>
<span class="k">return</span> <span class="n">urepr_encode</span><span class="p">(</span><span class="sa">u</span><span class="s1">&#39;&lt;</span><span class="si">{0}</span><span class="s1"> &quot;</span><span class="si">{1}</span><span class="s1">&quot; pid </span><span class="si">{2}</span><span class="s1"> at </span><span class="si">{3}</span><span class="s1">&gt;&#39;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="vm">__class__</span><span class="o">.</span><span class="vm">__name__</span><span class="p">,</span> <span class="n">exe_name</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">pid</span><span class="p">,</span> <span class="nb">hex</span><span class="p">(</span><span class="nb">id</span><span class="p">(</span><span class="bp">self</span><span class="p">))))</span>
<div class="viewcode-block" id="WinProcess.virtual_alloc">
<a class="viewcode-back" href="../../../process.html#windows.winobject.process.WinProcess.virtual_alloc">[docs]</a>
<span class="k">def</span> <span class="nf">virtual_alloc</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">size</span><span class="p">,</span> <span class="n">prot</span><span class="o">=</span><span class="n">PAGE_EXECUTE_READWRITE</span><span class="p">,</span> <span class="n">addr</span><span class="o">=</span><span class="kc">None</span><span class="p">,</span> <span class="nb">type</span><span class="o">=</span><span class="n">gdef</span><span class="o">.</span><span class="n">MEM_COMMIT</span><span class="p">):</span>
<span class="w"> </span><span class="sd">&quot;&quot;&quot;Allocate memory in the process</span>
<span class="sd"> :return: The address of the allocated memory</span>
<span class="sd"> :rtype: :class:`int`</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="k">return</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">VirtualAllocEx</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">lpAddress</span><span class="o">=</span><span class="n">addr</span><span class="p">,</span> <span class="n">dwSize</span><span class="o">=</span><span class="n">size</span><span class="p">,</span> <span class="n">flAllocationType</span><span class="o">=</span><span class="nb">type</span><span class="p">,</span> <span class="n">flProtect</span><span class="o">=</span><span class="n">prot</span><span class="p">)</span></div>
<div class="viewcode-block" id="WinProcess.virtual_free">
<a class="viewcode-back" href="../../../process.html#windows.winobject.process.WinProcess.virtual_free">[docs]</a>
<span class="k">def</span> <span class="nf">virtual_free</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">addr</span><span class="p">):</span>
<span class="w"> </span><span class="sd">&quot;&quot;&quot;Free memory in the process by virtual_alloc&quot;&quot;&quot;</span>
<span class="k">return</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">VirtualFreeEx</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">addr</span><span class="p">)</span></div>
<div class="viewcode-block" id="WinProcess.write_memory">
<a class="viewcode-back" href="../../../process.html#windows.winobject.process.WinProcess.write_memory">[docs]</a>
<span class="k">def</span> <span class="nf">write_memory</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">addr</span><span class="p">,</span> <span class="n">data</span><span class="p">):</span>
<span class="w"> </span><span class="sd">&quot;&quot;&quot;Write `data` at `addr`&quot;&quot;&quot;</span>
<span class="n">data</span> <span class="o">=</span> <span class="n">raw_encode</span><span class="p">(</span><span class="n">data</span><span class="p">)</span> <span class="c1"># We should only accept byte, but we are kind and will try to encode to latin-1 for simple ascii compat</span>
<span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">32</span> <span class="ow">and</span> <span class="bp">self</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">64</span><span class="p">:</span>
<span class="k">if</span> <span class="ow">not</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">is_implemented</span><span class="p">(</span><span class="n">winproxy</span><span class="o">.</span><span class="n">NtWow64WriteVirtualMemory64</span><span class="p">):</span>
<span class="k">raise</span> <span class="ne">ValueError</span><span class="p">(</span><span class="s2">&quot;NtWow64WriteVirtualMemory64 non available in ntdll: cannot write into 64bits processus&quot;</span><span class="p">)</span>
<span class="k">return</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">NtWow64WriteVirtualMemory64</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">addr</span><span class="p">,</span> <span class="n">data</span><span class="p">,</span> <span class="nb">len</span><span class="p">(</span><span class="n">data</span><span class="p">))</span>
<span class="k">return</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">WriteProcessMemory</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">addr</span><span class="p">,</span> <span class="n">lpBuffer</span><span class="o">=</span><span class="n">data</span><span class="p">)</span></div>
<span class="k">def</span> <span class="nf">low_read_memory</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">addr</span><span class="p">,</span> <span class="n">buffer_addr</span><span class="p">,</span> <span class="n">size</span><span class="p">):</span>
<span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">32</span> <span class="ow">and</span> <span class="bp">self</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">64</span><span class="p">:</span>
<span class="c1"># OptionalExport can be None (see winproxy.py)</span>
<span class="k">if</span> <span class="ow">not</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">is_implemented</span><span class="p">(</span><span class="n">winproxy</span><span class="o">.</span><span class="n">NtWow64ReadVirtualMemory64</span><span class="p">):</span>
<span class="k">raise</span> <span class="ne">ValueError</span><span class="p">(</span><span class="s2">&quot;NtWow64ReadVirtualMemory64 non available in ntdll: cannot read into 64bits processus&quot;</span><span class="p">)</span>
<span class="k">return</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">NtWow64ReadVirtualMemory64</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">addr</span><span class="p">,</span> <span class="n">buffer_addr</span><span class="p">,</span> <span class="n">size</span><span class="p">)</span>
<span class="c1">#if self.is_wow_64 and addr &gt; 0xffffffff:</span>
<span class="c1"># return winproxy.NtWow64ReadVirtualMemory64(self.handle, addr, buffer_addr, size)</span>
<span class="k">return</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">ReadProcessMemory</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">addr</span><span class="p">,</span> <span class="n">lpBuffer</span><span class="o">=</span><span class="n">buffer_addr</span><span class="p">,</span> <span class="n">nSize</span><span class="o">=</span><span class="n">size</span><span class="p">)</span>
<div class="viewcode-block" id="WinProcess.read_memory">
<a class="viewcode-back" href="../../../process.html#windows.winobject.process.WinProcess.read_memory">[docs]</a>
<span class="k">def</span> <span class="nf">read_memory</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">addr</span><span class="p">,</span> <span class="n">size</span><span class="p">):</span>
<span class="w"> </span><span class="sd">&quot;&quot;&quot;Read ``size`` from ``addr``</span>
<span class="sd"> :return: The data read</span>
<span class="sd"> :rtype: :class:`str`</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="n">buffer</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">create_string_buffer</span><span class="p">(</span><span class="n">size</span><span class="p">)</span>
<span class="bp">self</span><span class="o">.</span><span class="n">low_read_memory</span><span class="p">(</span><span class="n">addr</span><span class="p">,</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">byref</span><span class="p">(</span><span class="n">buffer</span><span class="p">),</span> <span class="n">size</span><span class="p">)</span>
<span class="k">return</span> <span class="n">buffer</span><span class="p">[:]</span></div>
<span class="c1"># Simple cache test</span>
<span class="c1"># real_read = read_memory</span>
<span class="c1">#</span>
<span class="c1"># def read_memory(self, addr, size):</span>
<span class="c1"># &quot;&quot;&quot;Cached version for test&quot;&quot;&quot;</span>
