admin/hakril-PythonForWindows
1
0
Fork 0
mirror of https://github.com/hakril/PythonForWindows synced 2026-06-08 14:31:45 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
f53cd00bc481224e4d2dc1d280d5e43206751e63
hakril-PythonForWindows/docs/build/html/_modules/windows/winobject/process.html
T
hakril f53cd00bc4 cosmetic changes to doc + generate html doc
2019-01-03 22:20:19 +01:00

1555 lines
219 KiB
HTML
Raw Blame History

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="X-UA-Compatible" content="IE=Edge" />
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>windows.winobject.process &#8212; PythonForWindows 0.5 documentation</title>
<link rel="stylesheet" href="../../../_static/classic.css" type="text/css" />
<link rel="stylesheet" href="../../../_static/pygments.css" type="text/css" />
<link rel="stylesheet" href="../../../_static/css/mbasic.css" type="text/css" />
<script type="text/javascript" id="documentation_options" data-url_root="../../../" src="../../../_static/documentation_options.js"></script>
<script type="text/javascript" src="../../../_static/jquery.js"></script>
<script type="text/javascript" src="../../../_static/underscore.js"></script>
<script type="text/javascript" src="../../../_static/doctools.js"></script>
<link rel="index" title="Index" href="../../../genindex.html" />
<link rel="search" title="Search" href="../../../search.html" />
</head><body>
<div class="related" role="navigation" aria-label="related navigation">
<h3>Navigation</h3>
<ul>
<li class="right" style="margin-right: 10px">
<a href="../../../genindex.html" title="General Index"
accesskey="I">index</a></li>
<li class="right" >
<a href="../../../py-modindex.html" title="Python Module Index"
>modules</a> |</li>
<li class="nav-item nav-item-0"><a href="../../../index.html">PythonForWindows 0.5 documentation</a> &#187;</li>
<li class="nav-item nav-item-1"><a href="../../index.html" accesskey="U">Module code</a> &#187;</li>
</ul>
</div>
<div class="document">
<div class="documentwrapper">
<div class="bodywrapper">
<div class="body" role="main">
<h1>Source code for windows.winobject.process</h1><div class="highlight"><pre>
<span></span><span class="kn">import</span> <span class="nn">sys</span>
<span class="kn">import</span> <span class="nn">ctypes</span>
<span class="kn">import</span> <span class="nn">os</span>
<span class="kn">import</span> <span class="nn">copy</span>
<span class="kn">import</span> <span class="nn">time</span>
<span class="kn">import</span> <span class="nn">struct</span>
<span class="kn">import</span> <span class="nn">itertools</span>
<span class="kn">from</span> <span class="nn">contextlib</span> <span class="k">import</span> <span class="n">contextmanager</span>
<span class="kn">from</span> <span class="nn">collections</span> <span class="k">import</span> <span class="n">namedtuple</span>
<span class="kn">import</span> <span class="nn">windows</span>
<span class="kn">import</span> <span class="nn">windows.native_exec.simple_x86</span> <span class="k">as</span> <span class="nn">x86</span>
<span class="kn">import</span> <span class="nn">windows.native_exec.simple_x64</span> <span class="k">as</span> <span class="nn">x64</span>
<span class="kn">import</span> <span class="nn">windows.remotectypes</span> <span class="k">as</span> <span class="nn">rctypes</span>
<span class="kn">import</span> <span class="nn">windows.generated_def</span> <span class="k">as</span> <span class="nn">gdef</span>
<span class="kn">from</span> <span class="nn">windows</span> <span class="k">import</span> <span class="n">injection</span>
<span class="kn">from</span> <span class="nn">windows</span> <span class="k">import</span> <span class="n">native_exec</span>
<span class="kn">from</span> <span class="nn">windows</span> <span class="k">import</span> <span class="n">pe_parse</span>
<span class="kn">from</span> <span class="nn">windows</span> <span class="k">import</span> <span class="n">winproxy</span>
<span class="kn">from</span> <span class="nn">windows</span> <span class="k">import</span> <span class="n">utils</span>
<span class="kn">from</span> <span class="nn">windows.dbgprint</span> <span class="k">import</span> <span class="n">dbgprint</span>
<span class="kn">from</span> <span class="nn">windows.generated_def.winstructs</span> <span class="k">import</span> <span class="o">*</span>
<span class="kn">from</span> <span class="nn">windows.generated_def.ntstatus</span> <span class="k">import</span> <span class="n">NtStatusException</span>
<span class="kn">from</span> <span class="nn">windows.winobject</span> <span class="k">import</span> <span class="n">exception</span>
<span class="kn">from</span> <span class="nn">windows.winobject</span> <span class="k">import</span> <span class="n">apisetmap</span>
<span class="kn">from</span> <span class="nn">windows.winobject</span> <span class="k">import</span> <span class="n">token</span>
<span class="n">TimeInfo</span> <span class="o">=</span> <span class="n">namedtuple</span><span class="p">(</span><span class="s2">&quot;TimeInfo&quot;</span><span class="p">,</span> <span class="p">[</span><span class="s2">&quot;creation&quot;</span><span class="p">,</span> <span class="s2">&quot;exit&quot;</span><span class="p">,</span> <span class="s2">&quot;kernel&quot;</span><span class="p">,</span> <span class="s2">&quot;user&quot;</span><span class="p">])</span>
<span class="sd">&quot;&quot;&quot;Time information about a process&quot;&quot;&quot;</span>
<div class="viewcode-block" id="DeadThread"><a class="viewcode-back" href="../../../process.html#windows.winobject.process.DeadThread">[docs]</a><span class="k">class</span> <span class="nc">DeadThread</span><span class="p">(</span><span class="n">utils</span><span class="o">.</span><span class="n">AutoHandle</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;An already dead thread (returned only by API returning a new thread if thread die before being returned)&quot;&quot;&quot;</span>
<span class="k">def</span> <span class="nf">__init__</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">handle</span><span class="p">,</span> <span class="n">tid</span><span class="o">=</span><span class="kc">None</span><span class="p">):</span>
<span class="k">if</span> <span class="n">tid</span> <span class="ow">is</span> <span class="kc">None</span><span class="p">:</span>
<span class="n">tid</span> <span class="o">=</span> <span class="n">WinThread</span><span class="o">.</span><span class="n">_get_thread_id</span><span class="p">(</span><span class="n">handle</span><span class="p">)</span>
<span class="bp">self</span><span class="o">.</span><span class="n">tid</span> <span class="o">=</span> <span class="n">tid</span>
<span class="c1"># set AutoHandle _handle</span>
<span class="bp">self</span><span class="o">.</span><span class="n">_handle</span> <span class="o">=</span> <span class="n">handle</span>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">is_exit</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;``True`` if the thread is terminated</span>
<span class="sd"> :type: :class:`bool`</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">exit_code</span> <span class="o">!=</span> <span class="n">STILL_ACTIVE</span>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">exit_code</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;The exit code of the thread : ``STILL_ACTIVE`` means the process is not dead</span>
<span class="sd"> :type: :class:`int`</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="n">res</span> <span class="o">=</span> <span class="n">DWORD</span><span class="p">()</span>
<span class="n">winproxy</span><span class="o">.</span><span class="n">GetExitCodeThread</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">byref</span><span class="p">(</span><span class="n">res</span><span class="p">))</span>
<span class="k">return</span> <span class="n">res</span><span class="o">.</span><span class="n">value</span></div>
<span class="k">class</span> <span class="nc">Process</span><span class="p">(</span><span class="n">utils</span><span class="o">.</span><span class="n">AutoHandle</span><span class="p">):</span>
<span class="nd">@utils</span><span class="o">.</span><span class="n">fixedpropety</span>
<span class="k">def</span> <span class="nf">is_wow_64</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;``True`` if the process is a SysWow64 process (32bit process on 64bits system).</span>
<span class="sd"> :type: :class:`bool`</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="c1"># return utils.is_wow_64(self.handle)</span>
<span class="k">return</span> <span class="n">utils</span><span class="o">.</span><span class="n">is_wow_64</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">limited_handle</span><span class="p">)</span>
<span class="nd">@utils</span><span class="o">.</span><span class="n">fixedpropety</span>
<span class="k">def</span> <span class="nf">bitness</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;The bitness of the process</span>
<span class="sd"> :returns: :class:`int` -- 32 or 64</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">system</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">32</span><span class="p">:</span>
<span class="k">return</span> <span class="mi">32</span>
<span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">is_wow_64</span><span class="p">:</span>
<span class="k">return</span> <span class="mi">32</span>
<span class="k">return</span> <span class="mi">64</span>
<span class="nd">@utils</span><span class="o">.</span><span class="n">fixedpropety</span>
<span class="k">def</span> <span class="nf">limited_handle</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">system</span><span class="o">.</span><span class="n">version</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span> <span class="o">&lt;=</span> <span class="mi">5</span><span class="p">:</span>
<span class="c1"># Windows XP | Serveur 2003</span>
<span class="k">return</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">OpenProcess</span><span class="p">(</span><span class="n">PROCESS_QUERY_INFORMATION</span><span class="p">,</span> <span class="n">dwProcessId</span><span class="o">=</span><span class="bp">self</span><span class="o">.</span><span class="n">pid</span><span class="p">)</span>
<span class="k">return</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">OpenProcess</span><span class="p">(</span><span class="n">PROCESS_QUERY_LIMITED_INFORMATION</span><span class="p">,</span> <span class="n">dwProcessId</span><span class="o">=</span><span class="bp">self</span><span class="o">.</span><span class="n">pid</span><span class="p">)</span>
<span class="nd">@utils</span><span class="o">.</span><span class="n">fixedpropety</span>
