mirror of
https://github.com/hakril/PythonForWindows
synced 2026-06-08 14:31:45 +00:00
Clement Rouault
1181 lines
37 KiB
Python
1181 lines
37 KiB
Python
#Generated file
|
|
from ctypes import *
|
|
from ctypes.wintypes import *
|
|
from .windef import *
|
|
|
|
PWSTR = LPWSTR
|
|
SIZE_T = c_ulong
|
|
PVOID = c_void_p
|
|
PPS_POST_PROCESS_INIT_ROUTINE = PVOID
|
|
NTSTATUS = DWORD
|
|
PULONG = POINTER(ULONG)
|
|
PDWORD = POINTER(DWORD)
|
|
LPDWORD = POINTER(DWORD)
|
|
LPTHREAD_START_ROUTINE = PVOID
|
|
LPBYTE = POINTER(BYTE)
|
|
ULONG_PTR = PULONG
|
|
CHAR = c_char
|
|
UCHAR = c_char
|
|
FARPROC = PVOID
|
|
HGLOBAL = PVOID
|
|
PVECTORED_EXCEPTION_HANDLER = PVOID
|
|
ULONGLONG = c_ulonglong
|
|
LONGLONG = c_longlong
|
|
ULONG64 = c_ulonglong
|
|
DWORD64 = ULONG64
|
|
PULONG64 = POINTER(ULONG64)
|
|
PHANDLE = POINTER(HANDLE)
|
|
HKEY = HANDLE
|
|
PHKEY = POINTER(HKEY)
|
|
ACCESS_MASK = DWORD
|
|
REGSAM = ACCESS_MASK
|
|
LPCONTEXT = PVOID
|
|
VOID = DWORD
|
|
|
|
structs = ['_LIST_ENTRY', '_PEB_LDR_DATA', '_LSA_UNICODE_STRING', '_RTL_USER_PROCESS_PARAMETERS', '_PEB', '_SECURITY_ATTRIBUTES', '_SYSTEM_VERIFIER_INFORMATION', '_LDR_DATA_TABLE_ENTRY', '_IMAGE_FILE_HEADER', '_IMAGE_DATA_DIRECTORY', '_IMAGE_SECTION_HEADER', '_IMAGE_OPTIONAL_HEADER64', '_IMAGE_OPTIONAL_HEADER', '_IMAGE_NT_HEADERS64', '_IMAGE_NT_HEADERS', '_IMAGE_IMPORT_DESCRIPTOR', '_IMAGE_IMPORT_BY_NAME', '_IMAGE_EXPORT_DIRECTORY', '_MEMORY_BASIC_INFORMATION', '_STARTUPINFOA', '_STARTUPINFOW', '_PROCESS_INFORMATION', '_FLOATING_SAVE_AREA', '_CONTEXT32', '_M128A', '_CONTEXT64', 'tagPROCESSENTRY32W', 'tagPROCESSENTRY32', 'tagTHREADENTRY32', '_LUID', '_LUID_AND_ATTRIBUTES', '_TOKEN_PRIVILEGES', '_TOKEN_ELEVATION', '_OSVERSIONINFOA', '_OSVERSIONINFOW', '_OSVERSIONINFOEXA', '_OSVERSIONINFOEXW', '_OVERLAPPED', '_MIB_TCPROW_OWNER_PID', '_MIB_TCPTABLE_OWNER_PID', '_MIB_UDPROW_OWNER_PID', '_MIB_UDPTABLE_OWNER_PID', '_MIB_UDP6ROW_OWNER_PID', '_MIB_UDP6TABLE_OWNER_PID', '_MIB_TCP6ROW_OWNER_PID', '_MIB_TCP6TABLE_OWNER_PID', '_MIB_TCPROW', '_EXCEPTION_RECORD', '_EXCEPTION_POINTERS64', '_EXCEPTION_POINTERS32', '_DEBUG_PROCESSOR_IDENTIFICATION_ALPHA', '_DEBUG_PROCESSOR_IDENTIFICATION_AMD64', '_DEBUG_PROCESSOR_IDENTIFICATION_IA64', '_DEBUG_PROCESSOR_IDENTIFICATION_X86', '_DEBUG_PROCESSOR_IDENTIFICATION_ARM', '_DEBUG_PROCESSOR_IDENTIFICATION_ALL', '_SYMBOL_INFO', '_MODLOAD_DATA', '_SYSTEM_MODULE32', '_SYSTEM_MODULE64']
|
|
|
|
enums = ['_SYSTEM_INFORMATION_CLASS', '_TCP_TABLE_CLASS', '_UDP_TABLE_CLASS', '_MIB_TCP_STATE', '_TOKEN_INFORMATION_CLASS', '_IMAGEHLP_SYMBOL_TYPE_INFO']
|
|
|
|
# Enum _SYSTEM_INFORMATION_CLASS definitions
|
|
_SYSTEM_INFORMATION_CLASS = DWORD
|
|
SYSTEM_INFORMATION_CLASS = _SYSTEM_INFORMATION_CLASS
|
|
|
|
SystemBasicInformation = 0x0
|
|
SystemProcessorInformation = 0x1
|
|
SystemPerformanceInformation = 0x2
|
|
SystemTimeOfDayInformation = 0x3
|
|
SystemPathInformation = 0x4
|
|
SystemProcessInformation = 0x5
|
|
SystemCallCountInformation = 0x6
|
|
SystemDeviceInformation = 0x7
|
|
SystemProcessorPerformanceInformation = 0x8
|
|
SystemFlagsInformation = 0x9
|
|
SystemCallTimeInformation = 0xa
|
|
SystemModuleInformation = 0xb
|
|
SystemLocksInformation = 0xc
|
|
SystemStackTraceInformation = 0xd
|
|
SystemPagedPoolInformation = 0xe
|
|
SystemNonPagedPoolInformation = 0xf
|
|
SystemHandleInformation = 0x10
|
|
SystemObjectInformation = 0x11
|
|
SystemPageFileInformation = 0x12
|
|
SystemVdmInstemulInformation = 0x13
|
|
SystemVdmBopInformation = 0x14
|
|
SystemFileCacheInformation = 0x15
|
|
SystemPoolTagInformation = 0x16
|
|
SystemInterruptInformation = 0x17
|
|
SystemDpcBehaviorInformation = 0x18
|
|
SystemFullMemoryInformation = 0x19
|
|
SystemLoadGdiDriverInformation = 0x1a
|
|
SystemUnloadGdiDriverInformation = 0x1b
|
|
SystemTimeAdjustmentInformation = 0x1c
|
|
SystemSummaryMemoryInformation = 0x1d
|
|
SystemMirrorMemoryInformation = 0x1e
|
|
SystemPerformanceTraceInformation = 0x1f
|
|
SystemObsolete0 = 0x20
|
|
SystemExceptionInformation = 0x21
|
|
SystemCrashDumpStateInformation = 0x22
|
|
SystemKernelDebuggerInformation = 0x23
|
|
SystemContextSwitchInformation = 0x24
|
|
SystemRegistryQuotaInformation = 0x25
|
|
SystemExtendServiceTableInformation = 0x26
|
|
SystemPrioritySeperation = 0x27
|
|
SystemVerifierAddDriverInformation = 0x28
|
|
SystemVerifierRemoveDriverInformation = 0x29
|
|
SystemProcessorIdleInformation = 0x2a
|
|
SystemLegacyDriverInformation = 0x2b
|
|
SystemCurrentTimeZoneInformation = 0x2c
|
|
SystemLookasideInformation = 0x2d
|
|
SystemTimeSlipNotification = 0x2e
|
|
SystemSessionCreate = 0x2f
|
|
SystemSessionDetach = 0x30
|
|
SystemSessionInformation = 0x31
|
|
SystemRangeStartInformation = 0x32
|
|
SystemVerifierInformation = 0x33
|
|
SystemVerifierThunkExtend = 0x34
|
|
SystemSessionProcessInformation = 0x35