<span class="c1"># dbgprint(&#39;Read remote Memory of {0}&#39;.format(self), &#39;READMEM&#39;)</span>
<span class="c1"># if not hasattr(self, &quot;_cache_cache&quot;):</span>
<span class="c1"># self._cache_cache = {}</span>
<span class="c1"># page_addr = addr &amp; 0xfffffffffffff000</span>
<span class="c1"># if page_addr in self._cache_cache:</span>
<span class="c1"># #print(&quot;CACHED Read on page {0}&quot;.format(hex(page_addr)))</span>
<span class="c1"># page_data = self._cache_cache[page_addr]</span>
<span class="c1"># return page_data[addr &amp; 0xfff: (addr &amp; 0xfff) + size]</span>
<span class="c1"># else:</span>
<span class="c1"># page_data = self.real_read(page_addr, 0x1000)</span>
<span class="c1"># self._cache_cache[page_addr] = page_data</span>
<span class="c1"># return page_data[addr &amp; 0xfff: (addr &amp; 0xfff) + size]</span>
<div class="viewcode-block" id="WinProcess.read_memory_into">
<a class="viewcode-back" href="../../../process.html#windows.winobject.process.WinProcess.read_memory_into">[docs]</a>
<span class="k">def</span> <span class="nf">read_memory_into</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">addr</span><span class="p">,</span> <span class="n">struct</span><span class="p">):</span>
<span class="w"> </span><span class="sd">&quot;&quot;&quot;Read a :mod:`ctypes` struct from `addr`</span>
<span class="sd"> :returns: struct</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="bp">self</span><span class="o">.</span><span class="n">low_read_memory</span><span class="p">(</span><span class="n">addr</span><span class="p">,</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">byref</span><span class="p">(</span><span class="n">struct</span><span class="p">),</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">struct</span><span class="p">))</span>
<span class="k">return</span> <span class="n">struct</span></div>
<div class="viewcode-block" id="WinProcess.create_thread">
<a class="viewcode-back" href="../../../process.html#windows.winobject.process.WinProcess.create_thread">[docs]</a>
<span class="k">def</span> <span class="nf">create_thread</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">addr</span><span class="p">,</span> <span class="n">param</span><span class="p">):</span>
<span class="w"> </span><span class="sd">&quot;&quot;&quot;Create a remote thread</span>
<span class="sd"> :rtype: :class:`WinThread` or :class:`DeadThread`</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="c1"># We are using NtCreateThreadEx as its more permissive about cross-bitness / cross-architecture</span>
<span class="c1"># And we can asume we known what we are doing -&gt; So no safeguard ;)</span>
<span class="n">thread_handle</span> <span class="o">=</span> <span class="n">HANDLE</span><span class="p">()</span>
<span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">32</span> <span class="ow">and</span> <span class="bp">self</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">64</span><span class="p">:</span>
<span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">_is_x86_on_arm64</span><span class="p">:</span>
<span class="k">raise</span> <span class="ne">NotImplementedError</span><span class="p">(</span><span class="s2">&quot;Crossing heaven gate x86 -&gt; arm64 not implemented&quot;</span><span class="p">)</span>
<span class="n">windows</span><span class="o">.</span><span class="n">syswow64</span><span class="o">.</span><span class="n">NtCreateThreadEx_32_to_64</span><span class="p">(</span><span class="n">ThreadHandle</span><span class="o">=</span><span class="n">byref</span><span class="p">(</span><span class="n">thread_handle</span><span class="p">)</span> <span class="p">,</span><span class="n">ProcessHandle</span><span class="o">=</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">lpStartAddress</span><span class="o">=</span><span class="n">addr</span><span class="p">,</span> <span class="n">lpParameter</span><span class="o">=</span><span class="n">param</span><span class="p">)</span>
<span class="k">else</span><span class="p">:</span>
<span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">NtCreateThreadEx</span><span class="p">(</span><span class="n">ThreadHandle</span><span class="o">=</span><span class="n">byref</span><span class="p">(</span><span class="n">thread_handle</span><span class="p">)</span> <span class="p">,</span><span class="n">ProcessHandle</span><span class="o">=</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">lpStartAddress</span><span class="o">=</span><span class="n">addr</span><span class="p">,</span> <span class="n">lpParameter</span><span class="o">=</span><span class="n">param</span><span class="p">)</span>
<span class="k">return</span> <span class="n">WinThread</span><span class="o">.</span><span class="n">_from_handle</span><span class="p">(</span><span class="n">thread_handle</span><span class="o">.</span><span class="n">value</span><span class="p">)</span></div>
<div class="viewcode-block" id="WinProcess.load_library">
<a class="viewcode-back" href="../../../process.html#windows.winobject.process.WinProcess.load_library">[docs]</a>
<span class="k">def</span> <span class="nf">load_library</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">dll_path</span><span class="p">):</span>
<span class="w"> </span><span class="sd">&quot;&quot;&quot;Load the library in remote process</span>
<span class="sd"> :rtype: :class:`LoadedModule`</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="n">dllbase</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">injection</span><span class="o">.</span><span class="n">load_dll_in_remote_process</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">dll_path</span><span class="p">)</span>
<span class="k">return</span> <span class="p">[</span><span class="n">m</span> <span class="k">for</span> <span class="n">m</span> <span class="ow">in</span> <span class="bp">self</span><span class="o">.</span><span class="n">peb</span><span class="o">.</span><span class="n">modules</span> <span class="k">if</span> <span class="n">m</span><span class="o">.</span><span class="n">baseaddr</span> <span class="o">==</span> <span class="n">dllbase</span><span class="p">][</span><span class="mi">0</span><span class="p">]</span></div>
<div class="viewcode-block" id="WinProcess.execute_python">
<a class="viewcode-back" href="../../../process.html#windows.winobject.process.WinProcess.execute_python">[docs]</a>
<span class="k">def</span> <span class="nf">execute_python</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">pycode</span><span class="p">):</span>
<span class="w"> </span><span class="sd">&quot;&quot;&quot;Execute Python code in the remote process.</span>
<span class="sd"> This function waits for the remote process to end and</span>
<span class="sd"> raises an exception if the remote thread raised one</span>
<span class="sd"> .. note::</span>
<span class="sd"> This method is incompatible with Microsoft Store builds of python, as the interpreter DLLs do not grant execute to Users.</span>
<span class="sd"> See workaround: https://hakril.github.io/PythonForWindows/build/html/sample.html#microsoft-store-python-injection</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="k">return</span> <span class="n">injection</span><span class="o">.</span><span class="n">safe_execute_python</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">pycode</span><span class="p">)</span></div>
<div class="viewcode-block" id="WinProcess.execute_python_unsafe">
<a class="viewcode-back" href="../../../process.html#windows.winobject.process.WinProcess.execute_python_unsafe">[docs]</a>
<span class="k">def</span> <span class="nf">execute_python_unsafe</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">pycode</span><span class="p">):</span>
<span class="w"> </span><span class="sd">&quot;&quot;&quot;Execute Python code in the remote process.</span>
<span class="sd"> :rtype: :rtype: :class:`WinThread` or :class:`DeadThread` : The thread executing the python code</span>
<span class="sd"> .. note::</span>
<span class="sd"> This method is incompatible with Microsoft Store builds of python, as the interpreter DLLs do not grant execute to Users.</span>
<span class="sd"> See workaround: https://hakril.github.io/PythonForWindows/build/html/sample.html#microsoft-store-python-injection</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="k">return</span> <span class="n">injection</span><span class="o">.</span><span class="n">execute_python_code</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">pycode</span><span class="p">)</span></div>