<span class="k">def</span> <span class="nf">ppid</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;Parent Process ID</span>
<span class="sd"> :type: :class:`int`</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">32</span> <span class="ow">and</span> <span class="bp">self</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">64</span><span class="p">:</span>
<span class="n">xtype</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">remotectypes</span><span class="o">.</span><span class="n">transform_type_to_remote64bits</span><span class="p">(</span><span class="n">PROCESS_BASIC_INFORMATION</span><span class="p">)</span>
<span class="c1"># Fuck-it &lt;3</span>
<span class="n">data</span> <span class="o">=</span> <span class="p">(</span><span class="n">ctypes</span><span class="o">.</span><span class="n">c_char</span> <span class="o">*</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">xtype</span><span class="p">))()</span>
<span class="n">windows</span><span class="o">.</span><span class="n">syswow64</span><span class="o">.</span><span class="n">NtQueryInformationProcess_32_to_64</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">ProcessInformation</span><span class="o">=</span><span class="n">data</span><span class="p">,</span> <span class="n">ProcessInformationLength</span><span class="o">=</span><span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">xtype</span><span class="p">))</span>
<span class="c1"># Map a remote64bits(PROCESS_BASIC_INFORMATION) at the address of &#39;data&#39;</span>
<span class="n">x</span> <span class="o">=</span> <span class="n">xtype</span><span class="p">(</span><span class="n">ctypes</span><span class="o">.</span><span class="n">addressof</span><span class="p">(</span><span class="n">data</span><span class="p">),</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="p">)</span>
<span class="k">else</span><span class="p">:</span>
<span class="n">information_type</span> <span class="o">=</span> <span class="mi">0</span>
<span class="n">x</span> <span class="o">=</span> <span class="n">PROCESS_BASIC_INFORMATION</span><span class="p">()</span>
<span class="n">winproxy</span><span class="o">.</span><span class="n">NtQueryInformationProcess</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">information_type</span><span class="p">,</span> <span class="n">x</span><span class="p">)</span>
<span class="k">return</span> <span class="n">x</span><span class="o">.</span><span class="n">InheritedFromUniqueProcessId</span>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">threads</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;The threads of the process</span>
<span class="sd"> :type: [:class:`WinThread`] -- A list of Thread</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="n">owner_pid</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">pid</span>
<span class="k">return</span> <span class="p">[</span><span class="n">WinThread</span><span class="o">.</span><span class="n">_from_THREADENTRY32</span><span class="p">(</span><span class="n">th</span><span class="p">,</span> <span class="n">owner</span><span class="o">=</span><span class="bp">self</span><span class="p">)</span> <span class="k">for</span> <span class="n">th</span> <span class="ow">in</span> <span class="n">windows</span><span class="o">.</span><span class="n">system</span><span class="o">.</span><span class="n">enumerate_threads_generator</span><span class="p">()</span> <span class="k">if</span> <span class="n">th</span><span class="o">.</span><span class="n">th32OwnerProcessID</span> <span class="o">==</span> <span class="n">owner_pid</span><span class="p">]</span>
<span class="k">def</span> <span class="nf">virtual_alloc</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">size</span><span class="p">):</span>
<span class="k">raise</span> <span class="ne">NotImplementedError</span><span class="p">(</span><span class="s2">&quot;virtual_alloc&quot;</span><span class="p">)</span>
<span class="k">def</span> <span class="nf">virtual_free</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="k">raise</span> <span class="ne">NotImplementedError</span><span class="p">(</span><span class="s2">&quot;virtual_free&quot;</span><span class="p">)</span>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">exit_code</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;The exit code of the process : ``STILL_ACTIVE`` means the process is not dead</span>
<span class="sd"> :type: :class:`int`</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="n">res</span> <span class="o">=</span> <span class="n">DWORD</span><span class="p">()</span>
<span class="n">winproxy</span><span class="o">.</span><span class="n">GetExitCodeProcess</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">byref</span><span class="p">(</span><span class="n">res</span><span class="p">))</span>
<span class="k">return</span> <span class="n">res</span><span class="o">.</span><span class="n">value</span>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">is_exit</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;``True`` if the process is terminated</span>
<span class="sd"> :type: :class:`bool`</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">exit_code</span> <span class="o">!=</span> <span class="n">STILL_ACTIVE</span>
<span class="nd">@contextmanager</span>
<span class="k">def</span> <span class="nf">allocated_memory</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">size</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;ContextManager to allocate memory and free it</span>
<span class="sd"> :type: :class:`int` -- the address of the allocated memory</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="n">addr</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">virtual_alloc</span><span class="p">(</span><span class="n">size</span><span class="p">)</span>
<span class="k">try</span><span class="p">:</span>
<span class="k">yield</span> <span class="n">addr</span>
<span class="k">finally</span><span class="p">:</span>
<span class="n">winproxy</span><span class="o">.</span><span class="n">VirtualFreeEx</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">addr</span><span class="p">)</span>
<span class="nd">@contextmanager</span>
<span class="k">def</span> <span class="nf">virtual_protected</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">addr</span><span class="p">,</span> <span class="n">size</span><span class="p">,</span> <span class="n">protect</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;A context manager for local virtual_protect (old Protection are restored at exit)&quot;&quot;&quot;</span>
<span class="n">old_protect</span> <span class="o">=</span> <span class="n">DWORD</span><span class="p">()</span>
<span class="bp">self</span><span class="o">.</span><span class="n">virtual_protect</span><span class="p">(</span><span class="n">addr</span><span class="p">,</span> <span class="n">size</span><span class="p">,</span> <span class="n">protect</span><span class="p">,</span> <span class="n">old_protect</span><span class="p">)</span>
<span class="k">try</span><span class="p">:</span>
<span class="k">yield</span> <span class="n">addr</span>
<span class="k">finally</span><span class="p">:</span>
<span class="bp">self</span><span class="o">.</span><span class="n">virtual_protect</span><span class="p">(</span><span class="n">addr</span><span class="p">,</span> <span class="n">size</span><span class="p">,</span> <span class="n">old_protect</span><span class="o">.</span><span class="n">value</span><span class="p">,</span> <span class="n">old_protect</span><span class="p">)</span>
<span class="k">def</span> <span class="nf">virtual_protect</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">addr</span><span class="p">,</span> <span class="n">size</span><span class="p">,</span> <span class="n">protect</span><span class="p">,</span> <span class="n">old_protect</span><span class="o">=</span><span class="kc">None</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;Change the access right of one or more page of the process&quot;&quot;&quot;</span>
<span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">32</span> <span class="ow">and</span> <span class="bp">self</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">64</span><span class="p">:</span>
<span class="k">if</span> <span class="n">size</span> <span class="o">&amp;</span> <span class="mh">0x0fff</span><span class="p">:</span>
<span class="n">size</span> <span class="o">=</span> <span class="p">((</span><span class="n">size</span> <span class="o">&gt;&gt;</span> <span class="mi">12</span><span class="p">)</span> <span class="o">+</span> <span class="mi">1</span><span class="p">)</span> <span class="o">&lt;&lt;</span> <span class="mi">12</span>
<span class="k">if</span> <span class="n">old_protect</span> <span class="ow">is</span> <span class="kc">None</span><span class="p">:</span>
<span class="n">old_protect</span> <span class="o">=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">DWORD</span><span class="p">()</span>
<span class="n">xold_protect</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">addressof</span><span class="p">(</span><span class="n">old_protect</span><span class="p">)</span>
<span class="n">xaddr</span> <span class="o">=</span> <span class="n">ULONG64</span><span class="p">(</span><span class="n">addr</span><span class="p">)</span>
<span class="n">addr</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">addressof</span><span class="p">(</span><span class="n">xaddr</span><span class="p">)</span>
<span class="n">xsize</span> <span class="o">=</span> <span class="n">ULONG</span><span class="p">(</span><span class="n">size</span><span class="p">)</span>
<span class="n">size</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">addressof</span><span class="p">(</span><span class="n">xsize</span><span class="p">)</span>
<span class="k">return</span> <span class="n">windows</span><span class="o">.</span><span class="n">syswow64</span><span class="o">.</span><span class="n">NtProtectVirtualMemory_32_to_64</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">addr</span><span class="p">,</span> <span class="n">size</span><span class="p">,</span> <span class="n">protect</span><span class="p">,</span> <span class="n">xold_protect</span><span class="p">)</span>
<span class="k">else</span><span class="p">:</span>
<span class="n">winproxy</span><span class="o">.</span><span class="n">VirtualProtectEx</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">addr</span><span class="p">,</span> <span class="n">size</span><span class="p">,</span> <span class="n">protect</span><span class="p">,</span> <span class="n">old_protect</span><span class="p">)</span>
