admin/hakril-PythonForWindows
1
0
Fork 0
mirror of https://github.com/hakril/PythonForWindows synced 2026-06-08 14:31:45 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
ef580c675f2d88676319c49b5cf60e46354037bb
hakril-PythonForWindows/docs/build/html/process.html
T
hakril 578b4d9193 Update generated def + documentation
2020-03-29 22:14:29 +02:00

1852 lines
123 KiB
HTML
Raw Blame History

This file contains ambiguous Unicode characters
This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="X-UA-Compatible" content="IE=Edge" />
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>2.1. Processes and Threads &#8212; PythonForWindows 0.5 documentation</title>
<link rel="stylesheet" href="_static/classic.css" type="text/css" />
<link rel="stylesheet" href="_static/pygments.css" type="text/css" />
<link rel="stylesheet" href="_static/css/mbasic.css" type="text/css" />
<script type="text/javascript" id="documentation_options" data-url_root="./" src="_static/documentation_options.js"></script>
<script type="text/javascript" src="_static/jquery.js"></script>
<script type="text/javascript" src="_static/underscore.js"></script>
<script type="text/javascript" src="_static/doctools.js"></script>
<link rel="index" title="Index" href="genindex.html" />
<link rel="search" title="Search" href="search.html" />
<link rel="next" title="2.4. Token" href="token.html" />
<link rel="prev" title="2. The windows objects" href="winobject.html" />
</head><body>
<div class="related" role="navigation" aria-label="related navigation">
<h3>Navigation</h3>
<ul>
<li class="right" style="margin-right: 10px">
<a href="genindex.html" title="General Index"
accesskey="I">index</a></li>
<li class="right" >
<a href="py-modindex.html" title="Python Module Index"
>modules</a> |</li>
<li class="right" >
<a href="token.html" title="2.4. Token"
accesskey="N">next</a> |</li>
<li class="right" >
<a href="winobject.html" title="2. The windows objects"
accesskey="P">previous</a> |</li>
<li class="nav-item nav-item-0"><a href="index.html">PythonForWindows 0.5 documentation</a> &#187;</li>
<li class="nav-item nav-item-1"><a href="winobject.html" accesskey="U">2. The <code class="docutils literal notranslate"><span class="pre">windows</span></code> objects</a> &#187;</li>
</ul>
</div>
<div class="document">
<div class="documentwrapper">
<div class="bodywrapper">
<div class="body" role="main">
<div class="section" id="module-windows.winobject.process">
<span id="processes-and-threads"></span><h1>2.1. Processes and Threads<a class="headerlink" href="#module-windows.winobject.process" title="Permalink to this headline"></a></h1>
<div class="section" id="currentprocess">
<h2>2.1.1. CurrentProcess<a class="headerlink" href="#currentprocess" title="Permalink to this headline"></a></h2>
<div class="admonition note">
<p class="first admonition-title">Note</p>
<p class="last">See sample <a class="reference internal" href="sample.html#sample-current-process"><span class="std std-ref">windows.current_process</span></a></p>
</div>
<dl class="class">
<dt id="windows.winobject.process.CurrentProcess">
<em class="property">class </em><code class="descclassname">windows.winobject.process.</code><code class="descname">CurrentProcess</code><a class="reference internal" href="_modules/windows/winobject/process.html#CurrentProcess"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.winobject.process.CurrentProcess" title="Permalink to this definition"></a></dt>
<dd><p>Bases: <code class="xref py py-class docutils literal notranslate"><span class="pre">windows.winobject.process.Process</span></code></p>
<p>The current process</p>
<dl class="method">
<dt id="windows.winobject.process.CurrentProcess.allocated_memory">
<code class="descname">allocated_memory</code><span class="sig-paren">(</span><em>**kwds</em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.CurrentProcess.allocated_memory" title="Permalink to this definition"></a></dt>
<dd><p>ContextManager to allocate memory and free it</p>
<table class="docutils field-list" frame="void" rules="none">
<col class="field-name" />
<col class="field-body" />
<tbody valign="top">
<tr class="field-odd field"><th class="field-name">Type:</th><td class="field-body"><a class="reference external" href="https://docs.python.org/2.7/library/functions.html#int" title="(in Python v2.7)"><code class="xref py py-class docutils literal notranslate"><span class="pre">int</span></code></a> – the address of the allocated memory</td>
</tr>
</tbody>
</table>
</dd></dl>
<dl class="attribute">
<dt id="windows.winobject.process.CurrentProcess.bitness">
<code class="descname">bitness</code><a class="headerlink" href="#windows.winobject.process.CurrentProcess.bitness" title="Permalink to this definition"></a></dt>
<dd><p>The bitness of the process</p>
<table class="docutils field-list" frame="void" rules="none">
<col class="field-name" />
<col class="field-body" />
<tbody valign="top">
<tr class="field-odd field"><th class="field-name">Type:</th><td class="field-body"><a class="reference external" href="https://docs.python.org/2.7/library/functions.html#int" title="(in Python v2.7)"><code class="xref py py-class docutils literal notranslate"><span class="pre">int</span></code></a> – 32 or 64</td>
</tr>
</tbody>
</table>
</dd></dl>
<dl class="method">
<dt id="windows.winobject.process.CurrentProcess.create_thread">
<code class="descname">create_thread</code><span class="sig-paren">(</span><em>lpStartAddress</em>, <em>lpParameter</em>, <em>dwCreationFlags=0</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/process.html#CurrentProcess.create_thread"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.winobject.process.CurrentProcess.create_thread" title="Permalink to this definition"></a></dt>
<dd><p>Create a new thread</p>
<table class="docutils field-list" frame="void" rules="none">
<col class="field-name" />
<col class="field-body" />
<tbody valign="top">
<tr class="field-odd field"><th class="field-name">Return type:</th><td class="field-body"><a class="reference internal" href="#windows.winobject.process.WinThread" title="windows.winobject.process.WinThread"><code class="xref py py-class docutils literal notranslate"><span class="pre">WinThread</span></code></a> or <a class="reference internal" href="#windows.winobject.process.DeadThread" title="windows.winobject.process.DeadThread"><code class="xref py py-class docutils literal notranslate"><span class="pre">DeadThread</span></code></a></td>
</tr>
</tbody>
</table>
</dd></dl>
<dl class="method">
<dt id="windows.winobject.process.CurrentProcess.execute">
<code class="descname">execute</code><span class="sig-paren">(</span><em>code</em>, <em>parameter=0</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/process.html#CurrentProcess.execute"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.winobject.process.CurrentProcess.execute" title="Permalink to this definition"></a></dt>
<dd><p>Execute native code <code class="docutils literal notranslate"><span class="pre">code</span></code> in the current thread.</p>
<table class="docutils field-list" frame="void" rules="none">
<col class="field-name" />
<col class="field-body" />
<tbody valign="top">
<tr class="field-odd field"><th class="field-name">Return type:</th><td class="field-body"><a class="reference external" href="https://docs.python.org/2.7/library/functions.html#int" title="(in Python v2.7)"><code class="xref py py-class docutils literal notranslate"><span class="pre">int</span></code></a> the return value of the native code</td>
</tr>
</tbody>
</table>
</dd></dl>
<dl class="method">
<dt id="windows.winobject.process.CurrentProcess.exit">
<code class="descname">exit</code><span class="sig-paren">(</span><em>code=0</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/process.html#CurrentProcess.exit"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.winobject.process.CurrentProcess.exit" title="Permalink to this definition"></a></dt>
<dd><p>Exit the process</p>
</dd></dl>
<dl class="attribute">
<dt id="windows.winobject.process.CurrentProcess.exit_code">
<code class="descname">exit_code</code><a class="headerlink" href="#windows.winobject.process.CurrentProcess.exit_code" title="Permalink to this definition"></a></dt>
<dd><p>The exit code of the process : <code class="docutils literal notranslate"><span class="pre">STILL_ACTIVE</span></code> means the process is not dead</p>
<table class="docutils field-list" frame="void" rules="none">
<col class="field-name" />
<col class="field-body" />
<tbody valign="top">
<tr class="field-odd field"><th class="field-name">Type:</th><td class="field-body"><a class="reference external" href="https://docs.python.org/2.7/library/functions.html#int" title="(in Python v2.7)"><code class="xref py py-class docutils literal notranslate"><span class="pre">int</span></code></a></td>
</tr>
</tbody>
</table>
</dd></dl>
<dl class="method">
<dt id="windows.winobject.process.CurrentProcess.get_mapped_filename">
<code class="descname">get_mapped_filename</code><span class="sig-paren">(</span><em>addr</em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.CurrentProcess.get_mapped_filename" title="Permalink to this definition"></a></dt>
<dd><p>The filename mapped at address <code class="docutils literal notranslate"><span class="pre">addr</span></code> or <code class="docutils literal notranslate"><span class="pre">None</span></code></p>
<table class="docutils field-list" frame="void" rules="none">
<col class="field-name" />
<col class="field-body" />
<tbody valign="top">
<tr class="field-odd field"><th class="field-name">Return type:</th><td class="field-body"><code class="xref py py-class docutils literal notranslate"><span class="pre">unicode</span></code> or <code class="docutils literal notranslate"><span class="pre">None</span></code></td>
</tr>
</tbody>
</table>
</dd></dl>
<dl class="attribute">
<dt id="windows.winobject.process.CurrentProcess.handle">
<code class="descname">handle</code><a class="headerlink" href="#windows.winobject.process.CurrentProcess.handle" title="Permalink to this definition"></a></dt>
<dd><p>An handle on the object</p>
<table class="docutils field-list" frame="void" rules="none">
<col class="field-name" />
<col class="field-body" />
<tbody valign="top">
<tr class="field-odd field"><th class="field-name">Type:</th><td class="field-body"><p class="first">HANDLE</p>
<div class="last admonition note">
<p class="first admonition-title">Note</p>
<p class="last">The handle is automaticaly closed when the object is destroyed</p>
</div>
</td>
</tr>
</tbody>
</table>
</dd></dl>
<dl class="attribute">
<dt id="windows.winobject.process.CurrentProcess.is_exit">
<code class="descname">is_exit</code><a class="headerlink" href="#windows.winobject.process.CurrentProcess.is_exit" title="Permalink to this definition"></a></dt>
<dd><p><code class="docutils literal notranslate"><span class="pre">True</span></code> if the process is terminated</p>
<table class="docutils field-list" frame="void" rules="none">
<col class="field-name" />
<col class="field-body" />
<tbody valign="top">
<tr class="field-odd field"><th class="field-name">Type:</th><td class="field-body"><a class="reference external" href="https://docs.python.org/2.7/library/functions.html#bool" title="(in Python v2.7)"><code class="xref py py-class docutils literal notranslate"><span class="pre">bool</span></code></a></td>
</tr>
</tbody>
</table>
</dd></dl>
<dl class="attribute">
<dt id="windows.winobject.process.CurrentProcess.is_wow_64">
<code class="descname">is_wow_64</code><a class="headerlink" href="#windows.winobject.process.CurrentProcess.is_wow_64" title="Permalink to this definition"></a></dt>
<dd><p><code class="docutils literal notranslate"><span class="pre">True</span></code> if the process is a SysWow64 process (32bit process on 64bits system).</p>
<table class="docutils field-list" frame="void" rules="none">
<col class="field-name" />
<col class="field-body" />
<tbody valign="top">
<tr class="field-odd field"><th class="field-name">Type:</th><td class="field-body"><a class="reference external" href="https://docs.python.org/2.7/library/functions.html#bool" title="(in Python v2.7)"><code class="xref py py-class docutils literal notranslate"><span class="pre">bool</span></code></a></td>
</tr>
</tbody>
</table>
</dd></dl>
<dl class="method">
<dt id="windows.winobject.process.CurrentProcess.load_library">
<code class="descname">load_library</code><span class="sig-paren">(</span><em>dll_path</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/process.html#CurrentProcess.load_library"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.winobject.process.CurrentProcess.load_library" title="Permalink to this definition"></a></dt>
<dd><p>Load the library in current process</p>
<table class="docutils field-list" frame="void" rules="none">
<col class="field-name" />
<col class="field-body" />
<tbody valign="top">
<tr class="field-odd field"><th class="field-name">Return type:</th><td class="field-body"><a class="reference internal" href="#windows.winobject.process.LoadedModule" title="windows.winobject.process.LoadedModule"><code class="xref py py-class docutils literal notranslate"><span class="pre">LoadedModule</span></code></a></td>
</tr>
</tbody>
</table>
</dd></dl>
<dl class="method">
<dt id="windows.winobject.process.CurrentProcess.memory_state">
<code class="descname">memory_state</code><span class="sig-paren">(</span><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.CurrentProcess.memory_state" title="Permalink to this definition"></a></dt>
<dd><p>Yield the memory information for the whole address space of the process</p>
<table class="docutils field-list" frame="void" rules="none">
<col class="field-name" />
<col class="field-body" />
<tbody valign="top">
<tr class="field-odd field"><th class="field-name">Yield:</th><td class="field-body"><a class="reference internal" href="winstructs_generated.html#windows.generated_def.winstructs.MEMORY_BASIC_INFORMATION" title="windows.generated_def.winstructs.MEMORY_BASIC_INFORMATION"><code class="xref py py-class docutils literal notranslate"><span class="pre">MEMORY_BASIC_INFORMATION</span></code></a></td>
</tr>
</tbody>
</table>
</dd></dl>
<dl class="method">
<dt id="windows.winobject.process.CurrentProcess.open_token">
<code class="descname">open_token</code><span class="sig-paren">(</span><em>flags=MAXIMUM_ALLOWED(0x2000000)</em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.CurrentProcess.open_token" title="Permalink to this definition"></a></dt>
<dd><p>Open the process Token</p>
<table class="docutils field-list" frame="void" rules="none">
<col class="field-name" />
<col class="field-body" />
<tbody valign="top">
<tr class="field-odd field"><th class="field-name">Returns:</th><td class="field-body"><a class="reference internal" href="token.html#windows.winobject.token.Token" title="windows.winobject.token.Token"><code class="xref py py-class docutils literal notranslate"><span class="pre">Token</span></code></a></td>
</tr>
</tbody>
</table>
</dd></dl>
<dl class="attribute">
<dt id="windows.winobject.process.CurrentProcess.peb">
<code class="descname">peb</code><a class="headerlink" href="#windows.winobject.process.CurrentProcess.peb" title="Permalink to this definition"></a></dt>
<dd><p>The Process Environment Block of the current process</p>
<table class="docutils field-list" frame="void" rules="none">
<col class="field-name" />
<col class="field-body" />
<tbody valign="top">
<tr class="field-odd field"><th class="field-name">Type:</th><td class="field-body"><a class="reference internal" href="#windows.winobject.process.PEB" title="windows.winobject.process.PEB"><code class="xref py py-class docutils literal notranslate"><span class="pre">PEB</span></code></a></td>
</tr>
</tbody>
</table>
</dd></dl>
<dl class="attribute">
<dt id="windows.winobject.process.CurrentProcess.peb_syswow">
<code class="descname">peb_syswow</code><a class="headerlink" href="#windows.winobject.process.CurrentProcess.peb_syswow" title="Permalink to this definition"></a></dt>
<dd><p>The 64bits PEB of a SysWow64 process</p>
<table class="docutils field-list" frame="void" rules="none">
<col class="field-name" />
<col class="field-body" />
<tbody valign="top">
<tr class="field-odd field"><th class="field-name">Type:</th><td class="field-body"><a class="reference internal" href="#windows.winobject.process.PEB" title="windows.winobject.process.PEB"><code class="xref py py-class docutils literal notranslate"><span class="pre">PEB</span></code></a></td>
</tr>
</tbody>
</table>
</dd></dl>
<dl class="attribute">
<dt id="windows.winobject.process.CurrentProcess.pid">
<code class="descname">pid</code><a class="headerlink" href="#windows.winobject.process.CurrentProcess.pid" title="Permalink to this definition"></a></dt>