<span class="nd">@utils</span><span class="o">.</span><span class="n">fixedproperty</span>
<span class="k">def</span> <span class="nf">peb_addr</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="w"> </span><span class="sd">&quot;&quot;&quot;The address of the PEB.</span>
<span class="sd"> :type: :class:`int`</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">_is_x86_on_arm64</span> <span class="ow">and</span> <span class="ow">not</span> <span class="bp">self</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">32</span><span class="p">:</span>
<span class="k">raise</span> <span class="ne">NotImplementedError</span><span class="p">(</span><span class="s2">&quot;Crossing heaven gate x86 -&gt; arm64 not implemented&quot;</span><span class="p">)</span>
<span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">32</span> <span class="ow">and</span> <span class="bp">self</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">64</span><span class="p">:</span> <span class="c1"># Intel to Intel</span>
<span class="n">x</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">remotectypes</span><span class="o">.</span><span class="n">transform_type_to_remote64bits</span><span class="p">(</span><span class="n">PROCESS_BASIC_INFORMATION</span><span class="p">)</span>
<span class="c1"># Fuck-it &lt;3</span>
<span class="n">data</span> <span class="o">=</span> <span class="p">(</span><span class="n">ctypes</span><span class="o">.</span><span class="n">c_char</span> <span class="o">*</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">x</span><span class="p">))()</span>
<span class="n">windows</span><span class="o">.</span><span class="n">syswow64</span><span class="o">.</span><span class="n">NtQueryInformationProcess_32_to_64</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">gdef</span><span class="o">.</span><span class="n">ProcessBasicInformation</span><span class="p">,</span> <span class="n">ProcessInformation</span><span class="o">=</span><span class="n">data</span><span class="p">)</span>
<span class="n">peb_offset</span> <span class="o">=</span> <span class="n">x</span><span class="o">.</span><span class="n">PebBaseAddress</span><span class="o">.</span><span class="n">offset</span>
<span class="n">peb_addr</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">unpack</span><span class="p">(</span><span class="s2">&quot;&lt;Q&quot;</span><span class="p">,</span> <span class="n">data</span><span class="p">[</span><span class="n">x</span><span class="o">.</span><span class="n">PebBaseAddress</span><span class="o">.</span><span class="n">offset</span><span class="p">:</span> <span class="n">x</span><span class="o">.</span><span class="n">PebBaseAddress</span><span class="o">.</span><span class="n">offset</span><span class="o">+</span><span class="mi">8</span><span class="p">])[</span><span class="mi">0</span><span class="p">]</span>
<span class="k">elif</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">64</span> <span class="ow">and</span> <span class="bp">self</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">32</span><span class="p">:</span>
<span class="n">y</span> <span class="o">=</span> <span class="n">ULONGLONG</span><span class="p">()</span>
<span class="n">winproxy</span><span class="o">.</span><span class="n">NtQueryInformationProcess</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">gdef</span><span class="o">.</span><span class="n">ProcessWow64Information</span><span class="p">,</span> <span class="n">byref</span><span class="p">(</span><span class="n">y</span><span class="p">),</span> <span class="n">sizeof</span><span class="p">(</span><span class="n">y</span><span class="p">))</span>
<span class="n">peb_addr</span> <span class="o">=</span> <span class="n">y</span><span class="o">.</span><span class="n">value</span>
<span class="k">else</span><span class="p">:</span>
<span class="n">x</span> <span class="o">=</span> <span class="n">PROCESS_BASIC_INFORMATION</span><span class="p">()</span>
<span class="n">winproxy</span><span class="o">.</span><span class="n">NtQueryInformationProcess</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">gdef</span><span class="o">.</span><span class="n">ProcessBasicInformation</span><span class="p">,</span> <span class="n">x</span><span class="p">)</span>
<span class="n">peb_addr</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">cast</span><span class="p">(</span><span class="n">x</span><span class="o">.</span><span class="n">PebBaseAddress</span><span class="p">,</span> <span class="n">PVOID</span><span class="p">)</span><span class="o">.</span><span class="n">value</span>
<span class="k">if</span> <span class="n">peb_addr</span> <span class="ow">is</span> <span class="kc">None</span><span class="p">:</span>
<span class="k">raise</span> <span class="ne">ValueError</span><span class="p">(</span><span class="s2">&quot;Could not get peb addr of process </span><span class="si">{0}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">name</span><span class="p">))</span>
<span class="k">return</span> <span class="n">peb_addr</span>
<span class="c1"># Not a fixedproperty to prevent ref-cycle and uncollectable WinProcess</span>
<span class="c1"># Try with a weakref ?</span>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">peb</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="w"> </span><span class="sd">&quot;&quot;&quot;The PEB of the process (see :mod:`remotectypes`)</span>
<span class="sd"> :type: :class:`PEB`</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">32</span> <span class="ow">and</span> <span class="bp">self</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">64</span><span class="p">:</span>
<span class="k">return</span> <span class="n">RemotePEB64</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">peb_addr</span><span class="p">,</span> <span class="bp">self</span><span class="p">)</span>
<span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">64</span> <span class="ow">and</span> <span class="bp">self</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">32</span><span class="p">:</span>
<span class="k">return</span> <span class="n">RemotePEB32</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">peb_addr</span><span class="p">,</span> <span class="bp">self</span><span class="p">)</span>
<span class="k">return</span> <span class="n">RemotePEB</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">peb_addr</span><span class="p">,</span> <span class="bp">self</span><span class="p">)</span>
<span class="nd">@utils</span><span class="o">.</span><span class="n">fixedproperty</span>
<span class="k">def</span> <span class="nf">peb_syswow_addr</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="k">if</span> <span class="ow">not</span> <span class="bp">self</span><span class="o">.</span><span class="n">is_wow_64</span><span class="p">:</span>
<span class="k">raise</span> <span class="ne">ValueError</span><span class="p">(</span><span class="s2">&quot;Not a syswow process&quot;</span><span class="p">)</span>
<span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">_is_x86_on_arm64</span><span class="p">:</span>
<span class="k">raise</span> <span class="ne">NotImplementedError</span><span class="p">(</span><span class="s2">&quot;Crossing heaven gate x86 -&gt; arm64 not implemented&quot;</span><span class="p">)</span>
<span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">64</span><span class="p">:</span>
<span class="n">information_type</span> <span class="o">=</span> <span class="mi">0</span>
<span class="n">x</span> <span class="o">=</span> <span class="n">PROCESS_BASIC_INFORMATION</span><span class="p">()</span>
<span class="n">winproxy</span><span class="o">.</span><span class="n">NtQueryInformationProcess</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">information_type</span><span class="p">,</span> <span class="n">x</span><span class="p">)</span>
<span class="n">peb_addr</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">cast</span><span class="p">(</span><span class="n">x</span><span class="o">.</span><span class="n">PebBaseAddress</span><span class="p">,</span> <span class="n">PVOID</span><span class="p">)</span><span class="o">.</span><span class="n">value</span>
<span class="k">return</span> <span class="n">peb_addr</span>
<span class="k">else</span><span class="p">:</span> <span class="c1">#current is 32bits</span>
<span class="n">x</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">remotectypes</span><span class="o">.</span><span class="n">transform_type_to_remote64bits</span><span class="p">(</span><span class="n">PROCESS_BASIC_INFORMATION</span><span class="p">)</span>