<span class="k">def</span> <span class="nf">execute</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">code</span><span class="p">,</span> <span class="n">parameter</span><span class="o">=</span><span class="mi">0</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;Execute some native code in the context of the process</span>
<span class="sd"> :return: The thread executing the code</span>
<span class="sd"> :rtype: :class:`WinThread` or :class:`DeadThread`</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="n">x</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">virtual_alloc</span><span class="p">(</span><span class="nb">len</span><span class="p">(</span><span class="n">code</span><span class="p">))</span> <span class="c1">#Todo: free this ? when ? how ? reuse ?</span>
<span class="bp">self</span><span class="o">.</span><span class="n">write_memory</span><span class="p">(</span><span class="n">x</span><span class="p">,</span> <span class="n">code</span><span class="p">)</span>
<span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">create_thread</span><span class="p">(</span><span class="n">x</span><span class="p">,</span> <span class="n">parameter</span><span class="p">)</span>
<span class="k">def</span> <span class="nf">query_memory</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">addr</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;Query the memory informations about page at ``addr``</span>
<span class="sd"> :rtype: :class:`~windows.generated_def.winstructs.MEMORY_BASIC_INFORMATION`</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">32</span> <span class="ow">and</span> <span class="bp">self</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">64</span><span class="p">:</span>
<span class="n">res</span> <span class="o">=</span> <span class="n">MEMORY_BASIC_INFORMATION64</span><span class="p">()</span>
<span class="k">try</span><span class="p">:</span>
<span class="n">v</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">syswow64</span><span class="o">.</span><span class="n">NtQueryVirtualMemory_32_to_64</span><span class="p">(</span><span class="n">ProcessHandle</span><span class="o">=</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">BaseAddress</span><span class="o">=</span><span class="n">addr</span><span class="p">,</span> <span class="n">MemoryInformationClass</span><span class="o">=</span><span class="n">MemoryBasicInformation</span><span class="p">,</span> <span class="n">MemoryInformation</span><span class="o">=</span><span class="n">res</span><span class="p">)</span>
<span class="k">except</span> <span class="n">NtStatusException</span> <span class="k">as</span> <span class="n">e</span><span class="p">:</span>
<span class="k">if</span> <span class="n">e</span><span class="o">.</span><span class="n">code</span> <span class="o">&amp;</span> <span class="mh">0xffffffff</span> <span class="o">==</span> <span class="mh">0XC000000D</span><span class="p">:</span>
<span class="k">raise</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">WinproxyError</span><span class="p">(</span><span class="s2">&quot;NtQueryVirtualMemory_32_to_64&quot;</span><span class="p">)</span>
<span class="k">raise</span>
<span class="k">return</span> <span class="n">res</span>
<span class="n">info_type</span> <span class="o">=</span> <span class="p">{</span><span class="mi">32</span> <span class="p">:</span> <span class="n">MEMORY_BASIC_INFORMATION32</span><span class="p">,</span> <span class="mi">64</span> <span class="p">:</span> <span class="n">MEMORY_BASIC_INFORMATION64</span><span class="p">}</span>
<span class="n">res</span> <span class="o">=</span> <span class="n">info_type</span><span class="p">[</span><span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">bitness</span><span class="p">]()</span>
<span class="n">ptr</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">cast</span><span class="p">(</span><span class="n">byref</span><span class="p">(</span><span class="n">res</span><span class="p">),</span> <span class="n">POINTER</span><span class="p">(</span><span class="n">MEMORY_BASIC_INFORMATION</span><span class="p">))</span>
<span class="n">winproxy</span><span class="o">.</span><span class="n">VirtualQueryEx</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">addr</span><span class="p">,</span> <span class="n">ptr</span><span class="p">,</span> <span class="n">sizeof</span><span class="p">(</span><span class="n">res</span><span class="p">))</span>
<span class="k">return</span> <span class="n">res</span>
<span class="k">def</span> <span class="nf">memory_state</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;Yield the memory information for the whole address space of the process</span>
<span class="sd"> :yield: :class:`~windows.generated_def.winstructs.MEMORY_BASIC_INFORMATION`</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="n">addr</span> <span class="o">=</span> <span class="mi">0</span>
<span class="n">res</span> <span class="o">=</span> <span class="p">[]</span>
<span class="k">while</span> <span class="kc">True</span><span class="p">:</span>
<span class="k">try</span><span class="p">:</span>
<span class="n">x</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">query_memory</span><span class="p">(</span><span class="n">addr</span><span class="p">)</span>
<span class="k">yield</span> <span class="n">x</span>
<span class="k">except</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">WinproxyError</span><span class="p">:</span>
<span class="k">return</span>
<span class="n">addr</span> <span class="o">+=</span> <span class="n">x</span><span class="o">.</span><span class="n">RegionSize</span>
<span class="k">def</span> <span class="nf">query_working_set</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">64</span> <span class="ow">or</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">64</span><span class="p">:</span>
<span class="n">WSET_BLOCK</span> <span class="o">=</span> <span class="n">EPSAPI_WORKING_SET_BLOCK64</span>
<span class="n">dummy</span> <span class="o">=</span> <span class="n">PSAPI_WORKING_SET_INFORMATION64</span><span class="p">()</span>
<span class="k">else</span><span class="p">:</span>
<span class="n">WSET_BLOCK</span> <span class="o">=</span> <span class="n">EPSAPI_WORKING_SET_BLOCK32</span>
<span class="n">dummy</span> <span class="o">=</span> <span class="n">PSAPI_WORKING_SET_INFORMATION32</span><span class="p">()</span>
<span class="k">try</span><span class="p">:</span>
<span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">QueryWorkingSet</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">byref</span><span class="p">(</span><span class="n">dummy</span><span class="p">),</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">dummy</span><span class="p">))</span>
<span class="k">except</span> <span class="ne">WindowsError</span> <span class="k">as</span> <span class="n">e</span><span class="p">:</span>
<span class="k">if</span> <span class="n">e</span><span class="o">.</span><span class="n">winerror</span> <span class="o">!=</span> <span class="mi">24</span><span class="p">:</span>
<span class="k">raise</span>
<span class="n">NumberOfEntriesType</span> <span class="o">=</span> <span class="p">[</span><span class="n">f</span> <span class="k">for</span> <span class="n">f</span> <span class="ow">in</span> <span class="n">WSET_BLOCK</span><span class="o">.</span><span class="n">_fields_</span> <span class="k">if</span> <span class="n">f</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span> <span class="o">==</span> <span class="s2">&quot;Flags&quot;</span><span class="p">][</span><span class="mi">0</span><span class="p">][</span><span class="mi">1</span><span class="p">]</span>
<span class="k">for</span> <span class="n">i</span> <span class="ow">in</span> <span class="nb">range</span><span class="p">(</span><span class="mi">10</span><span class="p">):</span>
<span class="c1"># use the same type as WSET_BLOCK.Flags</span>
<span class="k">class</span> <span class="nc">GENERATED_PSAPI_WORKING_SET_INFORMATION</span><span class="p">(</span><span class="n">ctypes</span><span class="o">.</span><span class="n">Structure</span><span class="p">):</span>
<span class="n">_fields_</span> <span class="o">=</span> <span class="p">[</span>
<span class="p">(</span><span class="s2">&quot;NumberOfEntries&quot;</span><span class="p">,</span> <span class="n">NumberOfEntriesType</span><span class="p">),</span>
<span class="p">(</span><span class="s2">&quot;WorkingSetInfo&quot;</span><span class="p">,</span> <span class="n">WSET_BLOCK</span> <span class="o">*</span> <span class="n">dummy</span><span class="o">.</span><span class="n">NumberOfEntries</span><span class="p">),</span>
<span class="p">]</span>
<span class="n">res</span> <span class="o">=</span> <span class="n">GENERATED_PSAPI_WORKING_SET_INFORMATION</span><span class="p">()</span>
<span class="k">try</span><span class="p">:</span>
<span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">32</span> <span class="ow">and</span> <span class="bp">self</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">64</span><span class="p">:</span>
<span class="n">windows</span><span class="o">.</span><span class="n">syswow64</span><span class="o">.</span><span class="n">NtQueryVirtualMemory_32_to_64</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="mi">0</span><span class="p">,</span> <span class="n">MemoryWorkingSetList</span><span class="p">,</span> <span class="n">res</span><span class="p">)</span>
<span class="k">else</span><span class="p">:</span>
<span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">QueryWorkingSet</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">byref</span><span class="p">(</span><span class="n">res</span><span class="p">),</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">res</span><span class="p">))</span>
<span class="k">except</span> <span class="ne">WindowsError</span> <span class="k">as</span> <span class="n">e</span><span class="p">:</span>
<span class="k">if</span> <span class="n">e</span><span class="o">.</span><span class="n">winerror</span> <span class="o">!=</span> <span class="mi">24</span><span class="p">:</span>
<span class="k">raise</span>
<span class="n">dummy</span><span class="o">.</span><span class="n">NumberOfEntries</span> <span class="o">=</span> <span class="n">res</span><span class="o">.</span><span class="n">NumberOfEntries</span>
<span class="k">continue</span>
<span class="k">except</span> <span class="n">windows</span><span class="o">.</span><span class="n">generated_def</span><span class="o">.</span><span class="n">ntstatus</span><span class="o">.</span><span class="n">NtStatusException</span> <span class="k">as</span> <span class="n">e</span><span class="p">:</span>