<dd><p>Process ID</p>
<table class="docutils field-list" frame="void" rules="none">
<col class="field-name" />
<col class="field-body" />
<tbody valign="top">
<tr class="field-odd field"><th class="field-name">Type:</th><td class="field-body"><a class="reference external" href="https://docs.python.org/2.7/library/functions.html#int" title="(in Python v2.7)"><code class="xref py py-class docutils literal notranslate"><span class="pre">int</span></code></a></td>
</tr>
</tbody>
</table>
</dd></dl>
<dl class="attribute">
<dt id="windows.winobject.process.CurrentProcess.ppid">
<code class="descname">ppid</code><a class="headerlink" href="#windows.winobject.process.CurrentProcess.ppid" title="Permalink to this definition"></a></dt>
<dd><p>Parent Process ID</p>
<table class="docutils field-list" frame="void" rules="none">
<col class="field-name" />
<col class="field-body" />
<tbody valign="top">
<tr class="field-odd field"><th class="field-name">Type:</th><td class="field-body"><a class="reference external" href="https://docs.python.org/2.7/library/functions.html#int" title="(in Python v2.7)"><code class="xref py py-class docutils literal notranslate"><span class="pre">int</span></code></a></td>
</tr>
</tbody>
</table>
</dd></dl>
<dl class="method">
<dt id="windows.winobject.process.CurrentProcess.query_memory">
<code class="descname">query_memory</code><span class="sig-paren">(</span><em>addr</em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.CurrentProcess.query_memory" title="Permalink to this definition"></a></dt>
<dd><p>Query the memory informations about page at <code class="docutils literal notranslate"><span class="pre">addr</span></code></p>
<table class="docutils field-list" frame="void" rules="none">
<col class="field-name" />
<col class="field-body" />
<tbody valign="top">
<tr class="field-odd field"><th class="field-name">Return type:</th><td class="field-body"><a class="reference internal" href="winstructs_generated.html#windows.generated_def.winstructs.MEMORY_BASIC_INFORMATION" title="windows.generated_def.winstructs.MEMORY_BASIC_INFORMATION"><code class="xref py py-class docutils literal notranslate"><span class="pre">MEMORY_BASIC_INFORMATION</span></code></a></td>
</tr>
</tbody>
</table>
</dd></dl>
<dl class="method">
<dt id="windows.winobject.process.CurrentProcess.read_byte">
<code class="descname">read_byte</code><span class="sig-paren">(</span><em>addr</em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.CurrentProcess.read_byte" title="Permalink to this definition"></a></dt>
<dd><p>Read a <code class="docutils literal notranslate"><span class="pre">CHAR</span></code> at <code class="docutils literal notranslate"><span class="pre">addr</span></code></p>
</dd></dl>
<dl class="method">
<dt id="windows.winobject.process.CurrentProcess.read_dword">
<code class="descname">read_dword</code><span class="sig-paren">(</span><em>addr</em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.CurrentProcess.read_dword" title="Permalink to this definition"></a></dt>
<dd><p>Read a <code class="docutils literal notranslate"><span class="pre">DWORD</span></code> at <code class="docutils literal notranslate"><span class="pre">addr</span></code></p>
</dd></dl>
<dl class="method">
<dt id="windows.winobject.process.CurrentProcess.read_memory">
<code class="descname">read_memory</code><span class="sig-paren">(</span><em>addr</em>, <em>size</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/process.html#CurrentProcess.read_memory"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.winobject.process.CurrentProcess.read_memory" title="Permalink to this definition"></a></dt>
<dd><p>Read <code class="docutils literal notranslate"><span class="pre">size</span></code> from <code class="docutils literal notranslate"><span class="pre">addr</span></code></p>
<table class="docutils field-list" frame="void" rules="none">
<col class="field-name" />
<col class="field-body" />
<tbody valign="top">
<tr class="field-odd field"><th class="field-name">Returns:</th><td class="field-body">The data read</td>
</tr>
<tr class="field-even field"><th class="field-name">Return type:</th><td class="field-body"><a class="reference external" href="https://docs.python.org/2.7/library/functions.html#str" title="(in Python v2.7)"><code class="xref py py-class docutils literal notranslate"><span class="pre">str</span></code></a></td>
</tr>
</tbody>
</table>
</dd></dl>
<dl class="method">
<dt id="windows.winobject.process.CurrentProcess.read_ptr">
<code class="descname">read_ptr</code><span class="sig-paren">(</span><em>addr</em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.CurrentProcess.read_ptr" title="Permalink to this definition"></a></dt>
<dd><p>Read a <code class="docutils literal notranslate"><span class="pre">PTR</span></code> at <code class="docutils literal notranslate"><span class="pre">addr</span></code></p>
</dd></dl>
<dl class="method">
<dt id="windows.winobject.process.CurrentProcess.read_qword">
<code class="descname">read_qword</code><span class="sig-paren">(</span><em>addr</em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.CurrentProcess.read_qword" title="Permalink to this definition"></a></dt>
<dd><p>Read a <code class="docutils literal notranslate"><span class="pre">ULONG64</span></code> at <code class="docutils literal notranslate"><span class="pre">addr</span></code></p>
</dd></dl>
<dl class="method">
<dt id="windows.winobject.process.CurrentProcess.read_short">
<code class="descname">read_short</code><span class="sig-paren">(</span><em>addr</em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.CurrentProcess.read_short" title="Permalink to this definition"></a></dt>
<dd><p>Read a <code class="docutils literal notranslate"><span class="pre">SHORT</span></code> at <code class="docutils literal notranslate"><span class="pre">addr</span></code></p>
</dd></dl>
<dl class="method">
<dt id="windows.winobject.process.CurrentProcess.read_string">
<code class="descname">read_string</code><span class="sig-paren">(</span><em>addr</em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.CurrentProcess.read_string" title="Permalink to this definition"></a></dt>
<dd><p>Read an ascii string at <code class="docutils literal notranslate"><span class="pre">addr</span></code></p>
</dd></dl>
<dl class="method">
<dt id="windows.winobject.process.CurrentProcess.read_wstring">
<code class="descname">read_wstring</code><span class="sig-paren">(</span><em>addr</em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.CurrentProcess.read_wstring" title="Permalink to this definition"></a></dt>
<dd><p>Read a windows UTF16 string at <code class="docutils literal notranslate"><span class="pre">addr</span></code></p>
</dd></dl>
<dl class="attribute">
<dt id="windows.winobject.process.CurrentProcess.threads">
<code class="descname">threads</code><a class="headerlink" href="#windows.winobject.process.CurrentProcess.threads" title="Permalink to this definition"></a></dt>
<dd><p>The threads of the process</p>
<table class="docutils field-list" frame="void" rules="none">
<col class="field-name" />
<col class="field-body" />
<tbody valign="top">
<tr class="field-odd field"><th class="field-name">Type:</th><td class="field-body">[<a class="reference internal" href="#windows.winobject.process.WinThread" title="windows.winobject.process.WinThread"><code class="xref py py-class docutils literal notranslate"><span class="pre">WinThread</span></code></a>] – A list of Thread</td>
</tr>
</tbody>
</table>
</dd></dl>
<dl class="attribute">
<dt id="windows.winobject.process.CurrentProcess.time_info">
<code class="descname">time_info</code><a class="headerlink" href="#windows.winobject.process.CurrentProcess.time_info" title="Permalink to this definition"></a></dt>
<dd><p>The time information of the process (creation, kernel/user time, exit time)</p>
<table class="docutils field-list" frame="void" rules="none">
<col class="field-name" />
<col class="field-body" />
<tbody valign="top">
<tr class="field-odd field"><th class="field-name">Type:</th><td class="field-body"><code class="xref py py-class docutils literal notranslate"><span class="pre">TimeInfo</span></code></td>
</tr>
</tbody>
</table>
</dd></dl>
<dl class="attribute">
<dt id="windows.winobject.process.CurrentProcess.token">
<code class="descname">token</code><a class="headerlink" href="#windows.winobject.process.CurrentProcess.token" title="Permalink to this definition"></a></dt>
<dd><p>The process <a class="reference internal" href="token.html#windows.winobject.token.Token" title="windows.winobject.token.Token"><code class="xref py py-class docutils literal notranslate"><span class="pre">Token</span></code></a></p>
</dd></dl>
<dl class="method">
<dt id="windows.winobject.process.CurrentProcess.virtual_alloc">
<code class="descname">virtual_alloc</code><span class="sig-paren">(</span><em>size</em>, <em>prot=PAGE_EXECUTE_READWRITE(0x40)</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/process.html#CurrentProcess.virtual_alloc"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.winobject.process.CurrentProcess.virtual_alloc" title="Permalink to this definition"></a></dt>
<dd><p>Allocate memory in the process</p>
<table class="docutils field-list" frame="void" rules="none">
<col class="field-name" />
<col class="field-body" />
<tbody valign="top">
<tr class="field-odd field"><th class="field-name">Returns:</th><td class="field-body">The address of the allocated memory</td>
</tr>
<tr class="field-even field"><th class="field-name">Return type:</th><td class="field-body"><a class="reference external" href="https://docs.python.org/2.7/library/functions.html#int" title="(in Python v2.7)"><code class="xref py py-class docutils literal notranslate"><span class="pre">int</span></code></a></td>
</tr>
</tbody>
</table>
</dd></dl>
<dl class="method">
<dt id="windows.winobject.process.CurrentProcess.virtual_free">
<code class="descname">virtual_free</code><span class="sig-paren">(</span><em>addr</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/process.html#CurrentProcess.virtual_free"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.winobject.process.CurrentProcess.virtual_free" title="Permalink to this definition"></a></dt>
<dd><p>Free memory in the process by virtual_alloc</p>
</dd></dl>
<dl class="method">
<dt id="windows.winobject.process.CurrentProcess.virtual_protect">
<code class="descname">virtual_protect</code><span class="sig-paren">(</span><em>addr</em>, <em>size</em>, <em>protect</em>, <em>old_protect=None</em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.CurrentProcess.virtual_protect" title="Permalink to this definition"></a></dt>
<dd><p>Change the access right of one or more page of the process</p>
</dd></dl>
<dl class="method">
<dt id="windows.winobject.process.CurrentProcess.virtual_protected">
<code class="descname">virtual_protected</code><span class="sig-paren">(</span><em>**kwds</em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.CurrentProcess.virtual_protected" title="Permalink to this definition"></a></dt>
<dd><p>A context manager for local virtual_protect (old Protection are restored at exit)</p>
</dd></dl>
<dl class="method">
<dt id="windows.winobject.process.CurrentProcess.wait">
<code class="descname">wait</code><span class="sig-paren">(</span><em>timeout=INFINITE(0xffffffff)</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/process.html#CurrentProcess.wait"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.winobject.process.CurrentProcess.wait" title="Permalink to this definition"></a></dt>
<dd><p>Raise <code class="xref py py-class docutils literal notranslate"><span class="pre">ValueError</span></code> to prevent deadlock :D</p>
</dd></dl>
<dl class="method">
<dt id="windows.winobject.process.CurrentProcess.write_byte">
<code class="descname">write_byte</code><span class="sig-paren">(</span><em>addr</em>, <em>byte</em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.CurrentProcess.write_byte" title="Permalink to this definition"></a></dt>
<dd><p>write a byte at <code class="docutils literal notranslate"><span class="pre">addr</span></code></p>
</dd></dl>
<dl class="method">
<dt id="windows.winobject.process.CurrentProcess.write_dword">
<code class="descname">write_dword</code><span class="sig-paren">(</span><em>addr</em>, <em>dword</em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.CurrentProcess.write_dword" title="Permalink to this definition"></a></dt>
<dd><p>write a dword at <code class="docutils literal notranslate"><span class="pre">addr</span></code></p>
</dd></dl>
<dl class="method">
<dt id="windows.winobject.process.CurrentProcess.write_memory">
<code class="descname">write_memory</code><span class="sig-paren">(</span><em>addr</em>, <em>data</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/process.html#CurrentProcess.write_memory"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.winobject.process.CurrentProcess.write_memory" title="Permalink to this definition"></a></dt>
<dd><p>Write data at addr</p>
</dd></dl>
<dl class="method">
<dt id="windows.winobject.process.CurrentProcess.write_ptr">
<code class="descname">write_ptr</code><span class="sig-paren">(</span><em>addr</em>, <em>value</em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.CurrentProcess.write_ptr" title="Permalink to this definition"></a></dt>
<dd><p>Write a <code class="docutils literal notranslate"><span class="pre">PTR</span></code> at <code class="docutils literal notranslate"><span class="pre">addr</span></code></p>
</dd></dl>
<dl class="method">
<dt id="windows.winobject.process.CurrentProcess.write_qword">
<code class="descname">write_qword</code><span class="sig-paren">(</span><em>addr</em>, <em>qword</em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.CurrentProcess.write_qword" title="Permalink to this definition"></a></dt>
<dd><p>write a qword at <code class="docutils literal notranslate"><span class="pre">addr</span></code></p>
</dd></dl>
<dl class="method">
<dt id="windows.winobject.process.CurrentProcess.write_short">
<code class="descname">write_short</code><span class="sig-paren">(</span><em>addr</em>, <em>word</em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.CurrentProcess.write_short" title="Permalink to this definition"></a></dt>
<dd><p>write a word at <code class="docutils literal notranslate"><span class="pre">addr</span></code></p>
</dd></dl>
</dd></dl>
</div>
<div class="section" id="currentthread">
<h2>2.1.2. CurrentThread<a class="headerlink" href="#currentthread" title="Permalink to this headline"></a></h2>
<dl class="class">
<dt id="windows.winobject.process.CurrentThread">
<em class="property">class </em><code class="descclassname">windows.winobject.process.</code><code class="descname">CurrentThread</code><a class="reference internal" href="_modules/windows/winobject/process.html#CurrentThread"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.winobject.process.CurrentThread" title="Permalink to this definition"></a></dt>
<dd><p>Bases: <code class="xref py py-class docutils literal notranslate"><span class="pre">windows.winobject.process.Thread</span></code></p>
<p>The current thread</p>
<dl class="method">
<dt id="windows.winobject.process.CurrentThread.exit">
<code class="descname">exit</code><span class="sig-paren">(</span><em>code=0</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/process.html#CurrentThread.exit"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.winobject.process.CurrentThread.exit" title="Permalink to this definition"></a></dt>
<dd><p>Exit the thread</p>
</dd></dl>
<dl class="attribute">
<dt id="windows.winobject.process.CurrentThread.handle">
<code class="descname">handle</code><a class="headerlink" href="#windows.winobject.process.CurrentThread.handle" title="Permalink to this definition"></a></dt>
<dd><p>An handle on the object</p>
<table class="docutils field-list" frame="void" rules="none">
<col class="field-name" />
<col class="field-body" />
<tbody valign="top">
<tr class="field-odd field"><th class="field-name">Type:</th><td class="field-body"><p class="first">HANDLE</p>
<div class="last admonition note">
<p class="first admonition-title">Note</p>
<p class="last">The handle is automaticaly closed when the object is destroyed</p>
</div>
</td>
</tr>
</tbody>
</table>
</dd></dl>
<dl class="method">
<dt id="windows.winobject.process.CurrentThread.open_token">
<code class="descname">open_token</code><span class="sig-paren">(</span><em>flags=MAXIMUM_ALLOWED(0x2000000)</em>, <em>as_self=False</em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.CurrentThread.open_token" title="Permalink to this definition"></a></dt>
<dd><p>Open the Thread token if any (Impersonation) else return None.