|
|
SystemLoadGdiDriverInSystemSpace = 0x36
|
|
SystemNumaProcessorMap = 0x37
|
|
SystemPrefetcherInformation = 0x38
|
|
SystemExtendedProcessInformation = 0x39
|
|
SystemRecommendedSharedDataAlignment = 0x3a
|
|
SystemComPlusPackage = 0x3b
|
|
SystemNumaAvailableMemory = 0x3c
|
|
SystemProcessorPowerInformation = 0x3d
|
|
SystemEmulationBasicInformation = 0x3e
|
|
SystemEmulationProcessorInformation = 0x3f
|
|
SystemExtendedHandleInformation = 0x40
|
|
SystemLostDelayedWriteInformation = 0x41
|
|
SystemBigPoolInformation = 0x42
|
|
SystemSessionPoolTagInformation = 0x43
|
|
SystemSessionMappedViewInformation = 0x44
|
|
SystemHotpatchInformation = 0x45
|
|
SystemObjectSecurityMode = 0x46
|
|
SystemWatchdogTimerHandler = 0x47
|
|
SystemWatchdogTimerInformation = 0x48
|
|
SystemLogicalProcessorInformation = 0x49
|
|
SystemWow64SharedInformation = 0x4a
|
|
SystemRegisterFirmwareTableInformationHandler = 0x4b
|
|
SystemFirmwareTableInformation = 0x4c
|
|
SystemModuleInformationEx = 0x4d
|
|
SystemVerifierTriageInformation = 0x4e
|
|
SystemSuperfetchInformation = 0x4f
|
|
SystemMemoryListInformation = 0x50
|
|
SystemFileCacheInformationEx = 0x51
|
|
MaxSystemInfoClass = 0x52
|
|
|
|
# Enum _TCP_TABLE_CLASS definitions
|
|
_TCP_TABLE_CLASS = DWORD
|
|
TCP_TABLE_CLASS = _TCP_TABLE_CLASS
|
|
|
|
TCP_TABLE_BASIC_LISTENER = 0x0
|
|
TCP_TABLE_BASIC_CONNECTIONS = 0x1
|
|
TCP_TABLE_BASIC_ALL = 0x2
|
|
TCP_TABLE_OWNER_PID_LISTENER = 0x3
|
|
TCP_TABLE_OWNER_PID_CONNECTIONS = 0x4
|
|
TCP_TABLE_OWNER_PID_ALL = 0x5
|
|
TCP_TABLE_OWNER_MODULE_LISTENER = 0x6
|
|
TCP_TABLE_OWNER_MODULE_CONNECTIONS = 0x7
|
|
TCP_TABLE_OWNER_MODULE_ALL = 0x8
|
|
|
|
# Enum _UDP_TABLE_CLASS definitions
|
|
_UDP_TABLE_CLASS = DWORD
|
|
UDP_TABLE_CLASS = _UDP_TABLE_CLASS
|
|
|
|
UDP_TABLE_BASIC = 0x0
|
|
UDP_TABLE_OWNER_PID = 0x1
|
|
UDP_TABLE_OWNER_MODULE = 0x2
|
|
|
|
# Enum _MIB_TCP_STATE definitions
|
|
_MIB_TCP_STATE = DWORD
|
|
MIB_TCP_STATE = _MIB_TCP_STATE
|
|
|
|
MIB_TCP_STATE_CLOSED = 0x1
|
|
MIB_TCP_STATE_LISTEN = 0x2
|
|
MIB_TCP_STATE_SYN_SENT = 0x3
|
|
MIB_TCP_STATE_SYN_RCVD = 0x4
|
|
MIB_TCP_STATE_ESTAB = 0x5
|
|
MIB_TCP_STATE_FIN_WAIT1 = 0x6
|
|
MIB_TCP_STATE_FIN_WAIT2 = 0x7
|
|
MIB_TCP_STATE_CLOSE_WAIT = 0x8
|
|
MIB_TCP_STATE_CLOSING = 0x9
|
|
MIB_TCP_STATE_LAST_ACK = 0xa
|
|
MIB_TCP_STATE_TIME_WAIT = 0xb
|
|
MIB_TCP_STATE_DELETE_TCB = 0xc
|
|
|
|
# Enum _TOKEN_INFORMATION_CLASS definitions
|
|
_TOKEN_INFORMATION_CLASS = DWORD
|
|
TOKEN_INFORMATION_CLASS = _TOKEN_INFORMATION_CLASS
|
|
PTOKEN_INFORMATION_CLASS = POINTER(_TOKEN_INFORMATION_CLASS)
|
|
|
|
TokenInvalid = 0x0
|
|
TokenUser = 0x1
|
|
TokenGroups = 0x2
|
|
TokenPrivileges = 0x3
|
|
TokenOwner = 0x4
|
|
TokenPrimaryGroup = 0x5
|
|
TokenDefaultDacl = 0x6
|
|
TokenSource = 0x7
|
|
TokenType = 0x8
|
|
TokenImpersonationLevel = 0x9
|
|
TokenStatistics = 0xa
|
|
TokenRestrictedSids = 0xb
|
|
TokenSessionId = 0xc
|
|
TokenGroupsAndPrivileges = 0xd
|
|
TokenSessionReference = 0xe
|
|
TokenSandBoxInert = 0xf
|
|
TokenAuditPolicy = 0x10
|
|
TokenOrigin = 0x11
|
|
TokenElevationType = 0x12
|
|
TokenLinkedToken = 0x13
|
|
TokenElevation = 0x14
|
|
TokenHasRestrictions = 0x15
|
|
TokenAccessInformation = 0x16
|
|
TokenVirtualizationAllowed = 0x17
|
|
TokenVirtualizationEnabled = 0x18
|
|
TokenIntegrityLevel = 0x19
|
|
TokenUIAccess = 0x1a
|
|
TokenMandatoryPolicy = 0x1b
|
|
TokenLogonSid = 0x1c
|
|
TokenIsAppContainer = 0x1d
|
|
TokenCapabilities = 0x1e
|
|
TokenAppContainerSid = 0x1f
|
|
TokenAppContainerNumber = 0x20
|
|
TokenUserClaimAttributes = 0x21
|
|
TokenDeviceClaimAttributes = 0x22
|
|
TokenRestrictedUserClaimAttributes = 0x23
|
|
TokenRestrictedDeviceClaimAttributes = 0x24
|
|
TokenDeviceGroups = 0x25
|
|
TokenRestrictedDeviceGroups = 0x26
|
|
TokenSecurityAttributes = 0x27
|
|
TokenIsRestricted = 0x28
|
|
MaxTokenInfoClass = 0x29
|
|
|
|
# Enum _IMAGEHLP_SYMBOL_TYPE_INFO definitions
|
|
_IMAGEHLP_SYMBOL_TYPE_INFO = DWORD
|
|
IMAGEHLP_SYMBOL_TYPE_INFO = _IMAGEHLP_SYMBOL_TYPE_INFO
|
|
|
|
TI_GET_SYMTAG = 0x0
|
|
TI_GET_SYMNAME = 0x1
|
|
TI_GET_LENGTH = 0x2
|
|
TI_GET_TYPE = 0x3
|
|
TI_GET_TYPEID = 0x4
|
|
TI_GET_BASETYPE = 0x5
|
|
TI_GET_ARRAYINDEXTYPEID = 0x6
|
|
TI_FINDCHILDREN = 0x7
|
|
TI_GET_DATAKIND = 0x8
|
|
TI_GET_ADDRESSOFFSET = 0x9
|
|
TI_GET_OFFSET = 0xa
|
|
TI_GET_VALUE = 0xb
|
|
TI_GET_COUNT = 0xc
|
|
TI_GET_CHILDRENCOUNT = 0xd
|
|
TI_GET_BITPOSITION = 0xe
|
|
TI_GET_VIRTUALBASECLASS = 0xf
|
|
TI_GET_VIRTUALTABLESHAPEID = 0x10
|
|
TI_GET_VIRTUALBASEPOINTEROFFSET = 0x11
|
|
TI_GET_CLASSPARENTID = 0x12
|
|
TI_GET_NESTED = 0x13
|
|
TI_GET_SYMINDEX = 0x14
|
|
TI_GET_LEXICALPARENT = 0x15
|
|
TI_GET_ADDRESS = 0x16
|
|
TI_GET_THISADJUST = 0x17
|
|
TI_GET_UDTKIND = 0x18
|
|
TI_IS_EQUIV_TO = 0x19
|
|
TI_GET_CALLING_CONVENTION = 0x1a
|
|