<span class="c1"># Fuck-it &lt;3</span>
<span class="n">data</span> <span class="o">=</span> <span class="p">(</span><span class="n">ctypes</span><span class="o">.</span><span class="n">c_char</span> <span class="o">*</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">x</span><span class="p">))()</span>
<span class="n">windows</span><span class="o">.</span><span class="n">syswow64</span><span class="o">.</span><span class="n">NtQueryInformationProcess_32_to_64</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">ProcessInformation</span><span class="o">=</span><span class="n">data</span><span class="p">,</span> <span class="n">ProcessInformationLength</span><span class="o">=</span><span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">x</span><span class="p">))</span>
<span class="n">peb_offset</span> <span class="o">=</span> <span class="n">x</span><span class="o">.</span><span class="n">PebBaseAddress</span><span class="o">.</span><span class="n">offset</span>
<span class="n">peb_addr</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">unpack</span><span class="p">(</span><span class="s2">&quot;&lt;Q&quot;</span><span class="p">,</span> <span class="n">data</span><span class="p">[</span><span class="n">x</span><span class="o">.</span><span class="n">PebBaseAddress</span><span class="o">.</span><span class="n">offset</span><span class="p">:</span> <span class="n">x</span><span class="o">.</span><span class="n">PebBaseAddress</span><span class="o">.</span><span class="n">offset</span><span class="o">+</span><span class="mi">8</span><span class="p">])[</span><span class="mi">0</span><span class="p">]</span>
<span class="k">return</span> <span class="n">peb_addr</span>
<span class="c1"># Not a fixedproperty to prevent ref-cycle and uncollectable WinProcess</span>
<span class="c1"># Try with a weakref ?</span>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">peb_syswow</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="w"> </span><span class="sd">&quot;&quot;&quot;The 64bits PEB of a SysWow64 process</span>
<span class="sd"> :type: :class:`PEB`</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="k">if</span> <span class="ow">not</span> <span class="bp">self</span><span class="o">.</span><span class="n">is_wow_64</span><span class="p">:</span>
<span class="k">raise</span> <span class="ne">ValueError</span><span class="p">(</span><span class="s2">&quot;Not a syswow process&quot;</span><span class="p">)</span>
<span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">64</span><span class="p">:</span>
<span class="k">return</span> <span class="n">RemotePEB</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">peb_syswow_addr</span><span class="p">,</span> <span class="bp">self</span><span class="p">)</span>
<span class="k">else</span><span class="p">:</span> <span class="c1">#current is 32bits</span>
<span class="k">return</span> <span class="n">RemotePEB64</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">peb_syswow_addr</span><span class="p">,</span> <span class="n">windows</span><span class="o">.</span><span class="n">syswow64</span><span class="o">.</span><span class="n">ReadSyswow64Process</span><span class="p">(</span><span class="bp">self</span><span class="p">))</span>
<div class="viewcode-block" id="WinProcess.exit">
<a class="viewcode-back" href="../../../process.html#windows.winobject.process.WinProcess.exit">[docs]</a>
<span class="k">def</span> <span class="nf">exit</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">code</span><span class="o">=</span><span class="mi">0</span><span class="p">):</span>
<span class="w"> </span><span class="sd">&quot;&quot;&quot;Exit the process&quot;&quot;&quot;</span>
<span class="k">return</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">TerminateProcess</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">code</span><span class="p">)</span></div>
</div>
<span class="k">def</span> <span class="nf">transform_ctypes_fields</span><span class="p">(</span><span class="n">struct</span><span class="p">,</span> <span class="n">replacement</span><span class="p">):</span>
<span class="k">return</span> <span class="p">[(</span><span class="n">name</span><span class="p">,</span> <span class="n">replacement</span><span class="o">.</span><span class="n">get</span><span class="p">(</span><span class="n">name</span><span class="p">,</span> <span class="nb">type</span><span class="p">))</span> <span class="k">for</span> <span class="n">name</span><span class="p">,</span> <span class="nb">type</span> <span class="ow">in</span> <span class="n">struct</span><span class="o">.</span><span class="n">_fields_</span><span class="p">]</span>
<div class="viewcode-block" id="LoadedModule">
<a class="viewcode-back" href="../../../process.html#windows.winobject.process.LoadedModule">[docs]</a>
<span class="k">class</span> <span class="nc">LoadedModule</span><span class="p">(</span><span class="n">LDR_DATA_TABLE_ENTRY</span><span class="p">):</span>
<span class="w"> </span><span class="sd">&quot;&quot;&quot;An entry in the PEB Ldr list&quot;&quot;&quot;</span>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">baseaddr</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="w"> </span><span class="sd">&quot;&quot;&quot;Base address of the module</span>
<span class="sd"> :type: :class:`int`</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">DllBase</span>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">name</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="w"> </span><span class="sd">&quot;&quot;&quot;Name of the module</span>
<span class="sd"> :type: :class:`str`</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">BaseDllName</span><span class="o">.</span><span class="n">str</span><span class="o">.</span><span class="n">lower</span><span class="p">()</span>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">fullname</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="w"> </span><span class="sd">&quot;&quot;&quot;Full name of the module (path)</span>
<span class="sd"> :type: :class:`str`</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">FullDllName</span><span class="o">.</span><span class="n">str</span><span class="o">.</span><span class="n">lower</span><span class="p">()</span>
<span class="k">def</span> <span class="fm">__repr__</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="k">return</span> <span class="n">urepr_encode</span><span class="p">(</span><span class="sa">u</span><span class="s1">&#39;&lt;</span><span class="si">{0}</span><span class="s1"> &quot;</span><span class="si">{1}</span><span class="s1">&quot; at </span><span class="si">{2}</span><span class="s1">&gt;&#39;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="vm">__class__</span><span class="o">.</span><span class="vm">__name__</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">name</span><span class="p">,</span> <span class="nb">hex</span><span class="p">(</span><span class="nb">id</span><span class="p">(</span><span class="bp">self</span><span class="p">))))</span>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">pe</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="w"> </span><span class="sd">&quot;&quot;&quot;A PE representation of the module</span>
<span class="sd"> :type: :class:`windows.pe_parse.PEFile`</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="k">return</span> <span class="n">pe_parse</span><span class="o">.</span><span class="n">GetPEFile</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">baseaddr</span><span class="p">)</span></div>
<div class="viewcode-block" id="PEB">
<a class="viewcode-back" href="../../../process.html#windows.winobject.process.PEB">[docs]</a>
<span class="k">class</span> <span class="nc">PEB</span><span class="p">(</span><span class="n">gdef</span><span class="o">.</span><span class="n">PEB</span><span class="p">):</span>
<span class="w"> </span><span class="sd">&quot;&quot;&quot;The PEB (Process Environment Block) of the current process&quot;&quot;&quot;</span>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">exe</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="w"> </span><span class="sd">&quot;&quot;&quot;The executable of the process, as pointed by PEB.ImageBaseAddress</span>