<code class="docutils literal notranslate"><span class="pre">as_self</span></code> tells which security context should be used</p>
<table class="docutils field-list" frame="void" rules="none">
<col class="field-name" />
<col class="field-body" />
<tbody valign="top">
<tr class="field-odd field"><th class="field-name">Returns:</th><td class="field-body"><a class="reference internal" href="token.html#windows.winobject.token.Token" title="windows.winobject.token.Token"><code class="xref py py-class docutils literal notranslate"><span class="pre">Token</span></code></a></td>
</tr>
</tbody>
</table>
<div class="admonition note">
<p class="first admonition-title">Note</p>
<p class="last">see <a class="reference external" href="https://docs.microsoft.com/en-us/windows/desktop/api/processthreadsapi/nf-processthreadsapi-openthreadtoken">https://docs.microsoft.com/en-us/windows/desktop/api/processthreadsapi/nf-processthreadsapi-openthreadtoken</a></p>
</div>
</dd></dl>
<dl class="attribute">
<dt id="windows.winobject.process.CurrentThread.owner">
<code class="descname">owner</code><a class="headerlink" href="#windows.winobject.process.CurrentThread.owner" title="Permalink to this definition"></a></dt>
<dd><p>The current process</p>
<table class="docutils field-list" frame="void" rules="none">
<col class="field-name" />
<col class="field-body" />
<tbody valign="top">
<tr class="field-odd field"><th class="field-name">Type:</th><td class="field-body"><a class="reference internal" href="#windows.winobject.process.CurrentProcess" title="windows.winobject.process.CurrentProcess"><code class="xref py py-class docutils literal notranslate"><span class="pre">CurrentProcess</span></code></a></td>
</tr>
</tbody>
</table>
</dd></dl>
<dl class="method">
<dt id="windows.winobject.process.CurrentThread.set_token">
<code class="descname">set_token</code><span class="sig-paren">(</span><em>token</em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.CurrentThread.set_token" title="Permalink to this definition"></a></dt>
<dd><p>Set the token for the thread (impersonation). Setting the token to None revert the impersonation</p>
</dd></dl>
<dl class="attribute">
<dt id="windows.winobject.process.CurrentThread.tid">
<code class="descname">tid</code><a class="headerlink" href="#windows.winobject.process.CurrentThread.tid" title="Permalink to this definition"></a></dt>
<dd><p>Thread ID</p>
<table class="docutils field-list" frame="void" rules="none">
<col class="field-name" />
<col class="field-body" />
<tbody valign="top">
<tr class="field-odd field"><th class="field-name">Type:</th><td class="field-body"><a class="reference external" href="https://docs.python.org/2.7/library/functions.html#int" title="(in Python v2.7)"><code class="xref py py-class docutils literal notranslate"><span class="pre">int</span></code></a></td>
</tr>
</tbody>
</table>
</dd></dl>
<dl class="attribute">
<dt id="windows.winobject.process.CurrentThread.token">
<code class="descname">token</code><a class="headerlink" href="#windows.winobject.process.CurrentThread.token" title="Permalink to this definition"></a></dt>
<dd><p>The thread <a class="reference internal" href="token.html#windows.winobject.token.Token" title="windows.winobject.token.Token"><code class="xref py py-class docutils literal notranslate"><span class="pre">Token</span></code></a></p>
<table class="docutils field-list" frame="void" rules="none">
<col class="field-name" />
<col class="field-body" />
<tbody valign="top">
<tr class="field-odd field"><th class="field-name">Getter:</th><td class="field-body"><a class="reference internal" href="#windows.winobject.process.CurrentThread.open_token" title="windows.winobject.process.CurrentThread.open_token"><code class="xref py py-func docutils literal notranslate"><span class="pre">open_token()</span></code></a></td>
</tr>
<tr class="field-even field"><th class="field-name">Setter:</th><td class="field-body"><a class="reference internal" href="#windows.winobject.process.CurrentThread.set_token" title="windows.winobject.process.CurrentThread.set_token"><code class="xref py py-func docutils literal notranslate"><span class="pre">set_token()</span></code></a></td>
</tr>
</tbody>
</table>
</dd></dl>
<dl class="method">
<dt id="windows.winobject.process.CurrentThread.wait">
<code class="descname">wait</code><span class="sig-paren">(</span><em>timeout=INFINITE(0xffffffff)</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/process.html#CurrentThread.wait"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.winobject.process.CurrentThread.wait" title="Permalink to this definition"></a></dt>
<dd><p>Raise <code class="xref py py-class docutils literal notranslate"><span class="pre">ValueError</span></code> to prevent deadlock :D</p>
</dd></dl>
</dd></dl>
</div>
<div class="section" id="winprocess">
<h2>2.1.3. WinProcess<a class="headerlink" href="#winprocess" title="Permalink to this headline"></a></h2>
<div class="admonition note">
<p class="first admonition-title">Note</p>
<p class="last">See sample <a class="reference internal" href="sample.html#sample-remote-process"><span class="std std-ref">Remote process : WinProcess</span></a></p>
</div>
<dl class="class">
<dt id="windows.winobject.process.WinProcess">
<em class="property">class </em><code class="descclassname">windows.winobject.process.</code><code class="descname">WinProcess</code><span class="sig-paren">(</span><em>pid=None</em>, <em>handle=None</em>, <em>name=None</em>, <em>ppid=None</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/process.html#WinProcess"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.winobject.process.WinProcess" title="Permalink to this definition"></a></dt>
<dd><p>Bases: <code class="xref py py-class docutils literal notranslate"><span class="pre">windows.winobject.process.Process</span></code></p>
<p>A Process on the system</p>
<dl class="method">
<dt id="windows.winobject.process.WinProcess.allocated_memory">
<code class="descname">allocated_memory</code><span class="sig-paren">(</span><em>**kwds</em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.WinProcess.allocated_memory" title="Permalink to this definition"></a></dt>
<dd><p>ContextManager to allocate memory and free it</p>
<table class="docutils field-list" frame="void" rules="none">
<col class="field-name" />
<col class="field-body" />
<tbody valign="top">
<tr class="field-odd field"><th class="field-name">Type:</th><td class="field-body"><a class="reference external" href="https://docs.python.org/2.7/library/functions.html#int" title="(in Python v2.7)"><code class="xref py py-class docutils literal notranslate"><span class="pre">int</span></code></a> – the address of the allocated memory</td>
</tr>
</tbody>
</table>
</dd></dl>
<dl class="attribute">
<dt id="windows.winobject.process.WinProcess.bitness">
<code class="descname">bitness</code><a class="headerlink" href="#windows.winobject.process.WinProcess.bitness" title="Permalink to this definition"></a></dt>
<dd><p>The bitness of the process</p>
<table class="docutils field-list" frame="void" rules="none">
<col class="field-name" />
<col class="field-body" />
<tbody valign="top">
<tr class="field-odd field"><th class="field-name">Returns:</th><td class="field-body"><a class="reference external" href="https://docs.python.org/2.7/library/functions.html#int" title="(in Python v2.7)"><code class="xref py py-class docutils literal notranslate"><span class="pre">int</span></code></a> – 32 or 64</td>
</tr>
</tbody>
</table>
</dd></dl>
<dl class="method">
<dt id="windows.winobject.process.WinProcess.create_thread">
<code class="descname">create_thread</code><span class="sig-paren">(</span><em>addr</em>, <em>param</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/process.html#WinProcess.create_thread"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.winobject.process.WinProcess.create_thread" title="Permalink to this definition"></a></dt>
<dd><p>Create a remote thread</p>
<table class="docutils field-list" frame="void" rules="none">
<col class="field-name" />
<col class="field-body" />
<tbody valign="top">
<tr class="field-odd field"><th class="field-name">Return type:</th><td class="field-body"><a class="reference internal" href="#windows.winobject.process.WinThread" title="windows.winobject.process.WinThread"><code class="xref py py-class docutils literal notranslate"><span class="pre">WinThread</span></code></a> or <a class="reference internal" href="#windows.winobject.process.DeadThread" title="windows.winobject.process.DeadThread"><code class="xref py py-class docutils literal notranslate"><span class="pre">DeadThread</span></code></a></td>
</tr>
</tbody>
</table>
</dd></dl>
<dl class="method">
<dt id="windows.winobject.process.WinProcess.execute">
<code class="descname">execute</code><span class="sig-paren">(</span><em>code</em>, <em>parameter=0</em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.WinProcess.execute" title="Permalink to this definition"></a></dt>
<dd><p>Execute some native code in the context of the process</p>
<table class="docutils field-list" frame="void" rules="none">
<col class="field-name" />
<col class="field-body" />
<tbody valign="top">
<tr class="field-odd field"><th class="field-name">Returns:</th><td class="field-body">The thread executing the code</td>
</tr>
<tr class="field-even field"><th class="field-name">Return type:</th><td class="field-body"><a class="reference internal" href="#windows.winobject.process.WinThread" title="windows.winobject.process.WinThread"><code class="xref py py-class docutils literal notranslate"><span class="pre">WinThread</span></code></a> or <a class="reference internal" href="#windows.winobject.process.DeadThread" title="windows.winobject.process.DeadThread"><code class="xref py py-class docutils literal notranslate"><span class="pre">DeadThread</span></code></a></td>
</tr>
</tbody>
</table>
</dd></dl>
<dl class="method">
<dt id="windows.winobject.process.WinProcess.execute_python">
<code class="descname">execute_python</code><span class="sig-paren">(</span><em>pycode</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/process.html#WinProcess.execute_python"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.winobject.process.WinProcess.execute_python" title="Permalink to this definition"></a></dt>
<dd><p>Execute Python code into the remote process.</p>
<p>This function waits for the remote process to end and
raises an exception if the remote thread raised one</p>
</dd></dl>
<dl class="method">
<dt id="windows.winobject.process.WinProcess.execute_python_unsafe">
<code class="descname">execute_python_unsafe</code><span class="sig-paren">(</span><em>pycode</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/process.html#WinProcess.execute_python_unsafe"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.winobject.process.WinProcess.execute_python_unsafe" title="Permalink to this definition"></a></dt>
<dd><p>Execute Python code into the remote process.</p>
<table class="docutils field-list" frame="void" rules="none">
<col class="field-name" />
<col class="field-body" />
<tbody valign="top">
<tr class="field-odd field"><th class="field-name">Return type:</th><td class="field-body"><table class="docutils field-list" frame="void" rules="none">
<col class="field-name" />
<col class="field-body" />
<tbody valign="top">
<tr class="field-odd field"><th class="field-name">rtype:</th><td class="field-body"><a class="reference internal" href="#windows.winobject.process.WinThread" title="windows.winobject.process.WinThread"><code class="xref py py-class docutils literal notranslate"><span class="pre">WinThread</span></code></a> or <a class="reference internal" href="#windows.winobject.process.DeadThread" title="windows.winobject.process.DeadThread"><code class="xref py py-class docutils literal notranslate"><span class="pre">DeadThread</span></code></a> : The thread executing the python code</td>
</tr>
</tbody>
</table>
</td>
</tr>
</tbody>
</table>
</dd></dl>
<dl class="method">
<dt id="windows.winobject.process.WinProcess.exit">
<code class="descname">exit</code><span class="sig-paren">(</span><em>code=0</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/process.html#WinProcess.exit"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.winobject.process.WinProcess.exit" title="Permalink to this definition"></a></dt>
<dd><p>Exit the process</p>
</dd></dl>
<dl class="attribute">
<dt id="windows.winobject.process.WinProcess.exit_code">
<code class="descname">exit_code</code><a class="headerlink" href="#windows.winobject.process.WinProcess.exit_code" title="Permalink to this definition"></a></dt>
<dd><p>The exit code of the process : <code class="docutils literal notranslate"><span class="pre">STILL_ACTIVE</span></code> means the process is not dead</p>
<table class="docutils field-list" frame="void" rules="none">
<col class="field-name" />
<col class="field-body" />
<tbody valign="top">
<tr class="field-odd field"><th class="field-name">Type:</th><td class="field-body"><a class="reference external" href="https://docs.python.org/2.7/library/functions.html#int" title="(in Python v2.7)"><code class="xref py py-class docutils literal notranslate"><span class="pre">int</span></code></a></td>
</tr>
</tbody>
</table>
</dd></dl>
<dl class="method">
<dt id="windows.winobject.process.WinProcess.get_mapped_filename">
<code class="descname">get_mapped_filename</code><span class="sig-paren">(</span><em>addr</em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.WinProcess.get_mapped_filename" title="Permalink to this definition"></a></dt>
<dd><p>The filename mapped at address <code class="docutils literal notranslate"><span class="pre">addr</span></code> or <code class="docutils literal notranslate"><span class="pre">None</span></code></p>
<table class="docutils field-list" frame="void" rules="none">
<col class="field-name" />
<col class="field-body" />
<tbody valign="top">
<tr class="field-odd field"><th class="field-name">Return type:</th><td class="field-body"><code class="xref py py-class docutils literal notranslate"><span class="pre">unicode</span></code> or <code class="docutils literal notranslate"><span class="pre">None</span></code></td>
</tr>
</tbody>
</table>
</dd></dl>
<dl class="attribute">
<dt id="windows.winobject.process.WinProcess.handle">
<code class="descname">handle</code><a class="headerlink" href="#windows.winobject.process.WinProcess.handle" title="Permalink to this definition"></a></dt>