TI_IS_CLOSE_EQUIV_TO = 0x1b
|
|
TI_GTIEX_REQS_VALID = 0x1c
|
|
TI_GET_VIRTUALBASEOFFSET = 0x1d
|
|
TI_GET_VIRTUALBASEDISPINDEX = 0x1e
|
|
TI_GET_IS_REFERENCE = 0x1f
|
|
TI_GET_INDIRECTVIRTUALBASECLASS = 0x20
|
|
IMAGEHLP_SYMBOL_TYPE_INFO_MAX = 0x21
|
|
|
|
# Struct _LIST_ENTRY definitions
|
|
# Self referencing struct tricks
|
|
class _LIST_ENTRY(Structure): pass
|
|
_LIST_ENTRY._fields_ = [
|
|
("Flink", POINTER(_LIST_ENTRY)),
|
|
("Blink", POINTER(_LIST_ENTRY)),
|
|
]
|
|
PLIST_ENTRY = POINTER(_LIST_ENTRY)
|
|
LIST_ENTRY = _LIST_ENTRY
|
|
PRLIST_ENTRY = POINTER(_LIST_ENTRY)
|
|
|
|
# Struct _PEB_LDR_DATA definitions
|
|
class _PEB_LDR_DATA(Structure):
|
|
_fields_ = [
|
|
("Reserved1", BYTE * 8),
|
|
("Reserved2", PVOID * 3),
|
|
("InMemoryOrderModuleList", LIST_ENTRY),
|
|
]
|
|
PPEB_LDR_DATA = POINTER(_PEB_LDR_DATA)
|
|
PEB_LDR_DATA = _PEB_LDR_DATA
|
|
|
|
# Struct _LSA_UNICODE_STRING definitions
|
|
class _LSA_UNICODE_STRING(Structure):
|
|
_fields_ = [
|
|
("Length", USHORT),
|
|
("MaximumLength", USHORT),
|
|
("Buffer", PWSTR),
|
|
]
|
|
PUNICODE_STRING = POINTER(_LSA_UNICODE_STRING)
|
|
UNICODE_STRING = _LSA_UNICODE_STRING
|
|
LSA_UNICODE_STRING = _LSA_UNICODE_STRING
|
|
PLSA_UNICODE_STRING = POINTER(_LSA_UNICODE_STRING)
|
|
|
|
# Struct _RTL_USER_PROCESS_PARAMETERS definitions
|
|
class _RTL_USER_PROCESS_PARAMETERS(Structure):
|
|
_fields_ = [
|
|
("Reserved1", BYTE * 16),
|
|
("Reserved2", PVOID * 10),
|
|
("ImagePathName", UNICODE_STRING),
|
|
("CommandLine", UNICODE_STRING),
|
|
]
|
|
PRTL_USER_PROCESS_PARAMETERS = POINTER(_RTL_USER_PROCESS_PARAMETERS)
|
|
RTL_USER_PROCESS_PARAMETERS = _RTL_USER_PROCESS_PARAMETERS
|
|
|
|
# Struct _PEB definitions
|
|
class _PEB(Structure):
|
|
_fields_ = [
|
|
("Reserved1", BYTE * 2),
|
|
("BeingDebugged", BYTE),
|
|
("Reserved2", BYTE * 1),
|
|
("Reserved3", PVOID * 2),
|
|
("Ldr", PPEB_LDR_DATA),
|
|
("ProcessParameters", PRTL_USER_PROCESS_PARAMETERS),
|
|
("Reserved4", BYTE * 104),
|
|
("Reserved5", PVOID * 52),
|
|
("PostProcessInitRoutine", PPS_POST_PROCESS_INIT_ROUTINE),
|
|
("Reserved6", BYTE * 128),
|
|
("Reserved7", PVOID * 1),
|
|
("SessionId", ULONG),
|
|
]
|
|
PPEB = POINTER(_PEB)
|
|
PEB = _PEB
|
|
|
|
# Struct _SECURITY_ATTRIBUTES definitions
|
|
class _SECURITY_ATTRIBUTES(Structure):
|
|
_fields_ = [
|
|
("nLength", DWORD),
|
|
("lpSecurityDescriptor", LPVOID),
|
|
("bInheritHandle", BOOL),
|
|
]
|
|
SECURITY_ATTRIBUTES = _SECURITY_ATTRIBUTES
|
|
LPSECURITY_ATTRIBUTES = POINTER(_SECURITY_ATTRIBUTES)
|
|
PSECURITY_ATTRIBUTES = POINTER(_SECURITY_ATTRIBUTES)
|
|
|
|
# Struct _SYSTEM_VERIFIER_INFORMATION definitions
|
|
class _SYSTEM_VERIFIER_INFORMATION(Structure):
|
|
_fields_ = [
|
|
("NextEntryOffset", ULONG),
|
|
("Level", ULONG),
|
|
("DriverName", UNICODE_STRING),
|
|
("RaiseIrqls", ULONG),
|
|
("AcquireSpinLocks", ULONG),
|
|
("SynchronizeExecutions", ULONG),
|
|
("AllocationsAttempted", ULONG),
|
|
("AllocationsSucceeded", ULONG),
|
|
("AllocationsSucceededSpecialPool", ULONG),
|
|
("AllocationsWithNoTag", ULONG),
|
|
("TrimRequests", ULONG),
|
|
("Trims", ULONG),
|
|
("AllocationsFailed", ULONG),
|
|
("AllocationsFailedDeliberately", ULONG),
|
|
("Loads", ULONG),
|
|
("Unloads", ULONG),
|
|
("UnTrackedPool", ULONG),
|
|
("CurrentPagedPoolAllocations", ULONG),
|
|
("CurrentNonPagedPoolAllocations", ULONG),
|
|
("PeakPagedPoolAllocations", ULONG),
|
|
("PeakNonPagedPoolAllocations", ULONG),
|
|
("PagedPoolUsageInBytes", SIZE_T),
|
|
("NonPagedPoolUsageInBytes", SIZE_T),
|
|
("PeakPagedPoolUsageInBytes", SIZE_T),
|
|
("PeakNonPagedPoolUsageInBytes", SIZE_T),
|
|
]
|
|
PSYSTEM_VERIFIER_INFORMATION = POINTER(_SYSTEM_VERIFIER_INFORMATION)
|
|
SYSTEM_VERIFIER_INFORMATION = _SYSTEM_VERIFIER_INFORMATION
|
|
|
|
# Struct _LDR_DATA_TABLE_ENTRY definitions
|
|
class _LDR_DATA_TABLE_ENTRY(Structure):
|
|
_fields_ = [
|
|
("Reserved1", PVOID * 2),
|
|
("InMemoryOrderLinks", LIST_ENTRY),
|
|
("Reserved2", PVOID * 2),
|
|
("DllBase", PVOID),
|
|
("EntryPoint", PVOID),
|
|
("Reserved3", PVOID),
|
|
("FullDllName", UNICODE_STRING),
|
|
("BaseDllName", UNICODE_STRING),
|
|
("Reserved5", PVOID * 3),
|
|
("CheckSum", ULONG),
|
|
("TimeDateStamp", ULONG),
|
|
]
|
|
PLDR_DATA_TABLE_ENTRY = POINTER(_LDR_DATA_TABLE_ENTRY)
|
|
LDR_DATA_TABLE_ENTRY = _LDR_DATA_TABLE_ENTRY
|
|
|
|
# Struct _IMAGE_FILE_HEADER definitions
|
|
class _IMAGE_FILE_HEADER(Structure):
|
|
_fields_ = [
|
|
("Machine", WORD),
|
|
("NumberOfSections", WORD),
|
|
("TimeDateStamp", DWORD),
|
|
("PointerToSymbolTable", DWORD),
|
|
("NumberOfSymbols", DWORD),
|
|
("SizeOfOptionalHeader", WORD),
|
|
("Characteristics", WORD),
|
|
]
|
|
IMAGE_FILE_HEADER = _IMAGE_FILE_HEADER
|
|
PIMAGE_FILE_HEADER = POINTER(_IMAGE_FILE_HEADER)
|
|
|
|
# Struct _IMAGE_DATA_DIRECTORY definitions
|
|