<span class="k">if</span> <span class="n">e</span><span class="o">.</span><span class="n">code</span> <span class="o">!=</span> <span class="n">STATUS_INFO_LENGTH_MISMATCH</span><span class="p">:</span>
<span class="k">raise</span>
<span class="n">dummy</span><span class="o">.</span><span class="n">NumberOfEntries</span> <span class="o">=</span> <span class="n">res</span><span class="o">.</span><span class="n">NumberOfEntries</span>
<span class="k">continue</span>
<span class="k">return</span> <span class="n">res</span><span class="o">.</span><span class="n">WorkingSetInfo</span>
<span class="c1"># Raise ?</span>
<span class="k">return</span> <span class="kc">None</span>
<span class="k">def</span> <span class="nf">query_working_setex</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">addresses</span><span class="p">):</span>
<span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">64</span> <span class="ow">or</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">64</span><span class="p">:</span>
<span class="n">info_type</span> <span class="o">=</span> <span class="n">EPSAPI_WORKING_SET_EX_INFORMATION64</span>
<span class="k">else</span><span class="p">:</span>
<span class="n">info_type</span> <span class="o">=</span> <span class="n">EPSAPI_WORKING_SET_EX_INFORMATION32</span>
<span class="n">info_array</span> <span class="o">=</span> <span class="p">(</span><span class="n">info_type</span> <span class="o">*</span> <span class="nb">len</span><span class="p">(</span><span class="n">addresses</span><span class="p">))()</span>
<span class="k">for</span> <span class="n">i</span><span class="p">,</span> <span class="n">data</span> <span class="ow">in</span> <span class="nb">enumerate</span><span class="p">(</span><span class="n">info_array</span><span class="p">):</span>
<span class="n">info_array</span><span class="p">[</span><span class="n">i</span><span class="p">]</span><span class="o">.</span><span class="n">VirtualAddress</span> <span class="o">=</span> <span class="n">addresses</span><span class="p">[</span><span class="n">i</span><span class="p">]</span>
<span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">32</span> <span class="ow">and</span> <span class="bp">self</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">64</span><span class="p">:</span>
<span class="n">windows</span><span class="o">.</span><span class="n">syswow64</span><span class="o">.</span><span class="n">NtQueryVirtualMemory_32_to_64</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="mi">0</span><span class="p">,</span> <span class="n">MemoryWorkingSetListEx</span><span class="p">,</span> <span class="n">info_array</span><span class="p">)</span>
<span class="k">else</span><span class="p">:</span>
<span class="n">winproxy</span><span class="o">.</span><span class="n">QueryWorkingSetEx</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">byref</span><span class="p">(</span><span class="n">info_array</span><span class="p">),</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">info_array</span><span class="p">))</span>
<span class="k">return</span> <span class="n">info_array</span>
<span class="k">def</span> <span class="nf">get_mapped_filename</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">addr</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;The filename mapped at address ``addr`` or ``None``</span>
<span class="sd"> :rtype: :class:`unicode` or ``None``</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="n">buffer_size</span> <span class="o">=</span> <span class="mh">0x1000</span>
<span class="n">buffer</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">c_buffer</span><span class="p">(</span><span class="n">buffer_size</span><span class="p">)</span>
<span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">32</span> <span class="ow">and</span> <span class="bp">self</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">64</span><span class="p">:</span>
<span class="n">target_size</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">c_buffer</span><span class="p">(</span><span class="n">buffer_size</span><span class="p">)</span>
<span class="k">try</span><span class="p">:</span>
<span class="n">windows</span><span class="o">.</span><span class="n">syswow64</span><span class="o">.</span><span class="n">NtQueryVirtualMemory_32_to_64</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">addr</span><span class="p">,</span> <span class="n">MemorySectionName</span><span class="p">,</span> <span class="n">buffer</span><span class="p">,</span> <span class="n">buffer_size</span><span class="p">,</span> <span class="n">target_size</span><span class="p">)</span>
<span class="k">except</span> <span class="n">NtStatusException</span> <span class="k">as</span> <span class="n">e</span><span class="p">:</span>
<span class="k">if</span> <span class="n">e</span><span class="o">.</span><span class="n">code</span> <span class="ow">not</span> <span class="ow">in</span> <span class="p">(</span><span class="n">STATUS_FILE_INVALID</span><span class="p">,</span> <span class="n">STATUS_INVALID_ADDRESS</span><span class="p">):</span>
<span class="k">raise</span>
<span class="k">return</span> <span class="kc">None</span>
<span class="n">remote_winstring</span> <span class="o">=</span> <span class="n">rctypes</span><span class="o">.</span><span class="n">transform_type_to_remote64bits</span><span class="p">(</span><span class="n">gdef</span><span class="o">.</span><span class="n">LSA_UNICODE_STRING</span><span class="p">)</span>
<span class="n">mapped_filename</span> <span class="o">=</span> <span class="n">remote_winstring</span><span class="p">(</span><span class="n">ctypes</span><span class="o">.</span><span class="n">addressof</span><span class="p">(</span><span class="n">buffer</span><span class="p">),</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="p">)</span>
<span class="k">return</span> <span class="n">mapped_filename</span><span class="o">.</span><span class="n">str</span>
<span class="k">try</span><span class="p">:</span>
<span class="n">size</span> <span class="o">=</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">GetMappedFileNameW</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">addr</span><span class="p">,</span> <span class="n">buffer</span><span class="p">,</span> <span class="n">buffer_size</span><span class="p">)</span>
<span class="k">except</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">WinproxyError</span> <span class="k">as</span> <span class="n">e</span><span class="p">:</span>
<span class="k">if</span> <span class="n">e</span><span class="o">.</span><span class="n">winerror</span> <span class="ow">not</span> <span class="ow">in</span> <span class="p">(</span><span class="n">gdef</span><span class="o">.</span><span class="n">ERROR_UNEXP_NET_ERR</span><span class="p">,</span> <span class="n">gdef</span><span class="o">.</span><span class="n">ERROR_FILE_INVALID</span><span class="p">):</span>
<span class="k">raise</span> <span class="c1"># Raise if error type is not expected: detect mapped aborted transaction</span>
<span class="k">return</span> <span class="kc">None</span>
<span class="k">return</span> <span class="n">buffer</span><span class="p">[:</span> <span class="n">size</span> <span class="o">*</span> <span class="mi">2</span><span class="p">]</span><span class="o">.</span><span class="n">decode</span><span class="p">(</span><span class="s2">&quot;utf16&quot;</span><span class="p">)</span>
<span class="k">def</span> <span class="nf">read_byte</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">addr</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;Read a ``CHAR`` at ``addr``&quot;&quot;&quot;</span>
<span class="n">sizeof_char</span> <span class="o">=</span> <span class="n">sizeof</span><span class="p">(</span><span class="n">CHAR</span><span class="p">)</span>
<span class="k">return</span> <span class="n">struct</span><span class="o">.</span><span class="n">unpack</span><span class="p">(</span><span class="s2">&quot;&lt;B&quot;</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">read_memory</span><span class="p">(</span><span class="n">addr</span><span class="p">,</span> <span class="n">sizeof_char</span><span class="p">))[</span><span class="mi">0</span><span class="p">]</span>
<span class="k">def</span> <span class="nf">read_short</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">addr</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;Read a ``SHORT`` at ``addr``&quot;&quot;&quot;</span>
<span class="n">sizeof_short</span> <span class="o">=</span> <span class="n">sizeof</span><span class="p">(</span><span class="n">ctypes</span><span class="o">.</span><span class="n">c_short</span><span class="p">)</span>
<span class="k">return</span> <span class="n">struct</span><span class="o">.</span><span class="n">unpack</span><span class="p">(</span><span class="s2">&quot;&lt;H&quot;</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">read_memory</span><span class="p">(</span><span class="n">addr</span><span class="p">,</span> <span class="n">sizeof_short</span><span class="p">))[</span><span class="mi">0</span><span class="p">]</span>
<span class="k">def</span> <span class="nf">read_dword</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">addr</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;Read a ``DWORD`` at ``addr``&quot;&quot;&quot;</span>
<span class="n">sizeof_dword</span> <span class="o">=</span> <span class="n">sizeof</span><span class="p">(</span><span class="n">DWORD</span><span class="p">)</span>
<span class="k">return</span> <span class="n">struct</span><span class="o">.</span><span class="n">unpack</span><span class="p">(</span><span class="s2">&quot;&lt;I&quot;</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">read_memory</span><span class="p">(</span><span class="n">addr</span><span class="p">,</span> <span class="n">sizeof_dword</span><span class="p">))[</span><span class="mi">0</span><span class="p">]</span>
<span class="k">def</span> <span class="nf">read_qword</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">addr</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;Read a ``ULONG64`` at ``addr``&quot;&quot;&quot;</span>
<span class="n">sizeof_qword</span> <span class="o">=</span> <span class="n">sizeof</span><span class="p">(</span><span class="n">ULONG64</span><span class="p">)</span>
<span class="k">return</span> <span class="n">struct</span><span class="o">.</span><span class="n">unpack</span><span class="p">(</span><span class="s2">&quot;&lt;Q&quot;</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">read_memory</span><span class="p">(</span><span class="n">addr</span><span class="p">,</span> <span class="n">sizeof_qword</span><span class="p">))[</span><span class="mi">0</span><span class="p">]</span>