<dd><p>An handle on the object</p>
<table class="docutils field-list" frame="void" rules="none">
<col class="field-name" />
<col class="field-body" />
<tbody valign="top">
<tr class="field-odd field"><th class="field-name">Type:</th><td class="field-body"><p class="first">HANDLE</p>
<div class="last admonition note">
<p class="first admonition-title">Note</p>
<p class="last">The handle is automaticaly closed when the object is destroyed</p>
</div>
</td>
</tr>
</tbody>
</table>
</dd></dl>
<dl class="attribute">
<dt id="windows.winobject.process.WinProcess.is_exit">
<code class="descname">is_exit</code><a class="headerlink" href="#windows.winobject.process.WinProcess.is_exit" title="Permalink to this definition"></a></dt>
<dd><p><code class="docutils literal notranslate"><span class="pre">True</span></code> if the process is terminated</p>
<table class="docutils field-list" frame="void" rules="none">
<col class="field-name" />
<col class="field-body" />
<tbody valign="top">
<tr class="field-odd field"><th class="field-name">Type:</th><td class="field-body"><a class="reference external" href="https://docs.python.org/2.7/library/functions.html#bool" title="(in Python v2.7)"><code class="xref py py-class docutils literal notranslate"><span class="pre">bool</span></code></a></td>
</tr>
</tbody>
</table>
</dd></dl>
<dl class="attribute">
<dt id="windows.winobject.process.WinProcess.is_wow_64">
<code class="descname">is_wow_64</code><a class="headerlink" href="#windows.winobject.process.WinProcess.is_wow_64" title="Permalink to this definition"></a></dt>
<dd><p><code class="docutils literal notranslate"><span class="pre">True</span></code> if the process is a SysWow64 process (32bit process on 64bits system).</p>
<table class="docutils field-list" frame="void" rules="none">
<col class="field-name" />
<col class="field-body" />
<tbody valign="top">
<tr class="field-odd field"><th class="field-name">Type:</th><td class="field-body"><a class="reference external" href="https://docs.python.org/2.7/library/functions.html#bool" title="(in Python v2.7)"><code class="xref py py-class docutils literal notranslate"><span class="pre">bool</span></code></a></td>
</tr>
</tbody>
</table>
</dd></dl>
<dl class="method">
<dt id="windows.winobject.process.WinProcess.load_library">
<code class="descname">load_library</code><span class="sig-paren">(</span><em>dll_path</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/process.html#WinProcess.load_library"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.winobject.process.WinProcess.load_library" title="Permalink to this definition"></a></dt>
<dd><p>Load the library in remote process</p>
<table class="docutils field-list" frame="void" rules="none">
<col class="field-name" />
<col class="field-body" />
<tbody valign="top">
<tr class="field-odd field"><th class="field-name">Return type:</th><td class="field-body"><a class="reference internal" href="#windows.winobject.process.LoadedModule" title="windows.winobject.process.LoadedModule"><code class="xref py py-class docutils literal notranslate"><span class="pre">LoadedModule</span></code></a></td>
</tr>
</tbody>
</table>
</dd></dl>
<dl class="method">
<dt id="windows.winobject.process.WinProcess.memory_state">
<code class="descname">memory_state</code><span class="sig-paren">(</span><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.WinProcess.memory_state" title="Permalink to this definition"></a></dt>
<dd><p>Yield the memory information for the whole address space of the process</p>
<table class="docutils field-list" frame="void" rules="none">
<col class="field-name" />
<col class="field-body" />
<tbody valign="top">
<tr class="field-odd field"><th class="field-name">Yield:</th><td class="field-body"><a class="reference internal" href="winstructs_generated.html#windows.generated_def.winstructs.MEMORY_BASIC_INFORMATION" title="windows.generated_def.winstructs.MEMORY_BASIC_INFORMATION"><code class="xref py py-class docutils literal notranslate"><span class="pre">MEMORY_BASIC_INFORMATION</span></code></a></td>
</tr>
</tbody>
</table>
</dd></dl>
<dl class="attribute">
<dt id="windows.winobject.process.WinProcess.name">
<code class="descname">name</code><a class="headerlink" href="#windows.winobject.process.WinProcess.name" title="Permalink to this definition"></a></dt>
<dd><p>Name of the process</p>
<table class="docutils field-list" frame="void" rules="none">
<col class="field-name" />
<col class="field-body" />
<tbody valign="top">
<tr class="field-odd field"><th class="field-name">Type:</th><td class="field-body"><a class="reference external" href="https://docs.python.org/2.7/library/functions.html#str" title="(in Python v2.7)"><code class="xref py py-class docutils literal notranslate"><span class="pre">str</span></code></a></td>
</tr>
</tbody>
</table>
</dd></dl>
<dl class="method">
<dt id="windows.winobject.process.WinProcess.open_token">
<code class="descname">open_token</code><span class="sig-paren">(</span><em>flags=MAXIMUM_ALLOWED(0x2000000)</em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.WinProcess.open_token" title="Permalink to this definition"></a></dt>
<dd><p>Open the process Token</p>
<table class="docutils field-list" frame="void" rules="none">
<col class="field-name" />
<col class="field-body" />
<tbody valign="top">
<tr class="field-odd field"><th class="field-name">Returns:</th><td class="field-body"><a class="reference internal" href="token.html#windows.winobject.token.Token" title="windows.winobject.token.Token"><code class="xref py py-class docutils literal notranslate"><span class="pre">Token</span></code></a></td>
</tr>
</tbody>
</table>
</dd></dl>
<dl class="attribute">
<dt id="windows.winobject.process.WinProcess.peb">
<code class="descname">peb</code><a class="headerlink" href="#windows.winobject.process.WinProcess.peb" title="Permalink to this definition"></a></dt>
<dd><p>The PEB of the process (see <code class="xref py py-mod docutils literal notranslate"><span class="pre">remotectypes</span></code>)</p>
<table class="docutils field-list" frame="void" rules="none">
<col class="field-name" />
<col class="field-body" />
<tbody valign="top">
<tr class="field-odd field"><th class="field-name">Type:</th><td class="field-body"><a class="reference internal" href="#windows.winobject.process.PEB" title="windows.winobject.process.PEB"><code class="xref py py-class docutils literal notranslate"><span class="pre">PEB</span></code></a></td>
</tr>
</tbody>
</table>
</dd></dl>
<dl class="attribute">
<dt id="windows.winobject.process.WinProcess.peb_addr">
<code class="descname">peb_addr</code><a class="headerlink" href="#windows.winobject.process.WinProcess.peb_addr" title="Permalink to this definition"></a></dt>
<dd><p>The address of the PEB</p>
<table class="docutils field-list" frame="void" rules="none">
<col class="field-name" />
<col class="field-body" />
<tbody valign="top">
<tr class="field-odd field"><th class="field-name">Type:</th><td class="field-body"><a class="reference external" href="https://docs.python.org/2.7/library/functions.html#int" title="(in Python v2.7)"><code class="xref py py-class docutils literal notranslate"><span class="pre">int</span></code></a></td>
</tr>
</tbody>
</table>
</dd></dl>
<dl class="attribute">
<dt id="windows.winobject.process.WinProcess.peb_syswow">
<code class="descname">peb_syswow</code><a class="headerlink" href="#windows.winobject.process.WinProcess.peb_syswow" title="Permalink to this definition"></a></dt>
<dd><p>The 64bits PEB of a SysWow64 process</p>
<table class="docutils field-list" frame="void" rules="none">
<col class="field-name" />
<col class="field-body" />
<tbody valign="top">
<tr class="field-odd field"><th class="field-name">Type:</th><td class="field-body"><a class="reference internal" href="#windows.winobject.process.PEB" title="windows.winobject.process.PEB"><code class="xref py py-class docutils literal notranslate"><span class="pre">PEB</span></code></a></td>
</tr>
</tbody>
</table>
</dd></dl>
<dl class="attribute">
<dt id="windows.winobject.process.WinProcess.pid">
<code class="descname">pid</code><a class="headerlink" href="#windows.winobject.process.WinProcess.pid" title="Permalink to this definition"></a></dt>
<dd><p>Process ID</p>
<table class="docutils field-list" frame="void" rules="none">
<col class="field-name" />
<col class="field-body" />
<tbody valign="top">
<tr class="field-odd field"><th class="field-name">Type:</th><td class="field-body"><a class="reference external" href="https://docs.python.org/2.7/library/functions.html#int" title="(in Python v2.7)"><code class="xref py py-class docutils literal notranslate"><span class="pre">int</span></code></a></td>
</tr>
</tbody>
</table>
</dd></dl>
<dl class="attribute">
<dt id="windows.winobject.process.WinProcess.ppid">
<code class="descname">ppid</code><a class="headerlink" href="#windows.winobject.process.WinProcess.ppid" title="Permalink to this definition"></a></dt>
<dd><p>Parent Process ID</p>
<table class="docutils field-list" frame="void" rules="none">
<col class="field-name" />
<col class="field-body" />
<tbody valign="top">
<tr class="field-odd field"><th class="field-name">Type:</th><td class="field-body"><a class="reference external" href="https://docs.python.org/2.7/library/functions.html#int" title="(in Python v2.7)"><code class="xref py py-class docutils literal notranslate"><span class="pre">int</span></code></a></td>
</tr>
</tbody>
</table>
</dd></dl>
<dl class="method">
<dt id="windows.winobject.process.WinProcess.query_memory">
<code class="descname">query_memory</code><span class="sig-paren">(</span><em>addr</em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.WinProcess.query_memory" title="Permalink to this definition"></a></dt>
<dd><p>Query the memory informations about page at <code class="docutils literal notranslate"><span class="pre">addr</span></code></p>
<table class="docutils field-list" frame="void" rules="none">
<col class="field-name" />
<col class="field-body" />
<tbody valign="top">
<tr class="field-odd field"><th class="field-name">Return type:</th><td class="field-body"><a class="reference internal" href="winstructs_generated.html#windows.generated_def.winstructs.MEMORY_BASIC_INFORMATION" title="windows.generated_def.winstructs.MEMORY_BASIC_INFORMATION"><code class="xref py py-class docutils literal notranslate"><span class="pre">MEMORY_BASIC_INFORMATION</span></code></a></td>
</tr>
</tbody>
</table>
</dd></dl>
<dl class="method">
<dt id="windows.winobject.process.WinProcess.read_byte">
<code class="descname">read_byte</code><span class="sig-paren">(</span><em>addr</em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.WinProcess.read_byte" title="Permalink to this definition"></a></dt>
<dd><p>Read a <code class="docutils literal notranslate"><span class="pre">CHAR</span></code> at <code class="docutils literal notranslate"><span class="pre">addr</span></code></p>
</dd></dl>
<dl class="method">
<dt id="windows.winobject.process.WinProcess.read_dword">
<code class="descname">read_dword</code><span class="sig-paren">(</span><em>addr</em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.WinProcess.read_dword" title="Permalink to this definition"></a></dt>
<dd><p>Read a <code class="docutils literal notranslate"><span class="pre">DWORD</span></code> at <code class="docutils literal notranslate"><span class="pre">addr</span></code></p>
</dd></dl>
<dl class="method">
<dt id="windows.winobject.process.WinProcess.read_memory">
<code class="descname">read_memory</code><span class="sig-paren">(</span><em>addr</em>, <em>size</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/process.html#WinProcess.read_memory"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.winobject.process.WinProcess.read_memory" title="Permalink to this definition"></a></dt>
<dd><p>Read <code class="docutils literal notranslate"><span class="pre">size</span></code> from <code class="docutils literal notranslate"><span class="pre">addr</span></code></p>
<table class="docutils field-list" frame="void" rules="none">
<col class="field-name" />
<col class="field-body" />
<tbody valign="top">
<tr class="field-odd field"><th class="field-name">Returns:</th><td class="field-body">The data read</td>
</tr>
<tr class="field-even field"><th class="field-name">Return type:</th><td class="field-body"><a class="reference external" href="https://docs.python.org/2.7/library/functions.html#str" title="(in Python v2.7)"><code class="xref py py-class docutils literal notranslate"><span class="pre">str</span></code></a></td>
</tr>
</tbody>
</table>
</dd></dl>
<dl class="method">
<dt id="windows.winobject.process.WinProcess.read_memory_into">
<code class="descname">read_memory_into</code><span class="sig-paren">(</span><em>addr</em>, <em>struct</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/process.html#WinProcess.read_memory_into"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.winobject.process.WinProcess.read_memory_into" title="Permalink to this definition"></a></dt>
<dd><p>Read a <a class="reference external" href="https://docs.python.org/2.7/library/ctypes.html#module-ctypes" title="(in Python v2.7)"><code class="xref py py-mod docutils literal notranslate"><span class="pre">ctypes</span></code></a> struct from <cite>addr</cite></p>
<table class="docutils field-list" frame="void" rules="none">
<col class="field-name" />
<col class="field-body" />
<tbody valign="top">
<tr class="field-odd field"><th class="field-name">Returns:</th><td class="field-body">struct</td>
</tr>
</tbody>
</table>
</dd></dl>
<dl class="method">
<dt id="windows.winobject.process.WinProcess.read_ptr">
<code class="descname">read_ptr</code><span class="sig-paren">(</span><em>addr</em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.WinProcess.read_ptr" title="Permalink to this definition"></a></dt>
<dd><p>Read a <code class="docutils literal notranslate"><span class="pre">PTR</span></code> at <code class="docutils literal notranslate"><span class="pre">addr</span></code></p>
</dd></dl>
<dl class="method">
<dt id="windows.winobject.process.WinProcess.read_qword">
<code class="descname">read_qword</code><span class="sig-paren">(</span><em>addr</em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.WinProcess.read_qword" title="Permalink to this definition"></a></dt>
<dd><p>Read a <code class="docutils literal notranslate"><span class="pre">ULONG64</span></code> at <code class="docutils literal notranslate"><span class="pre">addr</span></code></p>