class _IMAGE_DATA_DIRECTORY(Structure):
|
|
_fields_ = [
|
|
("VirtualAddress", DWORD),
|
|
("Size", DWORD),
|
|
]
|
|
IMAGE_DATA_DIRECTORY = _IMAGE_DATA_DIRECTORY
|
|
PIMAGE_DATA_DIRECTORY = POINTER(_IMAGE_DATA_DIRECTORY)
|
|
|
|
# Struct _IMAGE_SECTION_HEADER definitions
|
|
class _IMAGE_SECTION_HEADER(Structure):
|
|
_fields_ = [
|
|
("Name", BYTE * IMAGE_SIZEOF_SHORT_NAME),
|
|
("VirtualSize", DWORD),
|
|
("VirtualAddress", DWORD),
|
|
("SizeOfRawData", DWORD),
|
|
("PointerToRawData", DWORD),
|
|
("PointerToRelocations", DWORD),
|
|
("PointerToLinenumbers", DWORD),
|
|
("NumberOfRelocations", WORD),
|
|
("NumberOfLinenumbers", WORD),
|
|
("Characteristics", DWORD),
|
|
]
|
|
PIMAGE_SECTION_HEADER = POINTER(_IMAGE_SECTION_HEADER)
|
|
IMAGE_SECTION_HEADER = _IMAGE_SECTION_HEADER
|
|
|
|
# Struct _IMAGE_OPTIONAL_HEADER64 definitions
|
|
class _IMAGE_OPTIONAL_HEADER64(Structure):
|
|
_fields_ = [
|
|
("Magic", WORD),
|
|
("MajorLinkerVersion", BYTE),
|
|
("MinorLinkerVersion", BYTE),
|
|
("SizeOfCode", DWORD),
|
|
("SizeOfInitializedData", DWORD),
|
|
("SizeOfUninitializedData", DWORD),
|
|
("AddressOfEntryPoint", DWORD),
|
|
("BaseOfCode", DWORD),
|
|
("ImageBase", ULONGLONG),
|
|
("SectionAlignment", DWORD),
|
|
("FileAlignment", DWORD),
|
|
("MajorOperatingSystemVersion", WORD),
|
|
("MinorOperatingSystemVersion", WORD),
|
|
("MajorImageVersion", WORD),
|
|
("MinorImageVersion", WORD),
|
|
("MajorSubsystemVersion", WORD),
|
|
("MinorSubsystemVersion", WORD),
|
|
("Win32VersionValue", DWORD),
|
|
("SizeOfImage", DWORD),
|
|
("SizeOfHeaders", DWORD),
|
|
("CheckSum", DWORD),
|
|
("Subsystem", WORD),
|
|
("DllCharacteristics", WORD),
|
|
("SizeOfStackReserve", ULONGLONG),
|
|
("SizeOfStackCommit", ULONGLONG),
|
|
("SizeOfHeapReserve", ULONGLONG),
|
|
("SizeOfHeapCommit", ULONGLONG),
|
|
("LoaderFlags", DWORD),
|
|
("NumberOfRvaAndSizes", DWORD),
|
|
("DataDirectory", IMAGE_DATA_DIRECTORY * IMAGE_NUMBEROF_DIRECTORY_ENTRIES),
|
|
]
|
|
PIMAGE_OPTIONAL_HEADER64 = POINTER(_IMAGE_OPTIONAL_HEADER64)
|
|
IMAGE_OPTIONAL_HEADER64 = _IMAGE_OPTIONAL_HEADER64
|
|
|
|
# Struct _IMAGE_OPTIONAL_HEADER definitions
|
|
class _IMAGE_OPTIONAL_HEADER(Structure):
|
|
_fields_ = [
|
|
("Magic", WORD),
|
|
("MajorLinkerVersion", BYTE),
|
|
("MinorLinkerVersion", BYTE),
|
|
("SizeOfCode", DWORD),
|
|
("SizeOfInitializedData", DWORD),
|
|
("SizeOfUninitializedData", DWORD),
|
|
("AddressOfEntryPoint", DWORD),
|
|
("BaseOfCode", DWORD),
|
|
("BaseOfData", DWORD),
|
|
("ImageBase", DWORD),
|
|
("SectionAlignment", DWORD),
|
|
("FileAlignment", DWORD),
|
|
("MajorOperatingSystemVersion", WORD),
|
|
("MinorOperatingSystemVersion", WORD),
|
|
("MajorImageVersion", WORD),
|
|
("MinorImageVersion", WORD),
|
|
("MajorSubsystemVersion", WORD),
|
|
("MinorSubsystemVersion", WORD),
|
|
("Win32VersionValue", DWORD),
|
|
("SizeOfImage", DWORD),
|
|
("SizeOfHeaders", DWORD),
|
|
("CheckSum", DWORD),
|
|
("Subsystem", WORD),
|
|
("DllCharacteristics", WORD),
|
|
("SizeOfStackReserve", DWORD),
|
|
("SizeOfStackCommit", DWORD),
|
|
("SizeOfHeapReserve", DWORD),
|
|
("SizeOfHeapCommit", DWORD),
|
|
("LoaderFlags", DWORD),
|
|
("NumberOfRvaAndSizes", DWORD),
|
|
("DataDirectory", IMAGE_DATA_DIRECTORY * IMAGE_NUMBEROF_DIRECTORY_ENTRIES),
|
|
]
|
|
PIMAGE_OPTIONAL_HEADER32 = POINTER(_IMAGE_OPTIONAL_HEADER)
|
|
IMAGE_OPTIONAL_HEADER32 = _IMAGE_OPTIONAL_HEADER
|
|
|
|
# Struct _IMAGE_NT_HEADERS64 definitions
|
|
class _IMAGE_NT_HEADERS64(Structure):
|
|
_fields_ = [
|
|
("Signature", DWORD),
|
|
("FileHeader", IMAGE_FILE_HEADER),
|
|
("OptionalHeader", IMAGE_OPTIONAL_HEADER64),
|
|
]
|
|
PIMAGE_NT_HEADERS64 = POINTER(_IMAGE_NT_HEADERS64)
|
|
IMAGE_NT_HEADERS64 = _IMAGE_NT_HEADERS64
|
|
|
|
# Struct _IMAGE_NT_HEADERS definitions
|
|
class _IMAGE_NT_HEADERS(Structure):
|
|
_fields_ = [
|
|
("Signature", DWORD),
|
|
("FileHeader", IMAGE_FILE_HEADER),
|
|
("OptionalHeader", IMAGE_OPTIONAL_HEADER32),
|
|
]
|
|
IMAGE_NT_HEADERS32 = _IMAGE_NT_HEADERS
|
|
PIMAGE_NT_HEADERS32 = POINTER(_IMAGE_NT_HEADERS)
|
|
|
|
# Struct _IMAGE_IMPORT_DESCRIPTOR definitions
|
|
class _IMAGE_IMPORT_DESCRIPTOR(Structure):
|
|
_fields_ = [
|
|
("OriginalFirstThunk", DWORD),
|
|
("TimeDateStamp", DWORD),
|
|
("ForwarderChain", DWORD),
|
|
("Name", DWORD),
|
|
("FirstThunk", DWORD),
|
|
]
|
|
IMAGE_IMPORT_DESCRIPTOR = _IMAGE_IMPORT_DESCRIPTOR
|
|
PIMAGE_IMPORT_DESCRIPTOR = POINTER(_IMAGE_IMPORT_DESCRIPTOR)
|
|
|
|
# Struct _IMAGE_IMPORT_BY_NAME definitions
|
|
class _IMAGE_IMPORT_BY_NAME(Structure):
|
|
_fields_ = [
|
|
("Hint", WORD),
|
|
("Name", BYTE * 1),
|
|
]
|
|
PIMAGE_IMPORT_BY_NAME = POINTER(_IMAGE_IMPORT_BY_NAME)
|
|
IMAGE_IMPORT_BY_NAME = _IMAGE_IMPORT_BY_NAME
|
|
|
|
# Struct _IMAGE_EXPORT_DIRECTORY definitions
|
|
class _IMAGE_EXPORT_DIRECTORY(Structure):