<span class="sd"> :type: :class:`windows.pe_parse.PEFile`</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="k">return</span> <span class="n">windows</span><span class="o">.</span><span class="n">pe_parse</span><span class="o">.</span><span class="n">GetPEFile</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">ImageBaseAddress</span><span class="p">)</span>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">imagepath</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="w"> </span><span class="sd">&quot;&quot;&quot;The ImagePathName of the PEB</span>
<span class="sd"> :type: :class:`~windows.generated_def.winstructs.LSA_UNICODE_STRING`</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">ProcessParameters</span><span class="o">.</span><span class="n">contents</span><span class="o">.</span><span class="n">ImagePathName</span>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">commandline</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="w"> </span><span class="sd">&quot;&quot;&quot;The CommandLine of the PEB</span>
<span class="sd"> :type: :class:`~windows.generated_def.winstructs.LSA_UNICODE_STRING`</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">ProcessParameters</span><span class="o">.</span><span class="n">contents</span><span class="o">.</span><span class="n">CommandLine</span>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">modules</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="w"> </span><span class="sd">&quot;&quot;&quot;The loaded modules present in the PEB</span>
<span class="sd"> :type: [:class:`LoadedModule`] -- List of loaded modules</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="n">res</span> <span class="o">=</span> <span class="p">[]</span>
<span class="n">first_flink</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">Ldr</span><span class="o">.</span><span class="n">contents</span><span class="o">.</span><span class="n">InMemoryOrderModuleList</span><span class="o">.</span><span class="n">Flink</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span>
<span class="n">current_dll</span> <span class="o">=</span> <span class="n">first_flink</span><span class="o">.</span><span class="n">get_real_struct</span><span class="p">(</span><span class="n">LoadedModule</span><span class="p">,</span> <span class="n">LoadedModule</span><span class="o">.</span><span class="n">InMemoryOrderLinks</span><span class="p">)</span>
<span class="k">while</span> <span class="n">current_dll</span><span class="o">.</span><span class="n">DllBase</span><span class="p">:</span>
<span class="n">res</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">current_dll</span><span class="p">)</span>
<span class="n">next_flink</span> <span class="o">=</span> <span class="n">current_dll</span><span class="o">.</span><span class="n">InMemoryOrderLinks</span><span class="o">.</span><span class="n">Flink</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span>
<span class="n">current_dll</span> <span class="o">=</span> <span class="n">next_flink</span><span class="o">.</span><span class="n">get_real_struct</span><span class="p">(</span><span class="n">LoadedModule</span><span class="p">,</span> <span class="n">LoadedModule</span><span class="o">.</span><span class="n">InMemoryOrderLinks</span><span class="p">)</span>
<span class="k">return</span> <span class="n">res</span>
<span class="nd">@staticmethod</span>
<span class="k">def</span> <span class="nf">_extract_environment</span><span class="p">(</span><span class="n">env_block_addr</span><span class="p">,</span> <span class="n">target</span><span class="p">):</span>
<span class="n">result</span> <span class="o">=</span> <span class="p">[]</span>
<span class="k">while</span> <span class="kc">True</span><span class="p">:</span>
<span class="n">venv</span> <span class="o">=</span> <span class="n">target</span><span class="o">.</span><span class="n">read_wstring</span><span class="p">(</span><span class="n">env_block_addr</span><span class="p">)</span>
<span class="k">if</span> <span class="ow">not</span> <span class="n">venv</span><span class="p">:</span>
<span class="k">return</span> <span class="n">result</span>
<span class="n">result</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">venv</span><span class="p">)</span>
<span class="n">env_block_addr</span> <span class="o">+=</span> <span class="p">((</span><span class="nb">len</span><span class="p">(</span><span class="n">venv</span><span class="p">)</span> <span class="o">+</span> <span class="mi">1</span><span class="p">)</span> <span class="o">*</span> <span class="mi">2</span><span class="p">)</span>
<span class="c1"># raise RuntimeError(&quot;Out of infinite loop&quot;)</span>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">environment</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="c1"># TODO: Tests</span>
<span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">_extract_environment</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">ProcessParameters</span><span class="o">.</span><span class="n">contents</span><span class="o">.</span><span class="n">Environment</span><span class="p">,</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="p">)</span>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">apisetmap</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="w"> </span><span class="sd">&quot;&quot;&quot;The :class:`~windows.winobject.apisetmap.ApiSetMap` of the process</span>
<span class="sd"> :rtype: A subclass of :class:`~windows.winobject.apisetmap.ApiSetMap`</span>
<span class="sd"> :raise: :class:`~exception.NotImplementedError` -- Before ``6.2`` ApiSetMap did not exist</span>
<span class="sd"> :raise: :class:`~exception.NotImplementedError` -- Not implemented for remote process</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">system</span><span class="o">.</span><span class="n">version</span> <span class="o">&lt;</span> <span class="p">(</span><span class="mi">6</span><span class="p">,</span><span class="mi">2</span><span class="p">):</span>
<span class="k">raise</span> <span class="ne">NotImplementedError</span><span class="p">(</span><span class="s2">&quot;ApiSetMap does not exist prior to Windows 7&quot;</span><span class="p">)</span>
<span class="k">return</span> <span class="n">apisetmap</span><span class="o">.</span><span class="n">get_api_set_map_for_current_process</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">ApiSetMap</span><span class="p">)</span></div>
<span class="c1"># Memory stuff</span>
<span class="k">class</span> <span class="nc">EPSAPI_WORKING_SET_BLOCK_BASE</span><span class="p">(</span><span class="nb">object</span><span class="p">):</span>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">protection</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">Flags</span> <span class="o">&amp;</span> <span class="mb">0b11111</span>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">sharecount</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="k">return</span> <span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">Flags</span> <span class="o">&gt;&gt;</span> <span class="mi">5</span><span class="p">)</span> <span class="o">&amp;</span> <span class="mb">0b111</span>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">shared</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="k">return</span> <span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">Flags</span> <span class="o">&gt;&gt;</span> <span class="mi">8</span><span class="p">)</span> <span class="o">&amp;</span> <span class="mi">1</span>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">virtualpage</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="k">return</span> <span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">Flags</span> <span class="o">&gt;&gt;</span> <span class="mi">12</span><span class="p">)</span>
<span class="k">class</span> <span class="nc">EPSAPI_WORKING_SET_BLOCK</span><span class="p">(</span><span class="n">EPSAPI_WORKING_SET_BLOCK_BASE</span><span class="p">,</span> <span class="n">PSAPI_WORKING_SET_BLOCK</span><span class="p">):</span>
<span class="k">pass</span>
<span class="k">class</span> <span class="nc">EPSAPI_WORKING_SET_BLOCK32</span><span class="p">(</span><span class="n">EPSAPI_WORKING_SET_BLOCK_BASE</span><span class="p">,</span> <span class="n">PSAPI_WORKING_SET_BLOCK32</span><span class="p">):</span>
<span class="k">pass</span>
<span class="k">class</span> <span class="nc">EPSAPI_WORKING_SET_BLOCK64</span><span class="p">(</span><span class="n">EPSAPI_WORKING_SET_BLOCK_BASE</span><span class="p">,</span> <span class="n">PSAPI_WORKING_SET_BLOCK64</span><span class="p">):</span>
<span class="k">pass</span>