</dd></dl>
<dl class="method">
<dt id="windows.winobject.process.WinProcess.read_short">
<code class="descname">read_short</code><span class="sig-paren">(</span><em>addr</em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.WinProcess.read_short" title="Permalink to this definition"></a></dt>
<dd><p>Read a <code class="docutils literal notranslate"><span class="pre">SHORT</span></code> at <code class="docutils literal notranslate"><span class="pre">addr</span></code></p>
</dd></dl>
<dl class="method">
<dt id="windows.winobject.process.WinProcess.read_string">
<code class="descname">read_string</code><span class="sig-paren">(</span><em>addr</em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.WinProcess.read_string" title="Permalink to this definition"></a></dt>
<dd><p>Read an ascii string at <code class="docutils literal notranslate"><span class="pre">addr</span></code></p>
</dd></dl>
<dl class="method">
<dt id="windows.winobject.process.WinProcess.read_wstring">
<code class="descname">read_wstring</code><span class="sig-paren">(</span><em>addr</em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.WinProcess.read_wstring" title="Permalink to this definition"></a></dt>
<dd><p>Read a windows UTF16 string at <code class="docutils literal notranslate"><span class="pre">addr</span></code></p>
</dd></dl>
<dl class="attribute">
<dt id="windows.winobject.process.WinProcess.threads">
<code class="descname">threads</code><a class="headerlink" href="#windows.winobject.process.WinProcess.threads" title="Permalink to this definition"></a></dt>
<dd><p>The threads of the process</p>
<table class="docutils field-list" frame="void" rules="none">
<col class="field-name" />
<col class="field-body" />
<tbody valign="top">
<tr class="field-odd field"><th class="field-name">Type:</th><td class="field-body">[<a class="reference internal" href="#windows.winobject.process.WinThread" title="windows.winobject.process.WinThread"><code class="xref py py-class docutils literal notranslate"><span class="pre">WinThread</span></code></a>] – A list of Thread</td>
</tr>
</tbody>
</table>
</dd></dl>
<dl class="attribute">
<dt id="windows.winobject.process.WinProcess.time_info">
<code class="descname">time_info</code><a class="headerlink" href="#windows.winobject.process.WinProcess.time_info" title="Permalink to this definition"></a></dt>
<dd><p>The time information of the process (creation, kernel/user time, exit time)</p>
<table class="docutils field-list" frame="void" rules="none">
<col class="field-name" />
<col class="field-body" />
<tbody valign="top">
<tr class="field-odd field"><th class="field-name">Type:</th><td class="field-body"><code class="xref py py-class docutils literal notranslate"><span class="pre">TimeInfo</span></code></td>
</tr>
</tbody>
</table>
</dd></dl>
<dl class="attribute">
<dt id="windows.winobject.process.WinProcess.token">
<code class="descname">token</code><a class="headerlink" href="#windows.winobject.process.WinProcess.token" title="Permalink to this definition"></a></dt>
<dd><p>The process <a class="reference internal" href="token.html#windows.winobject.token.Token" title="windows.winobject.token.Token"><code class="xref py py-class docutils literal notranslate"><span class="pre">Token</span></code></a></p>
</dd></dl>
<dl class="method">
<dt id="windows.winobject.process.WinProcess.virtual_alloc">
<code class="descname">virtual_alloc</code><span class="sig-paren">(</span><em>size</em>, <em>prot=PAGE_EXECUTE_READWRITE(0x40)</em>, <em>addr=None</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/process.html#WinProcess.virtual_alloc"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.winobject.process.WinProcess.virtual_alloc" title="Permalink to this definition"></a></dt>
<dd><p>Allocate memory in the process</p>
<table class="docutils field-list" frame="void" rules="none">
<col class="field-name" />
<col class="field-body" />
<tbody valign="top">
<tr class="field-odd field"><th class="field-name">Returns:</th><td class="field-body">The address of the allocated memory</td>
</tr>
<tr class="field-even field"><th class="field-name">Return type:</th><td class="field-body"><a class="reference external" href="https://docs.python.org/2.7/library/functions.html#int" title="(in Python v2.7)"><code class="xref py py-class docutils literal notranslate"><span class="pre">int</span></code></a></td>
</tr>
</tbody>
</table>
</dd></dl>
<dl class="method">
<dt id="windows.winobject.process.WinProcess.virtual_free">
<code class="descname">virtual_free</code><span class="sig-paren">(</span><em>addr</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/process.html#WinProcess.virtual_free"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.winobject.process.WinProcess.virtual_free" title="Permalink to this definition"></a></dt>
<dd><p>Free memory in the process by virtual_alloc</p>
</dd></dl>
<dl class="method">
<dt id="windows.winobject.process.WinProcess.virtual_protect">
<code class="descname">virtual_protect</code><span class="sig-paren">(</span><em>addr</em>, <em>size</em>, <em>protect</em>, <em>old_protect=None</em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.WinProcess.virtual_protect" title="Permalink to this definition"></a></dt>
<dd><p>Change the access right of one or more page of the process</p>
</dd></dl>
<dl class="method">
<dt id="windows.winobject.process.WinProcess.virtual_protected">
<code class="descname">virtual_protected</code><span class="sig-paren">(</span><em>**kwds</em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.WinProcess.virtual_protected" title="Permalink to this definition"></a></dt>
<dd><p>A context manager for local virtual_protect (old Protection are restored at exit)</p>
</dd></dl>
<dl class="method">
<dt id="windows.winobject.process.WinProcess.wait">
<code class="descname">wait</code><span class="sig-paren">(</span><em>timeout=INFINITE(0xffffffff)</em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.WinProcess.wait" title="Permalink to this definition"></a></dt>
<dd><p>Wait for the object</p>
</dd></dl>
<dl class="method">
<dt id="windows.winobject.process.WinProcess.write_byte">
<code class="descname">write_byte</code><span class="sig-paren">(</span><em>addr</em>, <em>byte</em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.WinProcess.write_byte" title="Permalink to this definition"></a></dt>
<dd><p>write a byte at <code class="docutils literal notranslate"><span class="pre">addr</span></code></p>
</dd></dl>
<dl class="method">
<dt id="windows.winobject.process.WinProcess.write_dword">
<code class="descname">write_dword</code><span class="sig-paren">(</span><em>addr</em>, <em>dword</em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.WinProcess.write_dword" title="Permalink to this definition"></a></dt>
<dd><p>write a dword at <code class="docutils literal notranslate"><span class="pre">addr</span></code></p>
</dd></dl>
<dl class="method">
<dt id="windows.winobject.process.WinProcess.write_memory">
<code class="descname">write_memory</code><span class="sig-paren">(</span><em>addr</em>, <em>data</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/process.html#WinProcess.write_memory"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.winobject.process.WinProcess.write_memory" title="Permalink to this definition"></a></dt>
<dd><p>Write <cite>data</cite> at <cite>addr</cite></p>
</dd></dl>
<dl class="method">
<dt id="windows.winobject.process.WinProcess.write_ptr">
<code class="descname">write_ptr</code><span class="sig-paren">(</span><em>addr</em>, <em>value</em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.WinProcess.write_ptr" title="Permalink to this definition"></a></dt>
<dd><p>Write a <code class="docutils literal notranslate"><span class="pre">PTR</span></code> at <code class="docutils literal notranslate"><span class="pre">addr</span></code></p>
</dd></dl>
<dl class="method">
<dt id="windows.winobject.process.WinProcess.write_qword">
<code class="descname">write_qword</code><span class="sig-paren">(</span><em>addr</em>, <em>qword</em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.WinProcess.write_qword" title="Permalink to this definition"></a></dt>
<dd><p>write a qword at <code class="docutils literal notranslate"><span class="pre">addr</span></code></p>
</dd></dl>
<dl class="method">
<dt id="windows.winobject.process.WinProcess.write_short">
<code class="descname">write_short</code><span class="sig-paren">(</span><em>addr</em>, <em>word</em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.WinProcess.write_short" title="Permalink to this definition"></a></dt>
<dd><p>write a word at <code class="docutils literal notranslate"><span class="pre">addr</span></code></p>
</dd></dl>
</dd></dl>
</div>
<div class="section" id="winthread">
<h2>2.1.4. WinThread<a class="headerlink" href="#winthread" title="Permalink to this headline"></a></h2>
<dl class="class">
<dt id="windows.winobject.process.WinThread">
<em class="property">class </em><code class="descclassname">windows.winobject.process.</code><code class="descname">WinThread</code><span class="sig-paren">(</span><em>tid=None</em>, <em>handle=None</em>, <em>owner_pid=None</em>, <em>owner=None</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/process.html#WinThread"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.winobject.process.WinThread" title="Permalink to this definition"></a></dt>
<dd><p>Bases: <code class="xref py py-class docutils literal notranslate"><span class="pre">windows.winobject.process.Thread</span></code></p>
<p>Represent a thread</p>
<dl class="attribute">
<dt id="windows.winobject.process.WinThread.context">
<code class="descname">context</code><a class="headerlink" href="#windows.winobject.process.WinThread.context" title="Permalink to this definition"></a></dt>
<dd><p>The context of the thread, type depend of the target process.</p>
<table class="docutils field-list" frame="void" rules="none">
<col class="field-name" />
<col class="field-body" />
<tbody valign="top">
<tr class="field-odd field"><th class="field-name">Type:</th><td class="field-body"><code class="xref py py-class docutils literal notranslate"><span class="pre">windows.exception.ECONTEXT32</span></code> or <code class="xref py py-class docutils literal notranslate"><span class="pre">windows.exception.ECONTEXT64</span></code> or <code class="xref py py-class docutils literal notranslate"><span class="pre">windows.exception.ECONTEXTWOW64</span></code></td>
</tr>
</tbody>
</table>
</dd></dl>
<dl class="attribute">
<dt id="windows.winobject.process.WinThread.context_syswow">
<code class="descname">context_syswow</code><a class="headerlink" href="#windows.winobject.process.WinThread.context_syswow" title="Permalink to this definition"></a></dt>
<dd><p>The 64 bits context of a syswow thread.</p>
<table class="docutils field-list" frame="void" rules="none">
<col class="field-name" />
<col class="field-body" />
<tbody valign="top">
<tr class="field-odd field"><th class="field-name">Type:</th><td class="field-body"><code class="xref py py-class docutils literal notranslate"><span class="pre">windows.exception.ECONTEXT64</span></code></td>
</tr>
</tbody>
</table>
</dd></dl>
<dl class="method">
<dt id="windows.winobject.process.WinThread.exit">
<code class="descname">exit</code><span class="sig-paren">(</span><em>code=0</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/process.html#WinThread.exit"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.winobject.process.WinThread.exit" title="Permalink to this definition"></a></dt>
<dd><p>Exit the thread</p>
</dd></dl>
<dl class="attribute">
<dt id="windows.winobject.process.WinThread.exit_code">
<code class="descname">exit_code</code><a class="headerlink" href="#windows.winobject.process.WinThread.exit_code" title="Permalink to this definition"></a></dt>
<dd><p>The exit code of the thread : <code class="docutils literal notranslate"><span class="pre">STILL_ACTIVE</span></code> means the process is not dead</p>
<table class="docutils field-list" frame="void" rules="none">
<col class="field-name" />
<col class="field-body" />
<tbody valign="top">
<tr class="field-odd field"><th class="field-name">Type:</th><td class="field-body"><a class="reference external" href="https://docs.python.org/2.7/library/functions.html#int" title="(in Python v2.7)"><code class="xref py py-class docutils literal notranslate"><span class="pre">int</span></code></a></td>
</tr>
</tbody>
</table>
</dd></dl>
<dl class="attribute">
<dt id="windows.winobject.process.WinThread.handle">
<code class="descname">handle</code><a class="headerlink" href="#windows.winobject.process.WinThread.handle" title="Permalink to this definition"></a></dt>
<dd><p>An handle on the object</p>
<table class="docutils field-list" frame="void" rules="none">
<col class="field-name" />
<col class="field-body" />
<tbody valign="top">
<tr class="field-odd field"><th class="field-name">Type:</th><td class="field-body"><p class="first">HANDLE</p>
<div class="last admonition note">
<p class="first admonition-title">Note</p>
<p class="last">The handle is automaticaly closed when the object is destroyed</p>
</div>
</td>
</tr>
</tbody>
</table>
</dd></dl>
<dl class="attribute">
<dt id="windows.winobject.process.WinThread.is_exit">
<code class="descname">is_exit</code><a class="headerlink" href="#windows.winobject.process.WinThread.is_exit" title="Permalink to this definition"></a></dt>
<dd><p><code class="docutils literal notranslate"><span class="pre">True</span></code> if the thread is terminated</p>
<table class="docutils field-list" frame="void" rules="none">
<col class="field-name" />
<col class="field-body" />
<tbody valign="top">
<tr class="field-odd field"><th class="field-name">Type:</th><td class="field-body"><a class="reference external" href="https://docs.python.org/2.7/library/functions.html#bool" title="(in Python v2.7)"><code class="xref py py-class docutils literal notranslate"><span class="pre">bool</span></code></a></td>
</tr>
</tbody>
</table>
</dd></dl>
<dl class="method">
<dt id="windows.winobject.process.WinThread.open_token">
<code class="descname">open_token</code><span class="sig-paren">(</span><em>flags=MAXIMUM_ALLOWED(0x2000000)</em>, <em>as_self=False</em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.WinThread.open_token" title="Permalink to this definition"></a></dt>
<dd><p>Open the Thread token if any (Impersonation) else return None.