<span class="k">def</span> <span class="nf">read_ptr</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">addr</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;Read a ``PTR`` at ``addr``&quot;&quot;&quot;</span>
<span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">32</span><span class="p">:</span>
<span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">read_dword</span><span class="p">(</span><span class="n">addr</span><span class="p">)</span>
<span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">read_qword</span><span class="p">(</span><span class="n">addr</span><span class="p">)</span>
<span class="k">def</span> <span class="nf">read_string</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">addr</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;Read an ascii string at ``addr``&quot;&quot;&quot;</span>
<span class="n">res</span> <span class="o">=</span> <span class="p">[]</span>
<span class="n">read_size</span> <span class="o">=</span> <span class="mh">0x100</span>
<span class="n">readden</span> <span class="o">=</span> <span class="mi">0</span>
<span class="k">for</span> <span class="n">i</span> <span class="ow">in</span> <span class="n">itertools</span><span class="o">.</span><span class="n">count</span><span class="p">():</span>
<span class="k">try</span><span class="p">:</span>
<span class="n">x</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">read_memory</span><span class="p">(</span><span class="n">addr</span> <span class="o">+</span> <span class="n">readden</span><span class="p">,</span> <span class="n">read_size</span><span class="p">)</span>
<span class="k">except</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">WinproxyError</span> <span class="k">as</span> <span class="n">e</span><span class="p">:</span>
<span class="k">if</span> <span class="n">read_size</span> <span class="o">==</span> <span class="mi">2</span><span class="p">:</span>
<span class="k">raise</span>
<span class="c1"># handle read_wstring at end of page</span>
<span class="c1"># Of read failed: read only the half of size</span>
<span class="c1"># read_size must remain a multiple of 2</span>
<span class="n">read_size</span> <span class="o">=</span> <span class="n">read_size</span> <span class="o">/</span> <span class="mi">2</span>
<span class="k">continue</span>
<span class="n">readden</span> <span class="o">+=</span> <span class="n">read_size</span>
<span class="k">if</span> <span class="s2">&quot;</span><span class="se">\x00</span><span class="s2">&quot;</span> <span class="ow">in</span> <span class="n">x</span><span class="p">:</span>
<span class="n">res</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">x</span><span class="o">.</span><span class="n">split</span><span class="p">(</span><span class="s2">&quot;</span><span class="se">\x00</span><span class="s2">&quot;</span><span class="p">,</span> <span class="mi">1</span><span class="p">)[</span><span class="mi">0</span><span class="p">])</span>
<span class="k">break</span>
<span class="n">res</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">x</span><span class="p">)</span>
<span class="k">return</span> <span class="s2">&quot;&quot;</span><span class="o">.</span><span class="n">join</span><span class="p">(</span><span class="n">res</span><span class="p">)</span>
<span class="k">def</span> <span class="nf">read_wstring</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">addr</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;Read a windows UTF16 string at ``addr``&quot;&quot;&quot;</span>
<span class="n">res</span> <span class="o">=</span> <span class="p">[]</span>
<span class="n">read_size</span> <span class="o">=</span> <span class="mh">0x100</span>
<span class="n">readden</span> <span class="o">=</span> <span class="mi">0</span>
<span class="c1"># I am trying to do something smart here..</span>
<span class="k">while</span> <span class="kc">True</span><span class="p">:</span>
<span class="k">try</span><span class="p">:</span>
<span class="n">x</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">read_memory</span><span class="p">(</span><span class="n">addr</span> <span class="o">+</span> <span class="n">readden</span><span class="p">,</span> <span class="n">read_size</span><span class="p">)</span>
<span class="k">except</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">WinproxyError</span> <span class="k">as</span> <span class="n">e</span><span class="p">:</span>
<span class="k">if</span> <span class="n">read_size</span> <span class="o">==</span> <span class="mi">2</span><span class="p">:</span>
<span class="k">raise</span>
<span class="c1"># handle read_wstring at end of page</span>
<span class="c1"># Of read failed: read only the half of size</span>
<span class="c1"># read_size must remain a multiple of 2</span>
<span class="n">read_size</span> <span class="o">=</span> <span class="n">read_size</span> <span class="o">/</span> <span class="mi">2</span>
<span class="k">continue</span>
<span class="n">readden</span> <span class="o">+=</span> <span class="n">read_size</span>
<span class="n">utf16_chars</span> <span class="o">=</span> <span class="p">[</span><span class="s2">&quot;&quot;</span><span class="o">.</span><span class="n">join</span><span class="p">(</span><span class="n">c</span><span class="p">)</span> <span class="k">for</span> <span class="n">c</span> <span class="ow">in</span> <span class="nb">zip</span><span class="p">(</span><span class="o">*</span><span class="p">[</span><span class="nb">iter</span><span class="p">(</span><span class="n">x</span><span class="p">)]</span> <span class="o">*</span> <span class="mi">2</span><span class="p">)]</span>
<span class="k">if</span> <span class="s2">&quot;</span><span class="se">\x00\x00</span><span class="s2">&quot;</span> <span class="ow">in</span> <span class="n">utf16_chars</span><span class="p">:</span>
<span class="n">res</span><span class="o">.</span><span class="n">extend</span><span class="p">(</span><span class="n">utf16_chars</span><span class="p">[:</span><span class="n">utf16_chars</span><span class="o">.</span><span class="n">index</span><span class="p">(</span><span class="s2">&quot;</span><span class="se">\x00\x00</span><span class="s2">&quot;</span><span class="p">)])</span>
<span class="k">break</span>
<span class="n">res</span><span class="o">.</span><span class="n">extend</span><span class="p">(</span><span class="n">x</span><span class="p">)</span>
<span class="k">return</span> <span class="s2">&quot;&quot;</span><span class="o">.</span><span class="n">join</span><span class="p">(</span><span class="n">res</span><span class="p">)</span><span class="o">.</span><span class="n">decode</span><span class="p">(</span><span class="s1">&#39;utf16&#39;</span><span class="p">)</span>
<span class="k">def</span> <span class="nf">write_byte</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">addr</span><span class="p">,</span> <span class="n">byte</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;write a byte at ``addr``&quot;&quot;&quot;</span>
<span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">write_memory</span><span class="p">(</span><span class="n">addr</span><span class="p">,</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span><span class="s2">&quot;&lt;B&quot;</span><span class="p">,</span> <span class="n">byte</span><span class="p">))</span>
<span class="k">def</span> <span class="nf">write_short</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">addr</span><span class="p">,</span> <span class="n">word</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;write a word at ``addr``&quot;&quot;&quot;</span>
<span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">write_memory</span><span class="p">(</span><span class="n">addr</span><span class="p">,</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span><span class="s2">&quot;&lt;H&quot;</span><span class="p">,</span> <span class="n">word</span><span class="p">))</span>
<span class="k">def</span> <span class="nf">write_dword</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">addr</span><span class="p">,</span> <span class="n">dword</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;write a dword at ``addr``&quot;&quot;&quot;</span>
<span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">write_memory</span><span class="p">(</span><span class="n">addr</span><span class="p">,</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span><span class="s2">&quot;&lt;I&quot;</span><span class="p">,</span> <span class="n">dword</span><span class="p">))</span>
<span class="k">def</span> <span class="nf">write_qword</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">addr</span><span class="p">,</span> <span class="n">qword</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;write a qword at ``addr``&quot;&quot;&quot;</span>
<span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">write_memory</span><span class="p">(</span><span class="n">addr</span><span class="p">,</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span><span class="s2">&quot;&lt;Q&quot;</span><span class="p">,</span> <span class="n">qword</span><span class="p">))</span>
<span class="k">def</span> <span class="nf">write_ptr</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">addr</span><span class="p">,</span> <span class="n">value</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;Write a ``PTR`` at ``addr``&quot;&quot;&quot;</span>
<span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">32</span><span class="p">:</span>
<span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">write_dword</span><span class="p">(</span><span class="n">addr</span><span class="p">,</span> <span class="n">value</span><span class="p">)</span>
<span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">write_qword</span><span class="p">(</span><span class="n">addr</span><span class="p">,</span> <span class="n">value</span><span class="p">)</span>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">time_info</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;The time information of the process (creation, kernel/user time, exit time)</span>
<span class="sd"> :type: :class:`TimeInfo`&quot;&quot;&quot;</span>
<span class="n">CreationTime</span> <span class="o">=</span> <span class="n">FILETIME</span><span class="p">()</span>
<span class="n">ExitTime</span> <span class="o">=</span> <span class="n">FILETIME</span><span class="p">()</span>
<span class="n">KernelTime</span> <span class="o">=</span> <span class="n">FILETIME</span><span class="p">()</span>
<span class="n">UserTime</span> <span class="o">=</span> <span class="n">FILETIME</span><span class="p">()</span>