|
|
_fields_ = [
|
|
("Characteristics", DWORD),
|
|
("TimeDateStamp", DWORD),
|
|
("MajorVersion", WORD),
|
|
("MinorVersion", WORD),
|
|
("Name", DWORD),
|
|
("Base", DWORD),
|
|
("NumberOfFunctions", DWORD),
|
|
("NumberOfNames", DWORD),
|
|
("AddressOfFunctions", DWORD),
|
|
("AddressOfNames", DWORD),
|
|
("AddressOfNameOrdinals", DWORD),
|
|
]
|
|
IMAGE_EXPORT_DIRECTORY = _IMAGE_EXPORT_DIRECTORY
|
|
PIMAGE_EXPORT_DIRECTORY = POINTER(_IMAGE_EXPORT_DIRECTORY)
|
|
|
|
# Struct _MEMORY_BASIC_INFORMATION definitions
|
|
class _MEMORY_BASIC_INFORMATION(Structure):
|
|
_fields_ = [
|
|
("BaseAddress", PVOID),
|
|
("AllocationBase", PVOID),
|
|
("AllocationProtect", DWORD),
|
|
("RegionSize", SIZE_T),
|
|
("State", DWORD),
|
|
("Protect", DWORD),
|
|
("Type", DWORD),
|
|
]
|
|
PMEMORY_BASIC_INFORMATION = POINTER(_MEMORY_BASIC_INFORMATION)
|
|
MEMORY_BASIC_INFORMATION = _MEMORY_BASIC_INFORMATION
|
|
|
|
# Struct _STARTUPINFOA definitions
|
|
class _STARTUPINFOA(Structure):
|
|
_fields_ = [
|
|
("cb", DWORD),
|
|
("lpReserved", LPSTR),
|
|
("lpDesktop", LPSTR),
|
|
("lpTitle", LPSTR),
|
|
("dwX", DWORD),
|
|
("dwY", DWORD),
|
|
("dwXSize", DWORD),
|
|
("dwYSize", DWORD),
|
|
("dwXCountChars", DWORD),
|
|
("dwYCountChars", DWORD),
|
|
("dwFillAttribute", DWORD),
|
|
("dwFlags", DWORD),
|
|
("wShowWindow", WORD),
|
|
("cbReserved2", WORD),
|
|
("lpReserved2", LPBYTE),
|
|
("hStdInput", HANDLE),
|
|
("hStdOutput", HANDLE),
|
|
("hStdError", HANDLE),
|
|
]
|
|
LPSTARTUPINFOA = POINTER(_STARTUPINFOA)
|
|
STARTUPINFOA = _STARTUPINFOA
|
|
|
|
# Struct _STARTUPINFOW definitions
|
|
class _STARTUPINFOW(Structure):
|
|
_fields_ = [
|
|
("cb", DWORD),
|
|
("lpReserved", LPWSTR),
|
|
("lpDesktop", LPWSTR),
|
|
("lpTitle", LPWSTR),
|
|
("dwX", DWORD),
|
|
("dwY", DWORD),
|
|
("dwXSize", DWORD),
|
|
("dwYSize", DWORD),
|
|
("dwXCountChars", DWORD),
|
|
("dwYCountChars", DWORD),
|
|
("dwFillAttribute", DWORD),
|
|
("dwFlags", DWORD),
|
|
("wShowWindow", WORD),
|
|
("cbReserved2", WORD),
|
|
("lpReserved2", LPBYTE),
|
|
("hStdInput", HANDLE),
|
|
("hStdOutput", HANDLE),
|
|
("hStdError", HANDLE),
|
|
]
|
|
STARTUPINFOW = _STARTUPINFOW
|
|
LPSTARTUPINFOW = POINTER(_STARTUPINFOW)
|
|
|
|
# Struct _PROCESS_INFORMATION definitions
|
|
class _PROCESS_INFORMATION(Structure):
|
|
_fields_ = [
|
|
("hProcess", HANDLE),
|
|
("hThread", HANDLE),
|
|
("dwProcessId", DWORD),
|
|
("dwThreadId", DWORD),
|
|
]
|
|
LPPROCESS_INFORMATION = POINTER(_PROCESS_INFORMATION)
|
|
PROCESS_INFORMATION = _PROCESS_INFORMATION
|
|
PPROCESS_INFORMATION = POINTER(_PROCESS_INFORMATION)
|
|
|
|
# Struct _FLOATING_SAVE_AREA definitions
|
|
class _FLOATING_SAVE_AREA(Structure):
|
|
_fields_ = [
|
|
("ControlWord", DWORD),
|
|
("StatusWord", DWORD),
|
|
("TagWord", DWORD),
|
|
("ErrorOffset", DWORD),
|
|
("ErrorSelector", DWORD),
|
|
("DataOffset", DWORD),
|
|
("DataSelector", DWORD),
|
|
("RegisterArea", BYTE * 80),
|
|
("Cr0NpxState", DWORD),
|
|
]
|
|
FLOATING_SAVE_AREA = _FLOATING_SAVE_AREA
|
|
|
|
# Struct _CONTEXT32 definitions
|
|
class _CONTEXT32(Structure):
|
|
_fields_ = [
|
|
("ContextFlags", DWORD),
|
|
("Dr0", DWORD),
|
|
("Dr1", DWORD),
|
|
("Dr2", DWORD),
|
|
("Dr3", DWORD),
|
|
("Dr6", DWORD),
|
|
("Dr7", DWORD),
|
|
("FloatSave", FLOATING_SAVE_AREA),
|
|
("SegGs", DWORD),
|
|
("SegFs", DWORD),
|
|
("SegEs", DWORD),
|
|
("SegDs", DWORD),
|
|
("Edi", DWORD),
|
|
("Esi", DWORD),
|
|
("Ebx", DWORD),
|
|
("Edx", DWORD),
|
|
("Ecx", DWORD),
|
|
("Eax", DWORD),
|
|
("Ebp", DWORD),
|
|
("Eip", DWORD),
|
|
("SegCs", DWORD),
|
|
("EFlags", DWORD),
|
|
("Esp", DWORD),
|
|
("SegSs", DWORD),
|
|
("ExtendedRegisters", BYTE * 512),
|
|
]
|
|
PCONTEXT32 = POINTER(_CONTEXT32)
|
|
CONTEXT32 = _CONTEXT32
|
|
LPCONTEXT32 = POINTER(_CONTEXT32)
|
|
|
|
# Struct _M128A definitions
|
|
class _M128A(Structure):
|
|
_fields_ = [
|
|
("Low", ULONGLONG),
|
|
("High", LONGLONG),
|
|
]
|
|
M128A = _M128A
|
|
PM128A = POINTER(_M128A)
|
|
|
|
# Struct _CONTEXT64 definitions
|
|
class _CONTEXT64(Structure):
|
|
_fields_ = [
|
|
("P1Home", DWORD64),
|
|
("P2Home", DWORD64),
|
|
("P3Home", DWORD64),
|
|
("P4Home", DWORD64),
|
|
("P5Home", DWORD64),
|
|
("P6Home", DWORD64),
|
|
("ContextFlags", DWORD),
|
|
("MxCsr", DWORD),
|
|
("SegCs", WORD),
|
|
("SegDs", WORD),
|
|
("SegEs", WORD),
|
|
("SegFs", WORD),
|
|
("SegGs", WORD),
|
|
("SegSs", WORD),
|
|
("EFlags", DWORD),
|
|
("Dr0", DWORD64),
|
|
("Dr1", DWORD64),
|
|
("Dr2", DWORD64),
|
|
("Dr3", DWORD64),
|
|
("Dr6", DWORD64),
|
|
("Dr7", DWORD64),
|
|
("Rax", DWORD64),
|
|
("Rcx", DWORD64),
|
|
("Rdx", DWORD64),
|
|
("Rbx", DWORD64),
|
|
("Rsp", DWORD64),
|
|
("Rbp", DWORD64),
|
|
("Rsi", DWORD64),
|
|
("Rdi", DWORD64),
|
|
("R8", DWORD64),
|
|
("R9", DWORD64),
|
|
("R10", DWORD64),
|
|
("R11", DWORD64),
|
|