<code class="docutils literal notranslate"><span class="pre">as_self</span></code> tells which security context should be used</p>
<table class="docutils field-list" frame="void" rules="none">
<col class="field-name" />
<col class="field-body" />
<tbody valign="top">
<tr class="field-odd field"><th class="field-name">Returns:</th><td class="field-body"><a class="reference internal" href="token.html#windows.winobject.token.Token" title="windows.winobject.token.Token"><code class="xref py py-class docutils literal notranslate"><span class="pre">Token</span></code></a></td>
</tr>
</tbody>
</table>
<div class="admonition note">
<p class="first admonition-title">Note</p>
<p class="last">see <a class="reference external" href="https://docs.microsoft.com/en-us/windows/desktop/api/processthreadsapi/nf-processthreadsapi-openthreadtoken">https://docs.microsoft.com/en-us/windows/desktop/api/processthreadsapi/nf-processthreadsapi-openthreadtoken</a></p>
</div>
</dd></dl>
<dl class="attribute">
<dt id="windows.winobject.process.WinThread.owner">
<code class="descname">owner</code><a class="headerlink" href="#windows.winobject.process.WinThread.owner" title="Permalink to this definition"></a></dt>
<dd><p>The Process owning the thread</p>
<table class="docutils field-list" frame="void" rules="none">
<col class="field-name" />
<col class="field-body" />
<tbody valign="top">
<tr class="field-odd field"><th class="field-name">Type:</th><td class="field-body"><a class="reference internal" href="#windows.winobject.process.WinProcess" title="windows.winobject.process.WinProcess"><code class="xref py py-class docutils literal notranslate"><span class="pre">WinProcess</span></code></a></td>
</tr>
</tbody>
</table>
</dd></dl>
<dl class="method">
<dt id="windows.winobject.process.WinThread.resume">
<code class="descname">resume</code><span class="sig-paren">(</span><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/process.html#WinThread.resume"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.winobject.process.WinThread.resume" title="Permalink to this definition"></a></dt>
<dd><p>Resume the thread</p>
</dd></dl>
<dl class="method">
<dt id="windows.winobject.process.WinThread.set_context">
<code class="descname">set_context</code><span class="sig-paren">(</span><em>context</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/process.html#WinThread.set_context"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.winobject.process.WinThread.set_context" title="Permalink to this definition"></a></dt>
<dd><p>Set the thread’s context to <code class="docutils literal notranslate"><span class="pre">context</span></code></p>
</dd></dl>
<dl class="method">
<dt id="windows.winobject.process.WinThread.set_syswow_context">
<code class="descname">set_syswow_context</code><span class="sig-paren">(</span><em>context</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/process.html#WinThread.set_syswow_context"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.winobject.process.WinThread.set_syswow_context" title="Permalink to this definition"></a></dt>
<dd><p>Set a syswow thread’s 64 context to <code class="docutils literal notranslate"><span class="pre">context</span></code></p>
</dd></dl>
<dl class="method">
<dt id="windows.winobject.process.WinThread.set_token">
<code class="descname">set_token</code><span class="sig-paren">(</span><em>token</em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.WinThread.set_token" title="Permalink to this definition"></a></dt>
<dd><p>Set the token for the thread (impersonation). Setting the token to None revert the impersonation</p>
</dd></dl>
<dl class="attribute">
<dt id="windows.winobject.process.WinThread.start_address">
<code class="descname">start_address</code><a class="headerlink" href="#windows.winobject.process.WinThread.start_address" title="Permalink to this definition"></a></dt>
<dd><p>The start address of the thread</p>
<table class="docutils field-list" frame="void" rules="none">
<col class="field-name" />
<col class="field-body" />
<tbody valign="top">
<tr class="field-odd field"><th class="field-name">Type:</th><td class="field-body"><a class="reference external" href="https://docs.python.org/2.7/library/functions.html#int" title="(in Python v2.7)"><code class="xref py py-class docutils literal notranslate"><span class="pre">int</span></code></a></td>
</tr>
</tbody>
</table>
</dd></dl>
<dl class="method">
<dt id="windows.winobject.process.WinThread.suspend">
<code class="descname">suspend</code><span class="sig-paren">(</span><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/process.html#WinThread.suspend"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.winobject.process.WinThread.suspend" title="Permalink to this definition"></a></dt>
<dd><p>Suspend the thread</p>
</dd></dl>
<dl class="attribute">
<dt id="windows.winobject.process.WinThread.teb_base">
<code class="descname">teb_base</code><a class="headerlink" href="#windows.winobject.process.WinThread.teb_base" title="Permalink to this definition"></a></dt>
<dd><p>The address of the thread’s TEB</p>
<table class="docutils field-list" frame="void" rules="none">
<col class="field-name" />
<col class="field-body" />
<tbody valign="top">
<tr class="field-odd field"><th class="field-name">Type:</th><td class="field-body"><a class="reference external" href="https://docs.python.org/2.7/library/functions.html#int" title="(in Python v2.7)"><code class="xref py py-class docutils literal notranslate"><span class="pre">int</span></code></a></td>
</tr>
</tbody>
</table>
</dd></dl>
<dl class="attribute">
<dt id="windows.winobject.process.WinThread.tid">
<code class="descname">tid</code><a class="headerlink" href="#windows.winobject.process.WinThread.tid" title="Permalink to this definition"></a></dt>
<dd><p>Thread ID</p>
<table class="docutils field-list" frame="void" rules="none">
<col class="field-name" />
<col class="field-body" />
<tbody valign="top">
<tr class="field-odd field"><th class="field-name">Type:</th><td class="field-body"><a class="reference external" href="https://docs.python.org/2.7/library/functions.html#int" title="(in Python v2.7)"><code class="xref py py-class docutils literal notranslate"><span class="pre">int</span></code></a></td>
</tr>
</tbody>
</table>
</dd></dl>
<dl class="attribute">
<dt id="windows.winobject.process.WinThread.token">
<code class="descname">token</code><a class="headerlink" href="#windows.winobject.process.WinThread.token" title="Permalink to this definition"></a></dt>
<dd><p>The thread <a class="reference internal" href="token.html#windows.winobject.token.Token" title="windows.winobject.token.Token"><code class="xref py py-class docutils literal notranslate"><span class="pre">Token</span></code></a></p>
<table class="docutils field-list" frame="void" rules="none">
<col class="field-name" />
<col class="field-body" />
<tbody valign="top">
<tr class="field-odd field"><th class="field-name">Getter:</th><td class="field-body"><a class="reference internal" href="#windows.winobject.process.WinThread.open_token" title="windows.winobject.process.WinThread.open_token"><code class="xref py py-func docutils literal notranslate"><span class="pre">open_token()</span></code></a></td>
</tr>
<tr class="field-even field"><th class="field-name">Setter:</th><td class="field-body"><a class="reference internal" href="#windows.winobject.process.WinThread.set_token" title="windows.winobject.process.WinThread.set_token"><code class="xref py py-func docutils literal notranslate"><span class="pre">set_token()</span></code></a></td>
</tr>
</tbody>
</table>
</dd></dl>
<dl class="method">
<dt id="windows.winobject.process.WinThread.wait">
<code class="descname">wait</code><span class="sig-paren">(</span><em>timeout=INFINITE(0xffffffff)</em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.WinThread.wait" title="Permalink to this definition"></a></dt>
<dd><p>Wait for the object</p>
</dd></dl>
</dd></dl>
<dl class="class">
<dt id="windows.winobject.process.DeadThread">
<em class="property">class </em><code class="descclassname">windows.winobject.process.</code><code class="descname">DeadThread</code><span class="sig-paren">(</span><em>handle</em>, <em>tid=None</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/process.html#DeadThread"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.winobject.process.DeadThread" title="Permalink to this definition"></a></dt>
<dd><p>Bases: <code class="xref py py-class docutils literal notranslate"><span class="pre">windows.utils.pythonutils.AutoHandle</span></code></p>
<p>An already dead thread (returned only by API returning a new thread if thread die before being returned)</p>
<dl class="attribute">
<dt id="windows.winobject.process.DeadThread.exit_code">
<code class="descname">exit_code</code><a class="headerlink" href="#windows.winobject.process.DeadThread.exit_code" title="Permalink to this definition"></a></dt>
<dd><p>The exit code of the thread : <code class="docutils literal notranslate"><span class="pre">STILL_ACTIVE</span></code> means the process is not dead</p>
<table class="docutils field-list" frame="void" rules="none">
<col class="field-name" />
<col class="field-body" />
<tbody valign="top">
<tr class="field-odd field"><th class="field-name">Type:</th><td class="field-body"><a class="reference external" href="https://docs.python.org/2.7/library/functions.html#int" title="(in Python v2.7)"><code class="xref py py-class docutils literal notranslate"><span class="pre">int</span></code></a></td>
</tr>
</tbody>
</table>
</dd></dl>
<dl class="attribute">
<dt id="windows.winobject.process.DeadThread.handle">
<code class="descname">handle</code><a class="headerlink" href="#windows.winobject.process.DeadThread.handle" title="Permalink to this definition"></a></dt>
<dd><p>An handle on the object</p>
<table class="docutils field-list" frame="void" rules="none">
<col class="field-name" />
<col class="field-body" />
<tbody valign="top">
<tr class="field-odd field"><th class="field-name">Type:</th><td class="field-body"><p class="first">HANDLE</p>
<div class="last admonition note">
<p class="first admonition-title">Note</p>
<p class="last">The handle is automaticaly closed when the object is destroyed</p>
</div>
</td>
</tr>
</tbody>
</table>
</dd></dl>
<dl class="attribute">
<dt id="windows.winobject.process.DeadThread.is_exit">
<code class="descname">is_exit</code><a class="headerlink" href="#windows.winobject.process.DeadThread.is_exit" title="Permalink to this definition"></a></dt>
<dd><p><code class="docutils literal notranslate"><span class="pre">True</span></code> if the thread is terminated</p>
<table class="docutils field-list" frame="void" rules="none">
<col class="field-name" />
<col class="field-body" />
<tbody valign="top">
<tr class="field-odd field"><th class="field-name">Type:</th><td class="field-body"><a class="reference external" href="https://docs.python.org/2.7/library/functions.html#bool" title="(in Python v2.7)"><code class="xref py py-class docutils literal notranslate"><span class="pre">bool</span></code></a></td>
</tr>
</tbody>
</table>
</dd></dl>
<dl class="method">
<dt id="windows.winobject.process.DeadThread.wait">
<code class="descname">wait</code><span class="sig-paren">(</span><em>timeout=INFINITE(0xffffffff)</em><span class="sig-paren">)</span><a class="headerlink" href="#windows.winobject.process.DeadThread.wait" title="Permalink to this definition"></a></dt>
<dd><p>Wait for the object</p>
</dd></dl>
</dd></dl>
</div>
</div>
<div class="section" id="peb-exploration">
<h1>2.2. PEB Exploration<a class="headerlink" href="#peb-exploration" title="Permalink to this headline"></a></h1>
<p>The <code class="xref py py-mod docutils literal notranslate"><span class="pre">windows</span></code> module is able to parse the PEB of the current process or remote process.