<span class="k">class</span> <span class="nc">EPSAPI_WORKING_SET_EX_BLOCK_BASE</span><span class="p">(</span><span class="nb">object</span><span class="p">):</span>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">valid</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">Flags</span> <span class="o">&amp;</span> <span class="mb">0b1</span>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">sharecount</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="k">return</span> <span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">Flags</span> <span class="o">&gt;&gt;</span> <span class="mi">1</span><span class="p">)</span> <span class="o">&amp;</span> <span class="mb">0b111</span>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">shared</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="k">return</span> <span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">Flags</span> <span class="o">&gt;&gt;</span> <span class="mi">15</span><span class="p">)</span> <span class="o">&amp;</span> <span class="mi">1</span>
<span class="k">class</span> <span class="nc">EPSAPI_WORKING_SET_EX_BLOCK</span><span class="p">(</span><span class="n">EPSAPI_WORKING_SET_EX_BLOCK_BASE</span><span class="p">,</span> <span class="n">PSAPI_WORKING_SET_EX_BLOCK</span><span class="p">):</span>
<span class="k">pass</span>
<span class="k">class</span> <span class="nc">EPSAPI_WORKING_SET_EX_BLOCK32</span><span class="p">(</span><span class="n">EPSAPI_WORKING_SET_EX_BLOCK_BASE</span><span class="p">,</span> <span class="n">PSAPI_WORKING_SET_EX_BLOCK32</span><span class="p">):</span>
<span class="k">pass</span>
<span class="k">class</span> <span class="nc">EPSAPI_WORKING_SET_EX_BLOCK64</span><span class="p">(</span><span class="n">EPSAPI_WORKING_SET_EX_BLOCK_BASE</span><span class="p">,</span> <span class="n">PSAPI_WORKING_SET_EX_BLOCK64</span><span class="p">):</span>
<span class="k">pass</span>
<span class="k">class</span> <span class="nc">EPSAPI_WORKING_SET_EX_INFORMATION</span><span class="p">(</span><span class="n">ctypes</span><span class="o">.</span><span class="n">Structure</span><span class="p">):</span>
<span class="n">_fields_</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">utils</span><span class="o">.</span><span class="n">transform_ctypes_fields</span><span class="p">(</span><span class="n">PSAPI_WORKING_SET_EX_INFORMATION</span><span class="p">,</span> <span class="p">{</span><span class="s2">&quot;VirtualAttributes&quot;</span><span class="p">:</span> <span class="n">EPSAPI_WORKING_SET_EX_BLOCK</span><span class="p">})</span>
<span class="k">class</span> <span class="nc">EPSAPI_WORKING_SET_EX_INFORMATION32</span><span class="p">(</span><span class="n">ctypes</span><span class="o">.</span><span class="n">Structure</span><span class="p">):</span>
<span class="n">_fields_</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">utils</span><span class="o">.</span><span class="n">transform_ctypes_fields</span><span class="p">(</span><span class="n">PSAPI_WORKING_SET_EX_INFORMATION32</span><span class="p">,</span> <span class="p">{</span><span class="s2">&quot;VirtualAttributes&quot;</span><span class="p">:</span> <span class="n">EPSAPI_WORKING_SET_EX_BLOCK32</span><span class="p">})</span>
<span class="k">class</span> <span class="nc">EPSAPI_WORKING_SET_EX_INFORMATION64</span><span class="p">(</span><span class="n">ctypes</span><span class="o">.</span><span class="n">Structure</span><span class="p">):</span>
<span class="n">_fields_</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">utils</span><span class="o">.</span><span class="n">transform_ctypes_fields</span><span class="p">(</span><span class="n">PSAPI_WORKING_SET_EX_INFORMATION64</span><span class="p">,</span> <span class="p">{</span><span class="s2">&quot;VirtualAttributes&quot;</span><span class="p">:</span> <span class="n">EPSAPI_WORKING_SET_EX_BLOCK64</span><span class="p">})</span>
<span class="k">class</span> <span class="nc">RemoteLoadedModule</span><span class="p">(</span><span class="n">rctypes</span><span class="o">.</span><span class="n">RemoteStructure</span><span class="o">.</span><span class="n">from_structure</span><span class="p">(</span><span class="n">LoadedModule</span><span class="p">)):</span>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">pe</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="w"> </span><span class="sd">&quot;&quot;&quot;A PE representation of the module</span>
<span class="sd"> :type: :class:`windows.pe_parse.PEFile`</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="k">return</span> <span class="n">pe_parse</span><span class="o">.</span><span class="n">GetPEFile</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">baseaddr</span><span class="p">,</span> <span class="n">target</span><span class="o">=</span><span class="bp">self</span><span class="o">.</span><span class="n">_target</span><span class="p">)</span>
<span class="k">class</span> <span class="nc">RemotePEB</span><span class="p">(</span><span class="n">rctypes</span><span class="o">.</span><span class="n">RemoteStructure</span><span class="o">.</span><span class="n">from_structure</span><span class="p">(</span><span class="n">PEB</span><span class="p">)):</span>
<span class="k">def</span> <span class="nf">ptr_flink_to_remote_module</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">ptr_value</span><span class="p">):</span>
<span class="k">return</span> <span class="n">RemoteLoadedModule</span><span class="p">(</span><span class="n">ptr_value</span> <span class="o">-</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">ctypes</span><span class="o">.</span><span class="n">c_void_p</span><span class="p">)</span> <span class="o">*</span> <span class="mi">2</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">_target</span><span class="p">)</span>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">exe</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="w"> </span><span class="sd">&quot;&quot;&quot;The executable of the process, as pointed by PEB.ImageBaseAddress</span>
<span class="sd"> :type: :class:`windows.pe_parse.PEFile`</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="k">return</span> <span class="n">pe_parse</span><span class="o">.</span><span class="n">GetPEFile</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">ImageBaseAddress</span><span class="p">,</span> <span class="n">target</span><span class="o">=</span><span class="bp">self</span><span class="o">.</span><span class="n">_target</span><span class="p">)</span>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">modules</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="w"> </span><span class="sd">&quot;&quot;&quot;The loaded modules present in the PEB</span>
<span class="sd"> :type: [:class:`LoadedModule`] -- List of loaded modules</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="n">res</span> <span class="o">=</span> <span class="p">[]</span>
<span class="k">if</span> <span class="ow">not</span> <span class="bp">self</span><span class="o">.</span><span class="n">Ldr</span><span class="o">.</span><span class="n">value</span><span class="p">:</span>
<span class="k">raise</span> <span class="ne">ValueError</span><span class="p">(</span><span class="s2">&quot;PEB-&gt;Ldr is NULL: cannot walk the module list&quot;</span><span class="p">)</span>
<span class="n">list_entry_ptr</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">Ldr</span><span class="o">.</span><span class="n">contents</span><span class="o">.</span><span class="n">InMemoryOrderModuleList</span><span class="o">.</span><span class="n">Flink</span><span class="o">.</span><span class="n">raw_value</span>
<span class="n">current_dll</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">ptr_flink_to_remote_module</span><span class="p">(</span><span class="n">list_entry_ptr</span><span class="p">)</span>
<span class="k">while</span> <span class="n">current_dll</span><span class="o">.</span><span class="n">DllBase</span><span class="p">:</span>
<span class="n">res</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">current_dll</span><span class="p">)</span>
<span class="n">list_entry_ptr</span> <span class="o">=</span> <span class="n">current_dll</span><span class="o">.</span><span class="n">InMemoryOrderLinks</span><span class="o">.</span><span class="n">Flink</span><span class="o">.</span><span class="n">raw_value</span>
<span class="n">current_dll</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">ptr_flink_to_remote_module</span><span class="p">(</span><span class="n">list_entry_ptr</span><span class="p">)</span>