<span class="n">winproxy</span><span class="o">.</span><span class="n">GetProcessTimes</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">limited_handle</span><span class="p">,</span> <span class="n">CreationTime</span><span class="p">,</span> <span class="n">ExitTime</span><span class="p">,</span> <span class="n">KernelTime</span><span class="p">,</span> <span class="n">UserTime</span><span class="p">)</span>
<span class="n">creation</span> <span class="o">=</span> <span class="p">(</span><span class="n">CreationTime</span><span class="o">.</span><span class="n">dwHighDateTime</span> <span class="o">&lt;&lt;</span> <span class="mi">32</span><span class="p">)</span> <span class="o">+</span> <span class="n">CreationTime</span><span class="o">.</span><span class="n">dwLowDateTime</span>
<span class="n">exit</span> <span class="o">=</span> <span class="p">(</span><span class="n">ExitTime</span><span class="o">.</span><span class="n">dwHighDateTime</span> <span class="o">&lt;&lt;</span> <span class="mi">32</span><span class="p">)</span> <span class="o">+</span> <span class="n">ExitTime</span><span class="o">.</span><span class="n">dwLowDateTime</span>
<span class="n">kernel</span> <span class="o">=</span> <span class="p">(</span><span class="n">KernelTime</span><span class="o">.</span><span class="n">dwHighDateTime</span> <span class="o">&lt;&lt;</span> <span class="mi">32</span><span class="p">)</span> <span class="o">+</span> <span class="n">KernelTime</span><span class="o">.</span><span class="n">dwLowDateTime</span>
<span class="n">user</span> <span class="o">=</span> <span class="p">(</span><span class="n">UserTime</span><span class="o">.</span><span class="n">dwHighDateTime</span> <span class="o">&lt;&lt;</span> <span class="mi">32</span><span class="p">)</span> <span class="o">+</span> <span class="n">UserTime</span><span class="o">.</span><span class="n">dwLowDateTime</span>
<span class="k">return</span> <span class="n">TimeInfo</span><span class="p">(</span><span class="n">creation</span><span class="p">,</span> <span class="n">exit</span><span class="p">,</span> <span class="n">kernel</span><span class="p">,</span> <span class="n">user</span><span class="p">)</span>
<span class="n">PRIORITY_CLASS_MAPPER</span> <span class="o">=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">FlagMapper</span><span class="p">(</span>
<span class="n">ABOVE_NORMAL_PRIORITY_CLASS</span><span class="p">,</span>
<span class="n">BELOW_NORMAL_PRIORITY_CLASS</span><span class="p">,</span>
<span class="n">HIGH_PRIORITY_CLASS</span><span class="p">,</span>
<span class="n">IDLE_PRIORITY_CLASS</span><span class="p">,</span>
<span class="n">NORMAL_PRIORITY_CLASS</span><span class="p">,</span>
<span class="n">PROCESS_MODE_BACKGROUND_BEGIN</span><span class="p">,</span>
<span class="n">PROCESS_MODE_BACKGROUND_END</span><span class="p">,</span>
<span class="n">REALTIME_PRIORITY_CLASS</span><span class="p">)</span>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">memory_info</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="n">result</span> <span class="o">=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">PROCESS_MEMORY_COUNTERS_EX</span><span class="p">()</span>
<span class="n">result</span><span class="o">.</span><span class="n">cb</span> <span class="o">=</span> <span class="n">sizeof</span><span class="p">(</span><span class="n">gdef</span><span class="o">.</span><span class="n">PROCESS_MEMORY_COUNTERS_EX</span><span class="p">)</span>
<span class="n">cast_result</span> <span class="o">=</span> <span class="n">cast</span><span class="p">(</span><span class="n">pointer</span><span class="p">(</span><span class="n">result</span><span class="p">),</span> <span class="n">gdef</span><span class="o">.</span><span class="n">PPROCESS_MEMORY_COUNTERS</span><span class="p">)</span>
<span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">GetProcessMemoryInfo</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">limited_handle</span><span class="p">,</span> <span class="n">cast_result</span><span class="p">,</span> <span class="n">result</span><span class="o">.</span><span class="n">cb</span><span class="p">)</span>
<span class="k">return</span> <span class="n">result</span>
<span class="k">def</span> <span class="nf">query_info</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">information_class</span><span class="p">,</span> <span class="n">data</span><span class="o">=</span><span class="kc">None</span><span class="p">):</span>
<span class="n">winproxy</span><span class="o">.</span><span class="n">NtQueryInformationProcess</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">information_class</span><span class="p">,</span> <span class="n">byref</span><span class="p">(</span><span class="n">data</span><span class="p">),</span> <span class="n">sizeof</span><span class="p">(</span><span class="n">data</span><span class="p">))</span>
<span class="k">return</span> <span class="n">data</span>
<span class="k">def</span> <span class="nf">set_info</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">information_class</span><span class="p">,</span> <span class="n">data</span><span class="p">):</span>
<span class="n">winproxy</span><span class="o">.</span><span class="n">NtSetInformationProcess</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">information_class</span><span class="p">,</span> <span class="n">byref</span><span class="p">(</span><span class="n">data</span><span class="p">),</span> <span class="n">sizeof</span><span class="p">(</span><span class="n">data</span><span class="p">))</span>
<span class="k">def</span> <span class="nf">get_priority</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">PRIORITY_CLASS_MAPPER</span><span class="p">[</span><span class="n">winproxy</span><span class="o">.</span><span class="n">GetPriorityClass</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">)]</span>
<span class="k">def</span> <span class="nf">set_priority</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">priority</span><span class="p">):</span>
<span class="k">return</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">SetPriorityClass</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">priority</span><span class="p">)</span>
<span class="n">priority</span> <span class="o">=</span> <span class="nb">property</span><span class="p">(</span><span class="n">get_priority</span><span class="p">,</span> <span class="n">set_priority</span><span class="p">)</span>
<span class="sd">&quot;&quot;&quot;The priority of the process&quot;&quot;&quot;</span>
<span class="k">def</span> <span class="nf">open_token</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">flags</span><span class="o">=</span><span class="n">MAXIMUM_ALLOWED</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;Open the process Token</span>
<span class="sd"> :returns: :class:`~windows.winobject.token.Token`</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="n">token_handle</span> <span class="o">=</span> <span class="n">HANDLE</span><span class="p">()</span>
<span class="n">winproxy</span><span class="o">.</span><span class="n">OpenProcessToken</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">limited_handle</span><span class="p">,</span> <span class="n">flags</span><span class="p">,</span> <span class="n">byref</span><span class="p">(</span><span class="n">token_handle</span><span class="p">))</span>
<span class="k">return</span> <span class="n">token</span><span class="o">.</span><span class="n">Token</span><span class="p">(</span><span class="n">token_handle</span><span class="o">.</span><span class="n">value</span><span class="p">)</span>
<span class="n">token</span> <span class="o">=</span> <span class="nb">property</span><span class="p">(</span><span class="n">open_token</span><span class="p">,</span> <span class="n">doc</span><span class="o">=</span><span class="s2">&quot;The process :class:`~windows.winobject.token.Token`&quot;</span><span class="p">)</span>
<span class="k">def</span> <span class="nf">__del__</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="nb">super</span><span class="p">(</span><span class="n">Process</span><span class="p">,</span> <span class="bp">self</span><span class="p">)</span><span class="o">.</span><span class="fm">__del__</span><span class="p">()</span>
<span class="c1"># Same logic that AutoHandle.__del__ for Process.limited_handle</span>
<span class="c1"># Assert that Process inherit AutoHandle</span>
<span class="c1"># sys.path is not None -&gt; check if python shutdown</span>
<span class="k">if</span> <span class="n">sys</span><span class="o">.</span><span class="n">path</span> <span class="ow">is</span> <span class="ow">not</span> <span class="kc">None</span> <span class="ow">and</span> <span class="nb">hasattr</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="s2">&quot;_limited_handle&quot;</span><span class="p">)</span> <span class="ow">and</span> <span class="bp">self</span><span class="o">.</span><span class="n">_limited_handle</span><span class="p">:</span>
<span class="c1"># Prevent some bug where dbgprint might be None when __del__ is called in a closing process</span>
<span class="c1"># This line is bad -&gt; it reopens a handle closed by &#39;super(Process, self).__del__()&#39; ._.</span>
<span class="n">dbgprint</span><span class="p">(</span><span class="s2">&quot;Closing limited handle </span><span class="si">{0}</span><span class="s2"> for </span><span class="si">{1}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="nb">hex</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">_limited_handle</span><span class="p">),</span> <span class="bp">self</span><span class="p">),</span> <span class="s2">&quot;HANDLE&quot;</span><span class="p">)</span> <span class="k">if</span> <span class="n">dbgprint</span> <span class="ow">is</span> <span class="ow">not</span> <span class="kc">None</span> <span class="k">else</span> <span class="kc">None</span>
<span class="bp">self</span><span class="o">.</span><span class="n">_close_function</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">_limited_handle</span><span class="p">)</span>
<span class="k">class</span> <span class="nc">Thread</span><span class="p">(</span><span class="n">utils</span><span class="o">.</span><span class="n">AutoHandle</span><span class="p">):</span>
<span class="k">def</span> <span class="nf">open_token</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">flags</span><span class="o">=</span><span class="n">MAXIMUM_ALLOWED</span><span class="p">,</span> <span class="n">as_self</span><span class="o">=</span><span class="kc">False</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;Open the Thread token if any (Impersonation) else return None.</span>
<span class="sd"> ``as_self`` tells which security context should be used</span>