The <a class="reference internal" href="#windows.winobject.process.PEB" title="windows.winobject.process.PEB"><code class="xref py py-class docutils literal notranslate"><span class="pre">PEB</span></code></a> is accessible via <code class="docutils literal notranslate"><span class="pre">process.peb</span></code> and is of type <a class="reference internal" href="#windows.winobject.process.PEB" title="windows.winobject.process.PEB"><code class="xref py py-class docutils literal notranslate"><span class="pre">PEB</span></code></a>.</p>
<div class="admonition note">
<p class="first admonition-title">Note</p>
<p class="last">See sample <a class="reference internal" href="sample.html#sample-peb-exploration"><span class="std std-ref">PEB exploration</span></a></p>
</div>
<div class="section" id="peb">
<h2>2.2.1. PEB<a class="headerlink" href="#peb" title="Permalink to this headline"></a></h2>
<dl class="class">
<dt id="windows.winobject.process.PEB">
<em class="property">class </em><code class="descclassname">windows.winobject.process.</code><code class="descname">PEB</code><a class="reference internal" href="_modules/windows/winobject/process.html#PEB"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.winobject.process.PEB" title="Permalink to this definition"></a></dt>
<dd><p>The PEB (Process Environment Block) of the current process</p>
<dl class="attribute">
<dt id="windows.winobject.process.PEB.apisetmap">
<code class="descname">apisetmap</code><a class="headerlink" href="#windows.winobject.process.PEB.apisetmap" title="Permalink to this definition"></a></dt>
<dd><p>The <a class="reference internal" href="#windows.winobject.apisetmap.ApiSetMap" title="windows.winobject.apisetmap.ApiSetMap"><code class="xref py py-class docutils literal notranslate"><span class="pre">ApiSetMap</span></code></a> of the process</p>
<table class="docutils field-list" frame="void" rules="none">
<col class="field-name" />
<col class="field-body" />
<tbody valign="top">
<tr class="field-odd field"><th class="field-name">Return type:</th><td class="field-body">A subclass of <a class="reference internal" href="#windows.winobject.apisetmap.ApiSetMap" title="windows.winobject.apisetmap.ApiSetMap"><code class="xref py py-class docutils literal notranslate"><span class="pre">ApiSetMap</span></code></a></td>
</tr>
<tr class="field-even field"><th class="field-name">Raise:</th><td class="field-body"><code class="xref py py-class docutils literal notranslate"><span class="pre">NotImplementedError</span></code> – Before <code class="docutils literal notranslate"><span class="pre">6.2</span></code> ApiSetMap did not exist</td>
</tr>
<tr class="field-odd field"><th class="field-name">Raise:</th><td class="field-body"><code class="xref py py-class docutils literal notranslate"><span class="pre">NotImplementedError</span></code> – Not implemented for remote process</td>
</tr>
</tbody>
</table>
</dd></dl>
<dl class="attribute">
<dt id="windows.winobject.process.PEB.commandline">
<code class="descname">commandline</code><a class="headerlink" href="#windows.winobject.process.PEB.commandline" title="Permalink to this definition"></a></dt>
<dd><p>The CommandLine of the PEB</p>
<table class="docutils field-list" frame="void" rules="none">
<col class="field-name" />
<col class="field-body" />
<tbody valign="top">
<tr class="field-odd field"><th class="field-name">Type:</th><td class="field-body"><a class="reference internal" href="winstructs_generated.html#windows.generated_def.winstructs.LSA_UNICODE_STRING" title="windows.generated_def.winstructs.LSA_UNICODE_STRING"><code class="xref py py-class docutils literal notranslate"><span class="pre">LSA_UNICODE_STRING</span></code></a></td>
</tr>
</tbody>
</table>
</dd></dl>
<dl class="attribute">
<dt id="windows.winobject.process.PEB.exe">
<code class="descname">exe</code><a class="headerlink" href="#windows.winobject.process.PEB.exe" title="Permalink to this definition"></a></dt>
<dd><p>The executable of the process, as pointed by PEB.ImageBaseAddress</p>
<table class="docutils field-list" frame="void" rules="none">
<col class="field-name" />
<col class="field-body" />
<tbody valign="top">
<tr class="field-odd field"><th class="field-name">Type:</th><td class="field-body"><a class="reference internal" href="#windows.pe_parse.PEFile" title="windows.pe_parse.PEFile"><code class="xref py py-class docutils literal notranslate"><span class="pre">windows.pe_parse.PEFile</span></code></a></td>
</tr>
</tbody>
</table>
</dd></dl>
<dl class="attribute">
<dt id="windows.winobject.process.PEB.imagepath">
<code class="descname">imagepath</code><a class="headerlink" href="#windows.winobject.process.PEB.imagepath" title="Permalink to this definition"></a></dt>
<dd><p>The ImagePathName of the PEB</p>
<table class="docutils field-list" frame="void" rules="none">
<col class="field-name" />
<col class="field-body" />
<tbody valign="top">
<tr class="field-odd field"><th class="field-name">Type:</th><td class="field-body"><a class="reference internal" href="winstructs_generated.html#windows.generated_def.winstructs.LSA_UNICODE_STRING" title="windows.generated_def.winstructs.LSA_UNICODE_STRING"><code class="xref py py-class docutils literal notranslate"><span class="pre">LSA_UNICODE_STRING</span></code></a></td>
</tr>
</tbody>
</table>
</dd></dl>
<dl class="attribute">
<dt id="windows.winobject.process.PEB.modules">
<code class="descname">modules</code><a class="headerlink" href="#windows.winobject.process.PEB.modules" title="Permalink to this definition"></a></dt>
<dd><p>The loaded modules present in the PEB</p>
<table class="docutils field-list" frame="void" rules="none">
<col class="field-name" />
<col class="field-body" />
<tbody valign="top">
<tr class="field-odd field"><th class="field-name">Type:</th><td class="field-body">[<a class="reference internal" href="#windows.winobject.process.LoadedModule" title="windows.winobject.process.LoadedModule"><code class="xref py py-class docutils literal notranslate"><span class="pre">LoadedModule</span></code></a>] – List of loaded modules</td>
</tr>
</tbody>
</table>
</dd></dl>
</dd></dl>
</div>
<div class="section" id="loadedmodule">
<h2>2.2.2. LoadedModule<a class="headerlink" href="#loadedmodule" title="Permalink to this headline"></a></h2>
<dl class="class">
<dt id="windows.winobject.process.LoadedModule">
<em class="property">class </em><code class="descclassname">windows.winobject.process.</code><code class="descname">LoadedModule</code><a class="reference internal" href="_modules/windows/winobject/process.html#LoadedModule"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.winobject.process.LoadedModule" title="Permalink to this definition"></a></dt>
<dd><p>An entry in the PEB Ldr list</p>
<dl class="attribute">
<dt id="windows.winobject.process.LoadedModule.baseaddr">
<code class="descname">baseaddr</code><a class="headerlink" href="#windows.winobject.process.LoadedModule.baseaddr" title="Permalink to this definition"></a></dt>
<dd><p>Base address of the module</p>
<table class="docutils field-list" frame="void" rules="none">
<col class="field-name" />
<col class="field-body" />
<tbody valign="top">
<tr class="field-odd field"><th class="field-name">Type:</th><td class="field-body"><a class="reference external" href="https://docs.python.org/2.7/library/functions.html#int" title="(in Python v2.7)"><code class="xref py py-class docutils literal notranslate"><span class="pre">int</span></code></a></td>
</tr>
</tbody>
</table>
</dd></dl>
<dl class="attribute">
<dt id="windows.winobject.process.LoadedModule.fullname">
<code class="descname">fullname</code><a class="headerlink" href="#windows.winobject.process.LoadedModule.fullname" title="Permalink to this definition"></a></dt>
<dd><p>Full name of the module (path)</p>
<table class="docutils field-list" frame="void" rules="none">
<col class="field-name" />
<col class="field-body" />
<tbody valign="top">
<tr class="field-odd field"><th class="field-name">Type:</th><td class="field-body"><a class="reference external" href="https://docs.python.org/2.7/library/functions.html#str" title="(in Python v2.7)"><code class="xref py py-class docutils literal notranslate"><span class="pre">str</span></code></a></td>
</tr>
</tbody>
</table>
</dd></dl>
<dl class="attribute">
<dt id="windows.winobject.process.LoadedModule.name">
<code class="descname">name</code><a class="headerlink" href="#windows.winobject.process.LoadedModule.name" title="Permalink to this definition"></a></dt>
<dd><p>Name of the module</p>
<table class="docutils field-list" frame="void" rules="none">
<col class="field-name" />
<col class="field-body" />
<tbody valign="top">
<tr class="field-odd field"><th class="field-name">Type:</th><td class="field-body"><a class="reference external" href="https://docs.python.org/2.7/library/functions.html#str" title="(in Python v2.7)"><code class="xref py py-class docutils literal notranslate"><span class="pre">str</span></code></a></td>
</tr>
</tbody>
</table>
</dd></dl>
<dl class="attribute">
<dt id="windows.winobject.process.LoadedModule.pe">
<code class="descname">pe</code><a class="headerlink" href="#windows.winobject.process.LoadedModule.pe" title="Permalink to this definition"></a></dt>
<dd><p>A PE representation of the module</p>
<table class="docutils field-list" frame="void" rules="none">
<col class="field-name" />
<col class="field-body" />
<tbody valign="top">
<tr class="field-odd field"><th class="field-name">Type:</th><td class="field-body"><a class="reference internal" href="#windows.pe_parse.PEFile" title="windows.pe_parse.PEFile"><code class="xref py py-class docutils literal notranslate"><span class="pre">windows.pe_parse.PEFile</span></code></a></td>
</tr>
</tbody>
</table>
</dd></dl>
</dd></dl>
</div>
<div class="section" id="apisetmap">
<h2>2.2.3. ApiSetMap<a class="headerlink" href="#apisetmap" title="Permalink to this headline"></a></h2>
<div class="admonition note">
<p class="first admonition-title">Note</p>
<p class="last">see sample <a class="reference internal" href="sample.html#sample-apisetmap"><span class="std std-ref">ApiSetMap</span></a></p>
</div>
<dl class="class">
<dt id="windows.winobject.apisetmap.ApiSetMap">
<em class="property">class </em><code class="descclassname">windows.winobject.apisetmap.</code><code class="descname">ApiSetMap</code><span class="sig-paren">(</span><em>base</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/apisetmap.html#ApiSetMap"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.winobject.apisetmap.ApiSetMap" title="Permalink to this definition"></a></dt>
<dd><p>The base class for the ApiSeMap
(see <a class="reference external" href="https://blog.quarkslab.com/runtime-dll-name-resolution-apisetschema-part-ii.html">Runtime DLL name resolution: ApiSetSchema</a>)</p>
<dl class="attribute">
<dt id="windows.winobject.apisetmap.ApiSetMap.apisetmap_dict">
<code class="descname">apisetmap_dict</code><a class="headerlink" href="#windows.winobject.apisetmap.ApiSetMap.apisetmap_dict" title="Permalink to this definition"></a></dt>
<dd><p>The apisetmap dll-mapping content extracted from memory as a <a class="reference external" href="https://docs.python.org/2.7/library/stdtypes.html#dict" title="(in Python v2.7)"><code class="xref py py-class docutils literal notranslate"><span class="pre">dict</span></code></a></p>
<p><code class="docutils literal notranslate"><span class="pre">key</span> <span class="pre">-&gt;</span> <span class="pre">value</span> <span class="pre">example</span></code>:</p>
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="sa">u</span><span class="s1">&#39;ext-ms-win-advapi32-encryptedfile-l1-1-1&#39;</span> <span class="o">-&gt;</span> <span class="sa">u</span><span class="s1">&#39;advapi32.dll&#39;</span>
</pre></div>
</div>
</dd></dl>
<dl class="attribute">
<dt id="windows.winobject.apisetmap.ApiSetMap.resolution_dict">
<code class="descname">resolution_dict</code><a class="headerlink" href="#windows.winobject.apisetmap.ApiSetMap.resolution_dict" title="Permalink to this definition"></a></dt>
<dd><p>The <a class="reference external" href="https://docs.python.org/2.7/library/stdtypes.html#dict" title="(in Python v2.7)"><code class="xref py py-class docutils literal notranslate"><span class="pre">dict</span></code></a> based on <a class="reference internal" href="#windows.winobject.apisetmap.ApiSetMap.apisetmap_dict" title="windows.winobject.apisetmap.ApiSetMap.apisetmap_dict"><code class="xref py py-obj docutils literal notranslate"><span class="pre">apisetmap_dict</span></code></a> with only the part checked by <code class="docutils literal notranslate"><span class="pre">Windows</span></code>.</p>
<p><code class="docutils literal notranslate"><span class="pre">Windows</span></code> does not care about what is after the last <code class="docutils literal notranslate"><span class="pre">-</span></code></p>
<p><code class="docutils literal notranslate"><span class="pre">key</span> <span class="pre">-&gt;</span> <span class="pre">value</span> <span class="pre">example</span></code>:</p>
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="sa">u</span><span class="s1">&#39;ext-ms-win-advapi32-encryptedfile-l1-1-&#39;</span> <span class="o">-&gt;</span> <span class="sa">u</span><span class="s1">&#39;advapi32.dll&#39;</span>
</pre></div>
</div>
</dd></dl>
<dl class="method">
<dt id="windows.winobject.apisetmap.ApiSetMap.resolve">
<code class="descname">resolve</code><span class="sig-paren">(</span><em>dllname</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/apisetmap.html#ApiSetMap.resolve"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.winobject.apisetmap.ApiSetMap.resolve" title="Permalink to this definition"></a></dt>
<dd><p>The method used to resolve a DLL name using the ApiSetMap.
The behavior should match the non-exported function <code class="docutils literal notranslate"><span class="pre">ntdll!ApiSetResolveToHost</span></code></p>
</dd></dl>
<dl class="attribute">
<dt id="windows.winobject.apisetmap.ApiSetMap.version">
<code class="descname">version</code><em class="property"> = None</em><a class="headerlink" href="#windows.winobject.apisetmap.ApiSetMap.version" title="Permalink to this definition"></a></dt>
<dd><p>The version of the ApiSetMap</p>
</dd></dl>
</dd></dl>
<div class="admonition note">
<p class="first admonition-title">Note</p>
<p class="last">Currently supported version for the ApiSetMap are 2/4/6</p>
</div>
<dl class="class">
<dt id="windows.winobject.apisetmap.ApiSetMapVersion2">
<em class="property">class </em><code class="descclassname">windows.winobject.apisetmap.</code><code class="descname">ApiSetMapVersion2</code><span class="sig-paren">(</span><em>base</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/apisetmap.html#ApiSetMapVersion2"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.winobject.apisetmap.ApiSetMapVersion2" title="Permalink to this definition"></a></dt>
<dd><p>Represent an ApiSetMap version-2</p>
<dl class="attribute">
<dt id="windows.winobject.apisetmap.ApiSetMapVersion2.version">
<code class="descname">version</code><em class="property"> = 2</em><a class="headerlink" href="#windows.winobject.apisetmap.ApiSetMapVersion2.version" title="Permalink to this definition"></a></dt>
<dd><p>The version of the ApiSetMap</p>
</dd></dl>
</dd></dl>
<dl class="class">
<dt id="windows.winobject.apisetmap.ApiSetMapVersion4">
<em class="property">class </em><code class="descclassname">windows.winobject.apisetmap.</code><code class="descname">ApiSetMapVersion4</code><span class="sig-paren">(</span><em>base</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/apisetmap.html#ApiSetMapVersion4"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.winobject.apisetmap.ApiSetMapVersion4" title="Permalink to this definition"></a></dt>
<dd><p>Represent an ApiSetMap version-4</p>
<dl class="attribute">
<dt id="windows.winobject.apisetmap.ApiSetMapVersion4.version">
<code class="descname">version</code><em class="property"> = 4</em><a class="headerlink" href="#windows.winobject.apisetmap.ApiSetMapVersion4.version" title="Permalink to this definition"></a></dt>
<dd><p>The version of the ApiSetMap</p>
</dd></dl>
</dd></dl>
<dl class="class">
<dt id="windows.winobject.apisetmap.ApiSetMapVersion6">
<em class="property">class </em><code class="descclassname">windows.winobject.apisetmap.</code><code class="descname">ApiSetMapVersion6</code><span class="sig-paren">(</span><em>base</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/winobject/apisetmap.html#ApiSetMapVersion6"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.winobject.apisetmap.ApiSetMapVersion6" title="Permalink to this definition"></a></dt>
<dd><p>Represent an ApiSetMap version-6</p>
<dl class="attribute">
<dt id="windows.winobject.apisetmap.ApiSetMapVersion6.version">
<code class="descname">version</code><em class="property"> = 6</em><a class="headerlink" href="#windows.winobject.apisetmap.ApiSetMapVersion6.version" title="Permalink to this definition"></a></dt>
<dd><p>The version of the ApiSetMap</p>
</dd></dl>
</dd></dl>
</div>
</div>
<div class="section" id="pefile-parsing-loaded-pe">
<h1>2.3. PEFile - Parsing loaded PE<a class="headerlink" href="#pefile-parsing-loaded-pe" title="Permalink to this headline"></a></h1>
<div class="section" id="module-windows.pe_parse">
<span id="windows-pe-parse"></span><h2>2.3.1. <a class="reference internal" href="#module-windows.pe_parse" title="windows.pe_parse"><code class="xref py py-mod docutils literal notranslate"><span class="pre">windows.pe_parse</span></code></a><a class="headerlink" href="#module-windows.pe_parse" title="Permalink to this headline"></a></h2>
<dl class="function">
<dt id="windows.pe_parse.GetPEFile">
<code class="descclassname">windows.pe_parse.</code><code class="descname">GetPEFile</code><span class="sig-paren">(</span><em>baseaddr</em>, <em>target=None</em>, <em>force_bitness=None</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/pe_parse.html#GetPEFile"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.pe_parse.GetPEFile" title="Permalink to this definition"></a></dt>
<dd><p>Returns a <a class="reference internal" href="#windows.pe_parse.PEFile" title="windows.pe_parse.PEFile"><code class="xref py py-class docutils literal notranslate"><span class="pre">PEFile</span></code></a> to explore a PE loaded at <cite>baseaddr</cite> in process <cite>target</cite>.</p>
<table class="docutils field-list" frame="void" rules="none">
<col class="field-name" />
<col class="field-body" />
<tbody valign="top">
<tr class="field-odd field"><th class="field-name">Return type:</th><td class="field-body"><a class="reference internal" href="#windows.pe_parse.PEFile" title="windows.pe_parse.PEFile"><code class="xref py py-class docutils literal notranslate"><span class="pre">PEFile</span></code></a></td>
</tr>
</tbody>
</table>
<div class="admonition note">
<p class="first admonition-title">Note</p>
<p class="last">If target is <code class="docutils literal notranslate"><span class="pre">None</span></code> it refers to the current process</p>
</div>
</dd></dl>
<div class="section" id="pefile">
<h3>2.3.1.1. PEFile<a class="headerlink" href="#pefile" title="Permalink to this headline"></a></h3>
<dl class="class">
<dt id="windows.pe_parse.PEFile">
<em class="property">class </em><code class="descclassname">windows.pe_parse.</code><code class="descname">PEFile</code><span class="sig-paren">(</span><em>target</em>, <em>baseaddr</em>, <em>targetedbitness</em>, <em>transformers</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/pe_parse.html#PEFile"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.pe_parse.PEFile" title="Permalink to this definition"></a></dt>
<dd><p>Represent a PE loaded in a process (current or remote)</p>
<dl class="attribute">
<dt id="windows.pe_parse.PEFile.export_name">
<code class="descname">export_name</code><a class="headerlink" href="#windows.pe_parse.PEFile.export_name" title="Permalink to this definition"></a></dt>
<dd><p>The Name attribute of the <code class="docutils literal notranslate"><span class="pre">EXPORT_DIRECTORY</span></code></p>
</dd></dl>
<dl class="attribute">
<dt id="windows.pe_parse.PEFile.exports">
<code class="descname">exports</code><a class="headerlink" href="#windows.pe_parse.PEFile.exports" title="Permalink to this definition"></a></dt>
<dd><p>The exports of the PE in a dict. Keys are ordinal (<a class="reference external" href="https://docs.python.org/2.7/library/functions.html#int" title="(in Python v2.7)"><code class="xref py py-class docutils literal notranslate"><span class="pre">int</span></code></a>) and name (<a class="reference external" href="https://docs.python.org/2.7/library/functions.html#str" title="(in Python v2.7)"><code class="xref py py-class docutils literal notranslate"><span class="pre">str</span></code></a>).