("R12", DWORD64),
|
|
("R13", DWORD64),
|
|
("R14", DWORD64),
|
|
("R15", DWORD64),
|
|
("Rip", DWORD64),
|
|
("Header", M128A * 2),
|
|
("Legacy", M128A * 8),
|
|
("Xmm0", M128A),
|
|
("Xmm1", M128A),
|
|
("Xmm2", M128A),
|
|
("Xmm3", M128A),
|
|
("Xmm4", M128A),
|
|
("Xmm5", M128A),
|
|
("Xmm6", M128A),
|
|
("Xmm7", M128A),
|
|
("Xmm8", M128A),
|
|
("Xmm9", M128A),
|
|
("Xmm10", M128A),
|
|
("Xmm11", M128A),
|
|
("Xmm12", M128A),
|
|
("Xmm13", M128A),
|
|
("Xmm14", M128A),
|
|
("Xmm15", M128A),
|
|
("VectorRegister", M128A * 26),
|
|
("VectorControl", DWORD64),
|
|
("DebugControl", DWORD64),
|
|
("LastBranchToRip", DWORD64),
|
|
("LastBranchFromRip", DWORD64),
|
|
("LastExceptionToRip", DWORD64),
|
|
("LastExceptionFromRip", DWORD64),
|
|
]
|
|
PCONTEXT64 = POINTER(_CONTEXT64)
|
|
CONTEXT64 = _CONTEXT64
|
|
LPCONTEXT64 = POINTER(_CONTEXT64)
|
|
|
|
# Struct tagPROCESSENTRY32W definitions
|
|
class tagPROCESSENTRY32W(Structure):
|
|
_fields_ = [
|
|
("dwSize", DWORD),
|
|
("cntUsage", DWORD),
|
|
("th32ProcessID", DWORD),
|
|
("th32DefaultHeapID", ULONG_PTR),
|
|
("th32ModuleID", DWORD),
|
|
("cntThreads", DWORD),
|
|
("th32ParentProcessID", DWORD),
|
|
("pcPriClassBase", LONG),
|
|
("dwFlags", DWORD),
|
|
("szExeFile", WCHAR * MAX_PATH),
|
|
]
|
|
PPROCESSENTRY32W = POINTER(tagPROCESSENTRY32W)
|
|
LPPROCESSENTRY32W = POINTER(tagPROCESSENTRY32W)
|
|
PROCESSENTRY32W = tagPROCESSENTRY32W
|
|
|
|
# Struct tagPROCESSENTRY32 definitions
|
|
class tagPROCESSENTRY32(Structure):
|
|
_fields_ = [
|
|
("dwSize", DWORD),
|
|
("cntUsage", DWORD),
|
|
("th32ProcessID", DWORD),
|
|
("th32DefaultHeapID", ULONG_PTR),
|
|
("th32ModuleID", DWORD),
|
|
("cntThreads", DWORD),
|
|
("th32ParentProcessID", DWORD),
|
|
("pcPriClassBase", LONG),
|
|
("dwFlags", DWORD),
|
|
("szExeFile", CHAR * MAX_PATH),
|
|
]
|
|
PROCESSENTRY32 = tagPROCESSENTRY32
|
|
PPROCESSENTRY32 = POINTER(tagPROCESSENTRY32)
|
|
LPPROCESSENTRY32 = POINTER(tagPROCESSENTRY32)
|
|
|
|
# Struct tagTHREADENTRY32 definitions
|
|
class tagTHREADENTRY32(Structure):
|
|
_fields_ = [
|
|
("dwSize", DWORD),
|
|
("cntUsage", DWORD),
|
|
("th32ThreadID", DWORD),
|
|
("th32OwnerProcessID", DWORD),
|
|
("tpBasePri", LONG),
|
|
("tpDeltaPri", LONG),
|
|
("dwFlags", DWORD),
|
|
]
|
|
PTHREADENTRY32 = POINTER(tagTHREADENTRY32)
|
|
THREADENTRY32 = tagTHREADENTRY32
|
|
LPTHREADENTRY32 = POINTER(tagTHREADENTRY32)
|
|
|
|
# Struct _LUID definitions
|
|
class _LUID(Structure):
|
|
_fields_ = [
|
|
("LowPart", DWORD),
|
|
("HighPart", LONG),
|
|
]
|
|
LUID = _LUID
|
|
PLUID = POINTER(_LUID)
|
|
|
|
# Struct _LUID_AND_ATTRIBUTES definitions
|
|
class _LUID_AND_ATTRIBUTES(Structure):
|
|
_fields_ = [
|
|
("Luid", LUID),
|
|
("Attributes", DWORD),
|
|
]
|
|
LUID_AND_ATTRIBUTES = _LUID_AND_ATTRIBUTES
|
|
PLUID_AND_ATTRIBUTES = POINTER(_LUID_AND_ATTRIBUTES)
|
|
|
|
# Struct _TOKEN_PRIVILEGES definitions
|
|
class _TOKEN_PRIVILEGES(Structure):
|
|
_fields_ = [
|
|
("PrivilegeCount", DWORD),
|
|
("Privileges", LUID_AND_ATTRIBUTES * ANYSIZE_ARRAY),
|
|
]
|
|
TOKEN_PRIVILEGES = _TOKEN_PRIVILEGES
|
|
PTOKEN_PRIVILEGES = POINTER(_TOKEN_PRIVILEGES)
|
|
|
|
# Struct _TOKEN_ELEVATION definitions
|
|
class _TOKEN_ELEVATION(Structure):
|
|
_fields_ = [
|
|
("TokenIsElevated", DWORD),
|
|
]
|
|
TOKEN_ELEVATION = _TOKEN_ELEVATION
|
|
PTOKEN_ELEVATION = POINTER(_TOKEN_ELEVATION)
|
|
|
|
# Struct _OSVERSIONINFOA definitions
|
|
class _OSVERSIONINFOA(Structure):
|
|
_fields_ = [
|
|
("dwOSVersionInfoSize", DWORD),
|
|
("dwMajorVersion", DWORD),
|
|
("dwMinorVersion", DWORD),
|
|
("dwBuildNumber", DWORD),
|
|
("dwPlatformId", DWORD),
|
|
("szCSDVersion", CHAR * 128),
|
|
]
|
|
POSVERSIONINFOA = POINTER(_OSVERSIONINFOA)
|
|
OSVERSIONINFOA = _OSVERSIONINFOA
|
|
LPOSVERSIONINFOA = POINTER(_OSVERSIONINFOA)
|
|
|
|
# Struct _OSVERSIONINFOW definitions
|
|
class _OSVERSIONINFOW(Structure):
|
|
_fields_ = [
|
|
("dwOSVersionInfoSize", DWORD),
|
|
("dwMajorVersion", DWORD),
|
|
("dwMinorVersion", DWORD),
|
|
("dwBuildNumber", DWORD),
|
|
("dwPlatformId", DWORD),
|
|
("szCSDVersion", WCHAR * 128),
|
|
]
|
|
RTL_OSVERSIONINFOW = _OSVERSIONINFOW
|
|
PRTL_OSVERSIONINFOW = POINTER(_OSVERSIONINFOW)
|
|
LPOSVERSIONINFOW = POINTER(_OSVERSIONINFOW)
|
|
POSVERSIONINFOW = POINTER(_OSVERSIONINFOW)
|
|
OSVERSIONINFOW = _OSVERSIONINFOW
|
|
|
|
# Struct _OSVERSIONINFOEXA definitions
|
|
class _OSVERSIONINFOEXA(Structure):
|
|
_fields_ = [
|
|
("dwOSVersionInfoSize", DWORD),
|
|
("dwMajorVersion", DWORD),
|
|
("dwMinorVersion", DWORD),
|
|
("dwBuildNumber", DWORD),
|
|
("dwPlatformId", DWORD),
|
|
("szCSDVersion", CHAR * 128),
|
|
("wServicePackMajor", WORD),
|
|
("wServicePackMinor", WORD),
|
|
("wSuiteMask", WORD),
|
|
("wProductType", BYTE),
|
|
("wReserved", BYTE),
|
|
]
|
|
OSVERSIONINFOEXA = _OSVERSIONINFOEXA