<span class="k">return</span> <span class="n">res</span>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">environment</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="c1"># TODO: Tests</span>
<span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">_extract_environment</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">ProcessParameters</span><span class="o">.</span><span class="n">contents</span><span class="o">.</span><span class="n">Environment</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">_target</span><span class="p">)</span>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">apisetmap</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="k">raise</span> <span class="ne">NotImplementedError</span><span class="p">(</span><span class="s2">&quot;ApiSetMap for remote process not implemented yet&quot;</span><span class="p">)</span>
<span class="c1"># TEB enhanced, same bitness as PEB (current process)</span>
<span class="k">class</span> <span class="nc">TEB</span><span class="p">(</span><span class="n">gdef</span><span class="o">.</span><span class="n">TEB</span><span class="p">):</span>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">peb</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="k">return</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">cast</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">ProcessEnvironmentBlock</span><span class="p">,</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">POINTER</span><span class="p">(</span><span class="n">PEB</span><span class="p">))[</span><span class="mi">0</span><span class="p">]</span>
<span class="c1"># mote TEB enhanced, same bitness as PEB (current process)</span>
<span class="k">class</span> <span class="nc">RemoteTEB</span><span class="p">(</span><span class="n">rctypes</span><span class="o">.</span><span class="n">RemoteStructure</span><span class="o">.</span><span class="n">from_structure</span><span class="p">(</span><span class="n">TEB</span><span class="p">)):</span>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">peb</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="n">ctypes_peb</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">ProcessEnvironmentBlock</span><span class="o">.</span><span class="n">value</span>
<span class="k">return</span> <span class="n">RemotePEB</span><span class="p">(</span><span class="n">ctypes_peb</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">_target</span><span class="p">)</span>
<span class="k">if</span> <span class="n">CurrentProcess</span><span class="p">()</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">32</span><span class="p">:</span>
<span class="n">RemoteLoadedModule32</span> <span class="o">=</span> <span class="n">RemoteLoadedModule</span>
<span class="n">RemotePEB32</span> <span class="o">=</span> <span class="n">RemotePEB</span>
<span class="n">RemoteTEB32</span> <span class="o">=</span> <span class="n">RemoteTEB</span>
<span class="k">class</span> <span class="nc">RemoteLoadedModule64</span><span class="p">(</span><span class="n">rctypes</span><span class="o">.</span><span class="n">transform_type_to_remote64bits</span><span class="p">(</span><span class="n">LoadedModule</span><span class="p">)):</span>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">pe</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="w"> </span><span class="sd">&quot;&quot;&quot;A PE representation of the module</span>
<span class="sd"> :type: :class:`windows.pe_parse.PEFile`</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="k">return</span> <span class="n">pe_parse</span><span class="o">.</span><span class="n">GetPEFile</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">baseaddr</span><span class="p">,</span> <span class="n">target</span><span class="o">=</span><span class="bp">self</span><span class="o">.</span><span class="n">_target</span><span class="p">)</span>
<span class="k">class</span> <span class="nc">RemotePEB64</span><span class="p">(</span><span class="n">rctypes</span><span class="o">.</span><span class="n">transform_type_to_remote64bits</span><span class="p">(</span><span class="n">PEB</span><span class="p">)):</span>
<span class="k">def</span> <span class="nf">ptr_flink_to_remote_module</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">ptr_value</span><span class="p">):</span>
<span class="k">return</span> <span class="n">RemoteLoadedModule64</span><span class="p">(</span><span class="n">ptr_value</span> <span class="o">-</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">rctypes</span><span class="o">.</span><span class="n">c_void_p64</span><span class="p">)</span> <span class="o">*</span> <span class="mi">2</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">_target</span><span class="p">)</span>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">exe</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="w"> </span><span class="sd">&quot;&quot;&quot;The executable of the process, as pointed by PEB.ImageBaseAddress</span>
<span class="sd"> :type: :class:`windows.pe_parse.PEFile`</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="k">return</span> <span class="n">pe_parse</span><span class="o">.</span><span class="n">GetPEFile</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">ImageBaseAddress</span><span class="p">,</span> <span class="n">target</span><span class="o">=</span><span class="bp">self</span><span class="o">.</span><span class="n">_target</span><span class="p">)</span>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">modules</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="w"> </span><span class="sd">&quot;&quot;&quot;The loaded modules present in the PEB</span>
<span class="sd"> :type: [:class:`LoadedModule`] -- List of loaded modules</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="n">res</span> <span class="o">=</span> <span class="p">[]</span>
<span class="k">if</span> <span class="ow">not</span> <span class="bp">self</span><span class="o">.</span><span class="n">Ldr</span><span class="o">.</span><span class="n">value</span><span class="p">:</span>
<span class="k">raise</span> <span class="ne">ValueError</span><span class="p">(</span><span class="s2">&quot;PEB-&gt;Ldr is NULL: cannot walk the module list&quot;</span><span class="p">)</span>
<span class="n">list_entry_ptr</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">Ldr</span><span class="o">.</span><span class="n">contents</span><span class="o">.</span><span class="n">InMemoryOrderModuleList</span><span class="o">.</span><span class="n">Flink</span><span class="o">.</span><span class="n">raw_value</span>
<span class="n">current_dll</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">ptr_flink_to_remote_module</span><span class="p">(</span><span class="n">list_entry_ptr</span><span class="p">)</span>
<span class="k">while</span> <span class="n">current_dll</span><span class="o">.</span><span class="n">DllBase</span><span class="p">:</span>
<span class="n">res</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">current_dll</span><span class="p">)</span>
<span class="n">list_entry_ptr</span> <span class="o">=</span> <span class="n">current_dll</span><span class="o">.</span><span class="n">InMemoryOrderLinks</span><span class="o">.</span><span class="n">Flink</span><span class="o">.</span><span class="n">raw_value</span>
<span class="n">current_dll</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">ptr_flink_to_remote_module</span><span class="p">(</span><span class="n">list_entry_ptr</span><span class="p">)</span>
<span class="k">return</span> <span class="n">res</span>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">environment</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="c1"># TODO: Tests</span>
<span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">_extract_environment</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">ProcessParameters</span><span class="o">.</span><span class="n">contents</span><span class="o">.</span><span class="n">Environment</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">_target</span><span class="p">)</span>
<span class="n">apisetmap</span> <span class="o">=</span> <span class="n">RemotePEB</span><span class="o">.</span><span class="n">apisetmap</span>