The values are the addresses of the exports.</p>
<blockquote>
<div><table class="docutils field-list" frame="void" rules="none">
<col class="field-name" />
<col class="field-body" />
<tbody valign="top">
<tr class="field-odd field"><th class="field-name">type:</th><td class="field-body">{(<a class="reference external" href="https://docs.python.org/2.7/library/functions.html#int" title="(in Python v2.7)"><code class="xref py py-class docutils literal notranslate"><span class="pre">int</span></code></a> or <a class="reference external" href="https://docs.python.org/2.7/library/functions.html#str" title="(in Python v2.7)"><code class="xref py py-class docutils literal notranslate"><span class="pre">str</span></code></a>) : <a class="reference external" href="https://docs.python.org/2.7/library/functions.html#int" title="(in Python v2.7)"><code class="xref py py-class docutils literal notranslate"><span class="pre">int</span></code></a>}</td>
</tr>
</tbody>
</table>
</div></blockquote>
</dd></dl>
<dl class="attribute">
<dt id="windows.pe_parse.PEFile.imports">
<code class="descname">imports</code><a class="headerlink" href="#windows.pe_parse.PEFile.imports" title="Permalink to this definition"></a></dt>
<dd><p>The imports of the PE in a dict.
Keys are the names of DLL to import from and values are <code class="xref py py-class docutils literal notranslate"><span class="pre">list</span></code>
of <a class="reference internal" href="#windows.pe_parse.IATEntry" title="windows.pe_parse.IATEntry"><code class="xref py py-class docutils literal notranslate"><span class="pre">IATEntry</span></code></a></p>
<blockquote>
<div><table class="docutils field-list" frame="void" rules="none">
<col class="field-name" />
<col class="field-body" />
<tbody valign="top">
<tr class="field-odd field"><th class="field-name">type:</th><td class="field-body">{<a class="reference external" href="https://docs.python.org/2.7/library/functions.html#str" title="(in Python v2.7)"><code class="xref py py-class docutils literal notranslate"><span class="pre">str</span></code></a> : [<a class="reference internal" href="#windows.pe_parse.IATEntry" title="windows.pe_parse.IATEntry"><code class="xref py py-class docutils literal notranslate"><span class="pre">IATEntry</span></code></a>]}</td>
</tr>
</tbody>
</table>
</div></blockquote>
</dd></dl>
</dd></dl>
</div>
<div class="section" id="iatentry">
<h3>2.3.1.2. IATEntry<a class="headerlink" href="#iatentry" title="Permalink to this headline"></a></h3>
<dl class="class">
<dt id="windows.pe_parse.IATEntry">
<em class="property">class </em><code class="descclassname">windows.pe_parse.</code><code class="descname">IATEntry</code><a class="reference internal" href="_modules/windows/pe_parse.html#IATEntry"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.pe_parse.IATEntry" title="Permalink to this definition"></a></dt>
<dd><p>Represent an entry in the IAT of a module
Can be used to get resolved value and setup hook</p>
<dl class="data">
<dt id="windows.pe_parse.IATEntry.addr">
<code class="descname">addr</code><a class="headerlink" href="#windows.pe_parse.IATEntry.addr" title="Permalink to this definition"></a></dt>
<dd><p><a class="reference external" href="https://docs.python.org/2.7/library/functions.html#int" title="(in Python v2.7)"><code class="xref py py-class docutils literal notranslate"><span class="pre">int</span></code></a> : Address of the IAT Entry</p>
</dd></dl>
<dl class="data">
<dt id="windows.pe_parse.IATEntry.ord">
<code class="descname">ord</code><a class="headerlink" href="#windows.pe_parse.IATEntry.ord" title="Permalink to this definition"></a></dt>
<dd><p><a class="reference external" href="https://docs.python.org/2.7/library/functions.html#int" title="(in Python v2.7)"><code class="xref py py-class docutils literal notranslate"><span class="pre">int</span></code></a> : Ordinal of the imported function</p>
</dd></dl>
<dl class="data">
<dt id="windows.pe_parse.IATEntry.name">
<code class="descname">name</code><a class="headerlink" href="#windows.pe_parse.IATEntry.name" title="Permalink to this definition"></a></dt>
<dd><p><a class="reference external" href="https://docs.python.org/2.7/library/functions.html#int" title="(in Python v2.7)"><code class="xref py py-class docutils literal notranslate"><span class="pre">int</span></code></a> : Name of the imported function</p>
</dd></dl>
<dl class="data">
<dt id="windows.pe_parse.IATEntry.value">
<code class="descname">value</code><a class="headerlink" href="#windows.pe_parse.IATEntry.value" title="Permalink to this definition"></a></dt>
<dd><p><a class="reference external" href="https://docs.python.org/2.7/library/functions.html#int" title="(in Python v2.7)"><code class="xref py py-class docutils literal notranslate"><span class="pre">int</span></code></a> : The content (destination) of the IAT entry</p>
<div class="admonition warning">
<p class="first admonition-title">Warning</p>
<p class="last"><cite>value</cite> is a descriptor. Setting its value will actually CHANGE THE IAT ENTRY, resulting in a segfault if no VirtualProtect have been done.</p>
</div>
<div class="admonition note">
<p class="first admonition-title">Note</p>
<p class="last">See: <a class="reference internal" href="utils.html#windows.utils.VirtualProtected" title="windows.utils.VirtualProtected"><code class="xref py py-class docutils literal notranslate"><span class="pre">windows.utils.VirtualProtected</span></code></a></p>
</div>
</dd></dl>
<dl class="method">
<dt id="windows.pe_parse.IATEntry.remove_hook">
<code class="descname">remove_hook</code><span class="sig-paren">(</span><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/pe_parse.html#IATEntry.remove_hook"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.pe_parse.IATEntry.remove_hook" title="Permalink to this definition"></a></dt>
<dd><p>Remove the hook on the entry</p>
</dd></dl>
<dl class="method">
<dt id="windows.pe_parse.IATEntry.set_hook">
<code class="descname">set_hook</code><span class="sig-paren">(</span><em>callback</em>, <em>types=None</em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/pe_parse.html#IATEntry.set_hook"><span class="viewcode-link">[source]</span></a><a class="headerlink" href="#windows.pe_parse.IATEntry.set_hook" title="Permalink to this definition"></a></dt>
<dd><p>Setup a hook on the entry and return it.
You MUST keep a reference to the hook while the hook is enabled.</p>
<table class="docutils field-list" frame="void" rules="none">
<col class="field-name" />
<col class="field-body" />
<tbody valign="top">
<tr class="field-odd field"><th class="field-name">Parameters:</th><td class="field-body"><strong>callback</strong> – <p>the hook</p>
<div class="admonition note">
<p class="first admonition-title">Note</p>
<p class="last">see <a class="reference internal" href="iat_hook.html#hook-protocol"><span class="std std-ref">Hook protocol</span></a></p>
</div>
</td>
</tr>
<tr class="field-even field"><th class="field-name">Return type:</th><td class="field-body"><a class="reference internal" href="iat_hook.html#windows.hooks.IATHook" title="windows.hooks.IATHook"><code class="xref py py-class docutils literal notranslate"><span class="pre">windows.hooks.IATHook</span></code></a></td>
</tr>
</tbody>
</table>
<div class="admonition warning">
<p class="first admonition-title">Warning</p>
<p class="last">This works only for PEFile with the current process as target.</p>
</div>
</dd></dl>
</dd></dl>
</div>
</div>
</div>
</div>
</div>
</div>
<div class="sphinxsidebar" role="navigation" aria-label="main navigation">
<div class="sphinxsidebarwrapper">
<h3><a href="index.html">Table Of Contents</a></h3>
<ul>
<li><a class="reference internal" href="#">2.1. Processes and Threads</a><ul>
<li><a class="reference internal" href="#currentprocess">2.1.1. CurrentProcess</a></li>
<li><a class="reference internal" href="#currentthread">2.1.2. CurrentThread</a></li>
<li><a class="reference internal" href="#winprocess">2.1.3. WinProcess</a></li>
<li><a class="reference internal" href="#winthread">2.1.4. WinThread</a></li>
</ul>
</li>
<li><a class="reference internal" href="#peb-exploration">2.2. PEB Exploration</a><ul>
<li><a class="reference internal" href="#peb">2.2.1. PEB</a></li>
<li><a class="reference internal" href="#loadedmodule">2.2.2. LoadedModule</a></li>
<li><a class="reference internal" href="#apisetmap">2.2.3. ApiSetMap</a></li>
</ul>
</li>
<li><a class="reference internal" href="#pefile-parsing-loaded-pe">2.3. PEFile - Parsing loaded PE</a><ul>
<li><a class="reference internal" href="#module-windows.pe_parse">2.3.1. <code class="docutils literal notranslate"><span class="pre">windows.pe_parse</span></code></a><ul>
<li><a class="reference internal" href="#pefile">2.3.1.1. PEFile</a></li>
<li><a class="reference internal" href="#iatentry">2.3.1.2. IATEntry</a></li>
</ul>
</li>
</ul>
</li>
</ul>
<h4>Previous topic</h4>
<p class="topless"><a href="winobject.html"
title="previous chapter">2. The <code class="docutils literal notranslate"><span class="pre">windows</span></code> objects</a></p>
<h4>Next topic</h4>
<p class="topless"><a href="token.html"
title="next chapter">2.4. Token</a></p>
<div role="note" aria-label="source link">
<h3>This Page</h3>
<ul class="this-page-menu">
<li><a href="_sources/process.rst.txt"
rel="nofollow">Show Source</a></li>
</ul>
</div>
<div id="searchbox" style="display: none" role="search">
<h3>Quick search</h3>
<div class="searchformwrapper">
<form class="search" action="search.html" method="get">
<input type="text" name="q" />
<input type="submit" value="Go" />
<input type="hidden" name="check_keywords" value="yes" />
<input type="hidden" name="area" value="default" />
</form>
</div>
</div>
<script type="text/javascript">$('#searchbox').show(0);</script>
</div>
</div>
<div class="clearer"></div>
</div>
<div class="related" role="navigation" aria-label="related navigation">
<h3>Navigation</h3>
<ul>
<li class="right" style="margin-right: 10px">
<a href="genindex.html" title="General Index"
>index</a></li>
<li class="right" >
<a href="py-modindex.html" title="Python Module Index"
>modules</a> |</li>
<li class="right" >
<a href="token.html" title="2.4. Token"
>next</a> |</li>
<li class="right" >
<a href="winobject.html" title="2. The windows objects"
>previous</a> |</li>
<li class="nav-item nav-item-0"><a href="index.html">PythonForWindows 0.5 documentation</a> &#187;</li>
<li class="nav-item nav-item-1"><a href="winobject.html" >2. The <code class="docutils literal notranslate"><span class="pre">windows</span></code> objects</a> &#187;</li>
</ul>
</div>
<div class="footer" role="contentinfo">
&#169; Copyright 2015, Clement Rouault.
Created using <a href="http://sphinx-doc.org/">Sphinx</a> 1.7.5.
</div>
</body>
</html>
Reference in New Issue View Git Blame Copy Permalink