|
|
POSVERSIONINFOEXA = POINTER(_OSVERSIONINFOEXA)
|
|
LPOSVERSIONINFOEXA = POINTER(_OSVERSIONINFOEXA)
|
|
|
|
# Struct _OSVERSIONINFOEXW definitions
|
|
class _OSVERSIONINFOEXW(Structure):
|
|
_fields_ = [
|
|
("dwOSVersionInfoSize", DWORD),
|
|
("dwMajorVersion", DWORD),
|
|
("dwMinorVersion", DWORD),
|
|
("dwBuildNumber", DWORD),
|
|
("dwPlatformId", DWORD),
|
|
("szCSDVersion", WCHAR * 128),
|
|
("wServicePackMajor", WORD),
|
|
("wServicePackMinor", WORD),
|
|
("wSuiteMask", WORD),
|
|
("wProductType", BYTE),
|
|
("wReserved", BYTE),
|
|
]
|
|
PRTL_OSVERSIONINFOEXW = POINTER(_OSVERSIONINFOEXW)
|
|
LPOSVERSIONINFOEXW = POINTER(_OSVERSIONINFOEXW)
|
|
OSVERSIONINFOEXW = _OSVERSIONINFOEXW
|
|
POSVERSIONINFOEXW = POINTER(_OSVERSIONINFOEXW)
|
|
RTL_OSVERSIONINFOEXW = _OSVERSIONINFOEXW
|
|
|
|
# Struct _OVERLAPPED definitions
|
|
class _OVERLAPPED(Structure):
|
|
_fields_ = [
|
|
("Internal", ULONG_PTR),
|
|
("InternalHigh", ULONG_PTR),
|
|
("Pointer", PVOID),
|
|
("hEvent", HANDLE),
|
|
]
|
|
LPOVERLAPPED = POINTER(_OVERLAPPED)
|
|
OVERLAPPED = _OVERLAPPED
|
|
|
|
# Struct _MIB_TCPROW_OWNER_PID definitions
|
|
class _MIB_TCPROW_OWNER_PID(Structure):
|
|
_fields_ = [
|
|
("dwState", DWORD),
|
|
("dwLocalAddr", DWORD),
|
|
("dwLocalPort", DWORD),
|
|
("dwRemoteAddr", DWORD),
|
|
("dwRemotePort", DWORD),
|
|
("dwOwningPid", DWORD),
|
|
]
|
|
MIB_TCPROW_OWNER_PID = _MIB_TCPROW_OWNER_PID
|
|
PMIB_TCPROW_OWNER_PID = POINTER(_MIB_TCPROW_OWNER_PID)
|
|
|
|
# Struct _MIB_TCPTABLE_OWNER_PID definitions
|
|
class _MIB_TCPTABLE_OWNER_PID(Structure):
|
|
_fields_ = [
|
|
("dwNumEntries", DWORD),
|
|
("table", MIB_TCPROW_OWNER_PID * ANY_SIZE),
|
|
]
|
|
MIB_TCPTABLE_OWNER_PID = _MIB_TCPTABLE_OWNER_PID
|
|
PMIB_TCPTABLE_OWNER_PID = POINTER(_MIB_TCPTABLE_OWNER_PID)
|
|
|
|
# Struct _MIB_UDPROW_OWNER_PID definitions
|
|
class _MIB_UDPROW_OWNER_PID(Structure):
|
|
_fields_ = [
|
|
("dwLocalAddr", DWORD),
|
|
("dwLocalPort", DWORD),
|
|
("dwOwningPid", DWORD),
|
|
]
|
|
MIB_UDPROW_OWNER_PID = _MIB_UDPROW_OWNER_PID
|
|
PMIB_UDPROW_OWNER_PID = POINTER(_MIB_UDPROW_OWNER_PID)
|
|
|
|
# Struct _MIB_UDPTABLE_OWNER_PID definitions
|
|
class _MIB_UDPTABLE_OWNER_PID(Structure):
|
|
_fields_ = [
|
|
("dwNumEntries", DWORD),
|
|
("table", MIB_UDPROW_OWNER_PID * ANY_SIZE),
|
|
]
|
|
MIB_UDPTABLE_OWNER_PID = _MIB_UDPTABLE_OWNER_PID
|
|
PMIB_UDPTABLE_OWNER_PID = POINTER(_MIB_UDPTABLE_OWNER_PID)
|
|
|
|
# Struct _MIB_UDP6ROW_OWNER_PID definitions
|
|
class _MIB_UDP6ROW_OWNER_PID(Structure):
|
|
_fields_ = [
|
|
("ucLocalAddr", UCHAR * 16),
|
|
("dwLocalScopeId", DWORD),
|
|
("dwLocalPort", DWORD),
|
|
("dwOwningPid", DWORD),
|
|
]
|
|
MIB_UDP6ROW_OWNER_PID = _MIB_UDP6ROW_OWNER_PID
|
|
PMIB_UDP6ROW_OWNER_PID = POINTER(_MIB_UDP6ROW_OWNER_PID)
|
|
|
|
# Struct _MIB_UDP6TABLE_OWNER_PID definitions
|
|
class _MIB_UDP6TABLE_OWNER_PID(Structure):
|
|
_fields_ = [
|
|
("dwNumEntries", DWORD),
|
|
("table", MIB_UDP6ROW_OWNER_PID * ANY_SIZE),
|
|
]
|
|
PMIB_UDP6TABLE_OWNER_PID = POINTER(_MIB_UDP6TABLE_OWNER_PID)
|
|
MIB_UDP6TABLE_OWNER_PID = _MIB_UDP6TABLE_OWNER_PID
|
|
|
|
# Struct _MIB_TCP6ROW_OWNER_PID definitions
|
|
class _MIB_TCP6ROW_OWNER_PID(Structure):
|
|
_fields_ = [
|
|
("ucLocalAddr", UCHAR * 16),
|
|
("dwLocalScopeId", DWORD),
|
|
("dwLocalPort", DWORD),
|
|
("ucRemoteAddr", UCHAR * 16),
|
|
("dwRemoteScopeId", DWORD),
|
|
("dwRemotePort", DWORD),
|
|
("dwState", DWORD),
|
|
("dwOwningPid", DWORD),
|
|
]
|
|
MIB_TCP6ROW_OWNER_PID = _MIB_TCP6ROW_OWNER_PID
|
|
PMIB_TCP6ROW_OWNER_PID = POINTER(_MIB_TCP6ROW_OWNER_PID)
|
|
|
|
# Struct _MIB_TCP6TABLE_OWNER_PID definitions
|
|
class _MIB_TCP6TABLE_OWNER_PID(Structure):
|
|
_fields_ = [
|
|
("dwNumEntries", DWORD),
|
|
("table", MIB_TCP6ROW_OWNER_PID * ANY_SIZE),
|
|
]
|
|
MIB_TCP6TABLE_OWNER_PID = _MIB_TCP6TABLE_OWNER_PID
|
|
PMIB_TCP6TABLE_OWNER_PID = POINTER(_MIB_TCP6TABLE_OWNER_PID)
|
|
|
|
# Struct _MIB_TCPROW definitions
|
|
class _MIB_TCPROW(Structure):
|
|
_fields_ = [
|
|
("dwState", DWORD),
|
|
("dwLocalAddr", DWORD),
|
|
("dwLocalPort", DWORD),
|
|
("dwRemoteAddr", DWORD),
|
|
("dwRemotePort", DWORD),
|
|
]
|
|
MIB_TCPROW = _MIB_TCPROW
|
|
PMIB_TCPROW = POINTER(_MIB_TCPROW)
|
|
|
|
# Struct _EXCEPTION_RECORD definitions
|
|
# Self referencing struct tricks
|
|
class _EXCEPTION_RECORD(Structure): pass
|
|
_EXCEPTION_RECORD._fields_ = [
|
|
("ExceptionCode", DWORD),
|
|
("ExceptionFlags", DWORD),
|
|
("ExceptionRecord", POINTER(_EXCEPTION_RECORD)),
|
|
("ExceptionAddress", PVOID),
|
|
("NumberParameters", DWORD),
|
|
("ExceptionInformation", ULONG_PTR * EXCEPTION_MAXIMUM_PARAMETERS),
|
|
]
|
|
PEXCEPTION_RECORD = POINTER(_EXCEPTION_RECORD)
|
|
EXCEPTION_RECORD = _EXCEPTION_RECORD
|
|
|
|
# Struct _EXCEPTION_POINTERS64 definitions
|
|
class _EXCEPTION_POINTERS64(Structure):