<span class="k">class</span> <span class="nc">RemoteTEB64</span><span class="p">(</span><span class="n">rctypes</span><span class="o">.</span><span class="n">transform_type_to_remote64bits</span><span class="p">(</span><span class="n">TEB</span><span class="p">)):</span>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">peb</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="n">ctypes_peb</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">ProcessEnvironmentBlock</span><span class="o">.</span><span class="n">value</span>
<span class="k">return</span> <span class="n">RemotePEB64</span><span class="p">(</span><span class="n">ctypes_peb</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">_target</span><span class="p">)</span>
<span class="k">if</span> <span class="n">CurrentProcess</span><span class="p">()</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">64</span><span class="p">:</span>
<span class="n">RemoteLoadedModule64</span> <span class="o">=</span> <span class="n">RemoteLoadedModule</span>
<span class="n">RemotePEB64</span> <span class="o">=</span> <span class="n">RemotePEB</span>
<span class="n">RemoteTEB64</span> <span class="o">=</span> <span class="n">RemoteTEB</span>
<span class="k">class</span> <span class="nc">RemoteLoadedModule32</span><span class="p">(</span><span class="n">rctypes</span><span class="o">.</span><span class="n">transform_type_to_remote32bits</span><span class="p">(</span><span class="n">LoadedModule</span><span class="p">)):</span>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">pe</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="w"> </span><span class="sd">&quot;&quot;&quot;A PE representation of the module</span>
<span class="sd"> :type: :class:`windows.pe_parse.PEFile`</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="k">return</span> <span class="n">pe_parse</span><span class="o">.</span><span class="n">GetPEFile</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">baseaddr</span><span class="p">,</span> <span class="n">target</span><span class="o">=</span><span class="bp">self</span><span class="o">.</span><span class="n">_target</span><span class="p">)</span>
<span class="k">class</span> <span class="nc">RemotePEB32</span><span class="p">(</span><span class="n">rctypes</span><span class="o">.</span><span class="n">transform_type_to_remote32bits</span><span class="p">(</span><span class="n">PEB</span><span class="p">)):</span>
<span class="k">def</span> <span class="nf">ptr_flink_to_remote_module</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">ptr_value</span><span class="p">):</span>
<span class="k">return</span> <span class="n">RemoteLoadedModule32</span><span class="p">(</span><span class="n">ptr_value</span> <span class="o">-</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">rctypes</span><span class="o">.</span><span class="n">c_void_p32</span><span class="p">)</span> <span class="o">*</span> <span class="mi">2</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">_target</span><span class="p">)</span>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">exe</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="w"> </span><span class="sd">&quot;&quot;&quot;The executable of the process, as pointed by PEB.ImageBaseAddress</span>
<span class="sd"> :type: :class:`windows.pe_parse.PEFile`</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="k">return</span> <span class="n">pe_parse</span><span class="o">.</span><span class="n">GetPEFile</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">ImageBaseAddress</span><span class="p">,</span> <span class="n">target</span><span class="o">=</span><span class="bp">self</span><span class="o">.</span><span class="n">_target</span><span class="p">)</span>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">modules</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="w"> </span><span class="sd">&quot;&quot;&quot;The loaded modules present in the PEB</span>
<span class="sd"> :type: [:class:`LoadedModule`] -- List of loaded modules</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="n">res</span> <span class="o">=</span> <span class="p">[]</span>
<span class="k">if</span> <span class="ow">not</span> <span class="bp">self</span><span class="o">.</span><span class="n">Ldr</span><span class="o">.</span><span class="n">value</span><span class="p">:</span>
<span class="k">raise</span> <span class="ne">ValueError</span><span class="p">(</span><span class="s2">&quot;PEB-&gt;Ldr is NULL: cannot walk the module list&quot;</span><span class="p">)</span>
<span class="n">list_entry_ptr</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">Ldr</span><span class="o">.</span><span class="n">contents</span><span class="o">.</span><span class="n">InMemoryOrderModuleList</span><span class="o">.</span><span class="n">Flink</span><span class="o">.</span><span class="n">raw_value</span>
<span class="n">current_dll</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">ptr_flink_to_remote_module</span><span class="p">(</span><span class="n">list_entry_ptr</span><span class="p">)</span>
<span class="k">while</span> <span class="n">current_dll</span><span class="o">.</span><span class="n">DllBase</span><span class="p">:</span>
<span class="n">res</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">current_dll</span><span class="p">)</span>
<span class="n">list_entry_ptr</span> <span class="o">=</span> <span class="n">current_dll</span><span class="o">.</span><span class="n">InMemoryOrderLinks</span><span class="o">.</span><span class="n">Flink</span><span class="o">.</span><span class="n">raw_value</span>
<span class="n">current_dll</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">ptr_flink_to_remote_module</span><span class="p">(</span><span class="n">list_entry_ptr</span><span class="p">)</span>
<span class="k">return</span> <span class="n">res</span>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">environment</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="c1"># TODO: Tests</span>
<span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">_extract_environment</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">ProcessParameters</span><span class="o">.</span><span class="n">contents</span><span class="o">.</span><span class="n">Environment</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">_target</span><span class="p">)</span>
<span class="n">apisetmap</span> <span class="o">=</span> <span class="n">RemotePEB</span><span class="o">.</span><span class="n">apisetmap</span>
<span class="k">class</span> <span class="nc">RemoteTEB32</span><span class="p">(</span><span class="n">rctypes</span><span class="o">.</span><span class="n">transform_type_to_remote32bits</span><span class="p">(</span><span class="n">TEB</span><span class="p">)):</span>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">peb</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="n">ctypes_peb</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">ProcessEnvironmentBlock</span><span class="o">.</span><span class="n">value</span>
<span class="k">return</span> <span class="n">RemotePEB32</span><span class="p">(</span><span class="n">ctypes_peb</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">_target</span><span class="p">)</span>
</pre></div>
<div class="clearer"></div>
</div>
</div>
</div>
<div class="sphinxsidebar" role="navigation" aria-label="main navigation">
<div class="sphinxsidebarwrapper">
<search id="searchbox" style="display: none" role="search">
<h3 id="searchlabel">Quick search</h3>
<div class="searchformwrapper">
<form class="search" action="../../../search.html" method="get">
<input type="text" name="q" aria-labelledby="searchlabel" autocomplete="off" autocorrect="off" autocapitalize="off" spellcheck="false"/>
<input type="submit" value="Go" />
</form>
</div>
</search>
<script>document.getElementById('searchbox').style.display = "block"</script>
</div>
</div>
<div class="clearer"></div>
</div>
<div class="related" role="navigation" aria-label="related navigation">
<h3>Navigation</h3>
<ul>
<li class="right" style="margin-right: 10px">
<a href="../../../genindex.html" title="General Index"
>index</a></li>
<li class="right" >
<a href="../../../py-modindex.html" title="Python Module Index"
>modules</a> |</li>
<li class="nav-item nav-item-0"><a href="../../../index.html">PythonForWindows 1.0.3 documentation</a> &#187;</li>
<li class="nav-item nav-item-1"><a href="../../index.html" >Module code</a> &#187;</li>
<li class="nav-item nav-item-this"><a href="">windows.winobject.process</a></li>
</ul>
</div>
<div class="footer" role="contentinfo">
&#169; Copyright 2015-2020, Clement Rouault.
Created using <a href="https://www.sphinx-doc.org/">Sphinx</a> 7.3.7.
</div>
</body>
</html>
Reference in New Issue View Git Blame Copy Permalink