<span class="sd"> :returns: :class:`~windows.winobject.token.Token`</span>
<span class="sd"> .. note::</span>
<span class="sd"> see https://docs.microsoft.com/en-us/windows/desktop/api/processthreadsapi/nf-processthreadsapi-openthreadtoken</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="n">token_handle</span> <span class="o">=</span> <span class="n">HANDLE</span><span class="p">()</span>
<span class="k">try</span><span class="p">:</span>
<span class="n">winproxy</span><span class="o">.</span><span class="n">OpenThreadToken</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">flags</span><span class="p">,</span> <span class="n">as_self</span><span class="p">,</span> <span class="n">byref</span><span class="p">(</span><span class="n">token_handle</span><span class="p">))</span>
<span class="k">except</span> <span class="ne">WindowsError</span> <span class="k">as</span> <span class="n">e</span><span class="p">:</span>
<span class="k">if</span> <span class="n">e</span><span class="o">.</span><span class="n">winerror</span> <span class="o">==</span> <span class="n">gdef</span><span class="o">.</span><span class="n">ERROR_NO_TOKEN</span><span class="p">:</span>
<span class="c1"># No token to open: return None</span>
<span class="k">return</span> <span class="kc">None</span>
<span class="k">raise</span>
<span class="k">return</span> <span class="n">token</span><span class="o">.</span><span class="n">Token</span><span class="p">(</span><span class="n">token_handle</span><span class="o">.</span><span class="n">value</span><span class="p">)</span>
<span class="k">def</span> <span class="nf">set_token</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">token</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;Set the token for the thread (impersonation). Setting the token to None revert the impersonation&quot;&quot;&quot;</span>
<span class="n">thandle</span> <span class="o">=</span> <span class="nb">getattr</span><span class="p">(</span><span class="n">token</span><span class="p">,</span> <span class="s2">&quot;handle&quot;</span><span class="p">,</span> <span class="n">token</span><span class="p">)</span> <span class="c1"># Accept raw handle &amp; token object</span>
<span class="k">return</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">SetThreadToken</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">thandle</span><span class="p">)</span>
<span class="n">_TOKEN_PROPERTY_DOC</span> <span class="o">=</span> <span class="s2">&quot;&quot;&quot;The thread :class:`~windows.winobject.token.Token`</span>
<span class="s2"> :getter: :func:`open_token`</span>
<span class="s2"> :setter: :func:`set_token`</span>
<span class="s2"> &quot;&quot;&quot;</span>
<span class="n">token</span> <span class="o">=</span> <span class="nb">property</span><span class="p">(</span><span class="n">open_token</span><span class="p">,</span> <span class="n">set_token</span><span class="p">,</span> <span class="n">doc</span><span class="o">=</span><span class="n">_TOKEN_PROPERTY_DOC</span><span class="p">)</span>
<div class="viewcode-block" id="CurrentThread"><a class="viewcode-back" href="../../../process.html#windows.winobject.process.CurrentThread">[docs]</a><span class="k">class</span> <span class="nc">CurrentThread</span><span class="p">(</span><span class="n">Thread</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;The current thread&quot;&quot;&quot;</span>
<span class="nd">@property</span> <span class="c1">#It&#39;s not a fixedpropety because executing thread might change</span>
<span class="k">def</span> <span class="nf">tid</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;Thread ID</span>
<span class="sd"> :type: :class:`int`</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="k">return</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">GetCurrentThreadId</span><span class="p">()</span>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">owner</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;The current process</span>
<span class="sd"> :type: :class:`CurrentProcess`</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="k">return</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span>
<span class="k">def</span> <span class="nf">_get_handle</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="k">return</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">GetCurrentThread</span><span class="p">()</span>
<span class="k">def</span> <span class="nf">__del__</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="k">pass</span>
<div class="viewcode-block" id="CurrentThread.exit"><a class="viewcode-back" href="../../../process.html#windows.winobject.process.CurrentThread.exit">[docs]</a> <span class="k">def</span> <span class="nf">exit</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">code</span><span class="o">=</span><span class="mi">0</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;Exit the thread&quot;&quot;&quot;</span>
<span class="k">return</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">ExitThread</span><span class="p">(</span><span class="n">code</span><span class="p">)</span></div>
<div class="viewcode-block" id="CurrentThread.wait"><a class="viewcode-back" href="../../../process.html#windows.winobject.process.CurrentThread.wait">[docs]</a> <span class="k">def</span> <span class="nf">wait</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">timeout</span><span class="o">=</span><span class="n">INFINITE</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;Raise :class:`ValueError` to prevent deadlock :D&quot;&quot;&quot;</span>
<span class="k">raise</span> <span class="ne">ValueError</span><span class="p">(</span><span class="s2">&quot;wait() on current thread&quot;</span><span class="p">)</span></div></div>
<div class="viewcode-block" id="CurrentProcess"><a class="viewcode-back" href="../../../process.html#windows.winobject.process.CurrentProcess">[docs]</a><span class="k">class</span> <span class="nc">CurrentProcess</span><span class="p">(</span><span class="n">Process</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;The current process&quot;&quot;&quot;</span>
<span class="n">get_peb</span> <span class="o">=</span> <span class="kc">None</span>
<span class="n">get_peb_32_code</span> <span class="o">=</span> <span class="n">x86</span><span class="o">.</span><span class="n">MultipleInstr</span><span class="p">()</span>
<span class="n">get_peb_32_code</span> <span class="o">+=</span> <span class="n">x86</span><span class="o">.</span><span class="n">Mov</span><span class="p">(</span><span class="s1">&#39;EAX&#39;</span><span class="p">,</span> <span class="n">x86</span><span class="o">.</span><span class="n">mem</span><span class="p">(</span><span class="s1">&#39;fs:[0x30]&#39;</span><span class="p">))</span>
<span class="n">get_peb_32_code</span> <span class="o">+=</span> <span class="n">x86</span><span class="o">.</span><span class="n">Ret</span><span class="p">()</span>
<span class="n">get_peb_32_code</span> <span class="o">=</span> <span class="n">get_peb_32_code</span><span class="o">.</span><span class="n">get_code</span><span class="p">()</span>
<span class="n">get_peb_64_code</span> <span class="o">=</span> <span class="n">x64</span><span class="o">.</span><span class="n">MultipleInstr</span><span class="p">()</span>
<span class="n">get_peb_64_code</span> <span class="o">+=</span> <span class="n">x64</span><span class="o">.</span><span class="n">Mov</span><span class="p">(</span><span class="s1">&#39;RAX&#39;</span><span class="p">,</span> <span class="n">x64</span><span class="o">.</span><span class="n">mem</span><span class="p">(</span><span class="s1">&#39;gs:[0x60]&#39;</span><span class="p">))</span>
<span class="n">get_peb_64_code</span> <span class="o">+=</span> <span class="n">x64</span><span class="o">.</span><span class="n">Ret</span><span class="p">()</span>
<span class="n">get_peb_64_code</span> <span class="o">=</span> <span class="n">get_peb_64_code</span><span class="o">.</span><span class="n">get_code</span><span class="p">()</span>
<span class="n">allocator</span> <span class="o">=</span> <span class="n">native_exec</span><span class="o">.</span><span class="n">native_function</span><span class="o">.</span><span class="n">allocator</span>
<span class="n">name</span> <span class="o">=</span> <span class="s2">&quot;CurrentProcess&quot;</span> <span class="c1"># Used by Winthread for __repr__</span>
<span class="c1"># Use RtlGetCurrentPeb ?</span>
<span class="k">def</span> <span class="nf">get_peb_builtin</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">get_peb</span> <span class="ow">is</span> <span class="ow">not</span> <span class="kc">None</span><span class="p">:</span>
<span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">get_peb</span>
<span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">32</span><span class="p">:</span>
<span class="n">get_peb</span> <span class="o">=</span> <span class="n">native_exec</span><span class="o">.</span><span class="n">create_function</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">get_peb_32_code</span><span class="p">,</span> <span class="p">[</span><span class="n">PVOID</span><span class="p">])</span>
<span class="k">else</span><span class="p">:</span>
<span class="n">get_peb</span> <span class="o">=</span> <span class="n">native_exec</span><span class="o">.</span><span class="n">create_function</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">get_peb_64_code</span><span class="p">,</span> <span class="p">[</span><span class="n">PVOID</span><span class="p">])</span>
<span class="bp">self</span><span class="o">.</span><span class="n">get_peb</span> <span class="o">=</span> <span class="n">get_peb</span>
<span class="k">return</span> <span class="n">get_peb</span>
<span class="k">def</span> <span class="nf">_get_handle</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="k">return</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">GetCurrentProcess</span><span class="p">()</span>
<span class="k">def</span> <span class="nf">__del__</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="k">pass</span>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">pid</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;Process ID</span>
<span class="sd"> :type: :class:`int`</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="k">return</span> <span class="n">os</span><span class="o">.</span><span class="n">getpid</span><span class="p">()</span>
<span class="nd">@utils</span><span class="o">.</span><span class="n">fixedpropety</span> <span class="c1"># leave it has fixed property as we don&#39;t care if CurrentProcess is never collected</span>
<span class="k">def</span> <span class="nf">peb</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;The Process Environment Block of the current process</span>