|
|
_fields_ = [
|
|
("ExceptionRecord", PEXCEPTION_RECORD),
|
|
("ContextRecord", PCONTEXT64),
|
|
]
|
|
EXCEPTION_POINTERS64 = _EXCEPTION_POINTERS64
|
|
PEXCEPTION_POINTERS64 = POINTER(_EXCEPTION_POINTERS64)
|
|
|
|
# Struct _EXCEPTION_POINTERS32 definitions
|
|
class _EXCEPTION_POINTERS32(Structure):
|
|
_fields_ = [
|
|
("ExceptionRecord", PEXCEPTION_RECORD),
|
|
("ContextRecord", PCONTEXT32),
|
|
]
|
|
PEXCEPTION_POINTERS32 = POINTER(_EXCEPTION_POINTERS32)
|
|
EXCEPTION_POINTERS32 = _EXCEPTION_POINTERS32
|
|
|
|
# Struct _DEBUG_PROCESSOR_IDENTIFICATION_ALPHA definitions
|
|
class _DEBUG_PROCESSOR_IDENTIFICATION_ALPHA(Structure):
|
|
_fields_ = [
|
|
("Type", ULONG),
|
|
("Revision", ULONG),
|
|
]
|
|
DEBUG_PROCESSOR_IDENTIFICATION_ALPHA = _DEBUG_PROCESSOR_IDENTIFICATION_ALPHA
|
|
PDEBUG_PROCESSOR_IDENTIFICATION_ALPHA = POINTER(_DEBUG_PROCESSOR_IDENTIFICATION_ALPHA)
|
|
|
|
# Struct _DEBUG_PROCESSOR_IDENTIFICATION_AMD64 definitions
|
|
class _DEBUG_PROCESSOR_IDENTIFICATION_AMD64(Structure):
|
|
_fields_ = [
|
|
("Family", ULONG),
|
|
("Model", ULONG),
|
|
("Stepping", ULONG),
|
|
("VendorString", CHAR * 16),
|
|
]
|
|
DEBUG_PROCESSOR_IDENTIFICATION_AMD64 = _DEBUG_PROCESSOR_IDENTIFICATION_AMD64
|
|
PDEBUG_PROCESSOR_IDENTIFICATION_AMD64 = POINTER(_DEBUG_PROCESSOR_IDENTIFICATION_AMD64)
|
|
|
|
# Struct _DEBUG_PROCESSOR_IDENTIFICATION_IA64 definitions
|
|
class _DEBUG_PROCESSOR_IDENTIFICATION_IA64(Structure):
|
|
_fields_ = [
|
|
("Model", ULONG),
|
|
("Revision", ULONG),
|
|
("Family", ULONG),
|
|
("ArchRev", ULONG),
|
|
("VendorString", CHAR * 16),
|
|
]
|
|
PDEBUG_PROCESSOR_IDENTIFICATION_IA64 = POINTER(_DEBUG_PROCESSOR_IDENTIFICATION_IA64)
|
|
DEBUG_PROCESSOR_IDENTIFICATION_IA64 = _DEBUG_PROCESSOR_IDENTIFICATION_IA64
|
|
|
|
# Struct _DEBUG_PROCESSOR_IDENTIFICATION_X86 definitions
|
|
class _DEBUG_PROCESSOR_IDENTIFICATION_X86(Structure):
|
|
_fields_ = [
|
|
("Family", ULONG),
|
|
("Model", ULONG),
|
|
("Stepping", ULONG),
|
|
("VendorString", CHAR * 16),
|
|
]
|
|
DEBUG_PROCESSOR_IDENTIFICATION_X86 = _DEBUG_PROCESSOR_IDENTIFICATION_X86
|
|
PDEBUG_PROCESSOR_IDENTIFICATION_X86 = POINTER(_DEBUG_PROCESSOR_IDENTIFICATION_X86)
|
|
|
|
# Struct _DEBUG_PROCESSOR_IDENTIFICATION_ARM definitions
|
|
class _DEBUG_PROCESSOR_IDENTIFICATION_ARM(Structure):
|
|
_fields_ = [
|
|
("Type", ULONG),
|
|
("Revision", ULONG),
|
|
]
|
|
DEBUG_PROCESSOR_IDENTIFICATION_ARM = _DEBUG_PROCESSOR_IDENTIFICATION_ARM
|
|
PDEBUG_PROCESSOR_IDENTIFICATION_ARM = POINTER(_DEBUG_PROCESSOR_IDENTIFICATION_ARM)
|
|
|
|
# Struct _DEBUG_PROCESSOR_IDENTIFICATION_ALL definitions
|
|
class _DEBUG_PROCESSOR_IDENTIFICATION_ALL(Union):
|
|
_fields_ = [
|
|
("Alpha", DEBUG_PROCESSOR_IDENTIFICATION_ALPHA),
|
|
("Amd64", DEBUG_PROCESSOR_IDENTIFICATION_AMD64),
|
|
("Ia64", DEBUG_PROCESSOR_IDENTIFICATION_IA64),
|
|
("X86", DEBUG_PROCESSOR_IDENTIFICATION_X86),
|
|
("Arm", DEBUG_PROCESSOR_IDENTIFICATION_ARM),
|
|
]
|
|
PDEBUG_PROCESSOR_IDENTIFICATION_ALL = POINTER(_DEBUG_PROCESSOR_IDENTIFICATION_ALL)
|
|
DEBUG_PROCESSOR_IDENTIFICATION_ALL = _DEBUG_PROCESSOR_IDENTIFICATION_ALL
|
|
|
|
# Struct _SYMBOL_INFO definitions
|
|
class _SYMBOL_INFO(Structure):
|
|
_fields_ = [
|
|
("SizeOfStruct", ULONG),
|
|
("TypeIndex", ULONG),
|
|
("Reserved", ULONG64 * 2),
|
|
("Index", ULONG),
|
|
("Size", ULONG),
|
|
("ModBase", ULONG64),
|
|
("Flags", ULONG),
|
|
("Value", ULONG64),
|
|
("Address", ULONG64),
|
|
("Register", ULONG),
|
|
("Scope", ULONG),
|
|
("Tag", ULONG),
|
|
("NameLen", ULONG),
|
|
("MaxNameLen", ULONG),
|
|
("Name", CHAR * 1),
|
|
]
|
|
SYMBOL_INFO = _SYMBOL_INFO
|
|
PSYMBOL_INFO = POINTER(_SYMBOL_INFO)
|
|
|
|
# Struct _MODLOAD_DATA definitions
|
|
class _MODLOAD_DATA(Structure):
|
|
_fields_ = [
|
|
("ssize", DWORD),
|
|
("ssig", DWORD),
|
|
("data", PVOID),
|
|
("size", DWORD),
|
|
("flags", DWORD),
|
|
]
|
|
PMODLOAD_DATA = POINTER(_MODLOAD_DATA)
|
|
MODLOAD_DATA = _MODLOAD_DATA
|
|
|
|
# Struct _SYSTEM_MODULE32 definitions
|
|
class _SYSTEM_MODULE32(Structure):
|
|
_fields_ = [
|
|
("Reserved", ULONG * 2),
|
|
("Base", ULONG),
|
|
("Size", ULONG),
|
|
("Flags", ULONG),
|
|
("Index", USHORT),
|
|
("Unknown", USHORT),
|
|
("LoadCount", USHORT),
|
|
("ModuleNameOffset", USHORT),
|
|
("ImageName", CHAR * 256),
|
|
]
|
|
SYSTEM_MODULE32 = _SYSTEM_MODULE32
|
|
PSYSTEM_MODULE32 = POINTER(_SYSTEM_MODULE32)
|
|
|
|
# Struct _SYSTEM_MODULE64 definitions
|
|
class _SYSTEM_MODULE64(Structure):
|
|
_fields_ = [
|
|
("Reserved", ULONG * 4),
|
|
("Base", ULONG64),
|
|
("Size", ULONG),
|
|
("Flags", ULONG),
|
|
("Index", USHORT),
|
|
("Unknown", USHORT),
|
|
("LoadCount", USHORT),
|
|
("ModuleNameOffset", USHORT),
|
|
("ImageName", CHAR * 256),
|
|
]
|
|
SYSTEM_MODULE64 = _SYSTEM_MODULE64
|
|
PSYSTEM_MODULE64 = POINTER(_SYSTEM_MODULE64)
|
|
|