<span class="sd"> :type: :class:`PEB`</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="k">return</span> <span class="n">PEB</span><span class="o">.</span><span class="n">from_address</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">get_peb_builtin</span><span class="p">()())</span>
<span class="nd">@utils</span><span class="o">.</span><span class="n">fixedpropety</span>
<span class="k">def</span> <span class="nf">bitness</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;The bitness of the process</span>
<span class="sd"> :type: :class:`int` -- 32 or 64</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="kn">import</span> <span class="nn">platform</span>
<span class="n">bits</span> <span class="o">=</span> <span class="n">platform</span><span class="o">.</span><span class="n">architecture</span><span class="p">()[</span><span class="mi">0</span><span class="p">]</span>
<span class="k">return</span> <span class="nb">int</span><span class="p">(</span><span class="n">bits</span><span class="p">[:</span><span class="mi">2</span><span class="p">])</span>
<div class="viewcode-block" id="CurrentProcess.virtual_alloc"><a class="viewcode-back" href="../../../process.html#windows.winobject.process.CurrentProcess.virtual_alloc">[docs]</a> <span class="k">def</span> <span class="nf">virtual_alloc</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">size</span><span class="p">,</span> <span class="n">prot</span><span class="o">=</span><span class="n">PAGE_EXECUTE_READWRITE</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;Allocate memory in the process</span>
<span class="sd"> :return: The address of the allocated memory</span>
<span class="sd"> :rtype: :class:`int`</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="k">return</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">VirtualAlloc</span><span class="p">(</span><span class="n">dwSize</span><span class="o">=</span><span class="n">size</span><span class="p">,</span> <span class="n">flProtect</span><span class="o">=</span><span class="n">prot</span><span class="p">)</span></div>
<div class="viewcode-block" id="CurrentProcess.virtual_free"><a class="viewcode-back" href="../../../process.html#windows.winobject.process.CurrentProcess.virtual_free">[docs]</a> <span class="k">def</span> <span class="nf">virtual_free</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">addr</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;Free memory in the process by virtual_alloc&quot;&quot;&quot;</span>
<span class="k">return</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">VirtualFree</span><span class="p">(</span><span class="n">addr</span><span class="p">)</span></div>
<div class="viewcode-block" id="CurrentProcess.write_memory"><a class="viewcode-back" href="../../../process.html#windows.winobject.process.CurrentProcess.write_memory">[docs]</a> <span class="k">def</span> <span class="nf">write_memory</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">addr</span><span class="p">,</span> <span class="n">data</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;Write data at addr&quot;&quot;&quot;</span>
<span class="c1"># buffertype = (c_char * len(data)).from_address(addr)</span>
<span class="c1"># buffertype[:len(data)] = data</span>
<span class="n">ctypes</span><span class="o">.</span><span class="n">memmove</span><span class="p">(</span><span class="n">addr</span><span class="p">,</span> <span class="n">data</span><span class="p">,</span> <span class="nb">len</span><span class="p">(</span><span class="n">data</span><span class="p">))</span>
<span class="k">return</span> <span class="kc">True</span></div>
<div class="viewcode-block" id="CurrentProcess.read_memory"><a class="viewcode-back" href="../../../process.html#windows.winobject.process.CurrentProcess.read_memory">[docs]</a> <span class="k">def</span> <span class="nf">read_memory</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">addr</span><span class="p">,</span> <span class="n">size</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;Read ``size`` from ``addr``</span>
<span class="sd"> :return: The data read</span>
<span class="sd"> :rtype: :class:`str`</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="n">dbgprint</span><span class="p">(</span><span class="s1">&#39;Read CurrentProcess Memory&#39;</span><span class="p">,</span> <span class="s1">&#39;READMEM&#39;</span><span class="p">)</span>
<span class="n">buffer</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">c_buffer</span><span class="p">(</span><span class="n">size</span><span class="p">)</span>
<span class="n">ctypes</span><span class="o">.</span><span class="n">memmove</span><span class="p">(</span><span class="n">buffer</span><span class="p">,</span> <span class="n">addr</span><span class="p">,</span> <span class="n">size</span><span class="p">)</span>
<span class="k">return</span> <span class="n">buffer</span><span class="p">[:]</span></div>
<div class="viewcode-block" id="CurrentProcess.create_thread"><a class="viewcode-back" href="../../../process.html#windows.winobject.process.CurrentProcess.create_thread">[docs]</a> <span class="k">def</span> <span class="nf">create_thread</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">lpStartAddress</span><span class="p">,</span> <span class="n">lpParameter</span><span class="p">,</span> <span class="n">dwCreationFlags</span><span class="o">=</span><span class="mi">0</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;Create a new thread</span>
<span class="sd"> :rtype: :class:`WinThread` or :class:`DeadThread`</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="n">handle</span> <span class="o">=</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">CreateThread</span><span class="p">(</span><span class="n">lpStartAddress</span><span class="o">=</span><span class="n">lpStartAddress</span><span class="p">,</span> <span class="n">lpParameter</span><span class="o">=</span><span class="n">lpParameter</span><span class="p">,</span> <span class="n">dwCreationFlags</span><span class="o">=</span><span class="n">dwCreationFlags</span><span class="p">)</span>
<span class="k">return</span> <span class="n">WinThread</span><span class="o">.</span><span class="n">_from_handle</span><span class="p">(</span><span class="n">handle</span><span class="p">)</span></div>
<div class="viewcode-block" id="CurrentProcess.load_library"><a class="viewcode-back" href="../../../process.html#windows.winobject.process.CurrentProcess.load_library">[docs]</a> <span class="k">def</span> <span class="nf">load_library</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">dll_path</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;Load the library in current process</span>
<span class="sd"> :rtype: :class:`LoadedModule`</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="n">dllbase</span> <span class="o">=</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">LoadLibraryA</span><span class="p">(</span><span class="n">dll_path</span><span class="p">)</span>
<span class="k">return</span> <span class="p">[</span><span class="n">m</span> <span class="k">for</span> <span class="n">m</span> <span class="ow">in</span> <span class="bp">self</span><span class="o">.</span><span class="n">peb</span><span class="o">.</span><span class="n">modules</span> <span class="k">if</span> <span class="n">m</span><span class="o">.</span><span class="n">baseaddr</span> <span class="o">==</span> <span class="n">dllbase</span><span class="p">][</span><span class="mi">0</span><span class="p">]</span></div>
<div class="viewcode-block" id="CurrentProcess.execute"><a class="viewcode-back" href="../../../process.html#windows.winobject.process.CurrentProcess.execute">[docs]</a> <span class="k">def</span> <span class="nf">execute</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">code</span><span class="p">,</span> <span class="n">parameter</span><span class="o">=</span><span class="mi">0</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;Execute native code ``code`` in the current thread.</span>
<span class="sd"> :rtype: :class:`int` the return value of the native code&quot;&quot;&quot;</span>
<span class="n">f</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">native_exec</span><span class="o">.</span><span class="n">create_function</span><span class="p">(</span><span class="n">code</span><span class="p">,</span> <span class="p">[</span><span class="n">PVOID</span><span class="p">,</span> <span class="n">PVOID</span><span class="p">])</span>
<span class="k">return</span> <span class="n">f</span><span class="p">(</span><span class="n">parameter</span><span class="p">)</span></div>
<div class="viewcode-block" id="CurrentProcess.exit"><a class="viewcode-back" href="../../../process.html#windows.winobject.process.CurrentProcess.exit">[docs]</a> <span class="k">def</span> <span class="nf">exit</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">code</span><span class="o">=</span><span class="mi">0</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;Exit the process&quot;&quot;&quot;</span>
<span class="k">return</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">ExitProcess</span><span class="p">(</span><span class="n">code</span><span class="p">)</span></div>
<div class="viewcode-block" id="CurrentProcess.wait"><a class="viewcode-back" href="../../../process.html#windows.winobject.process.CurrentProcess.wait">[docs]</a> <span class="k">def</span> <span class="nf">wait</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">timeout</span><span class="o">=</span><span class="n">INFINITE</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;Raise :class:`ValueError` to prevent deadlock :D&quot;&quot;&quot;</span>
<span class="k">raise</span> <span class="ne">ValueError</span><span class="p">(</span><span class="s2">&quot;wait() on current thread&quot;</span><span class="p">)</span></div>
<span class="nd">@utils</span><span class="o">.</span><span class="n">fixedpropety</span>
<span class="k">def</span> <span class="nf">peb_syswow</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;The 64bits PEB of a SysWow64 process</span>
<span class="sd"> :type: :class:`PEB`</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="k">if</span> <span class="ow">not</span> <span class="bp">self</span><span class="o">.</span><span class="n">is_wow_64</span><span class="p">:</span>
<span class="k">raise</span> <span class="ne">ValueError</span><span class="p">(</span><span class="s2">&quot;Not a syswow process&quot;</span><span class="p">)</span>
<span class="k">return</span> <span class="n">windows</span><span class="o">.</span><span class="n">syswow64</span><span class="o">.</span><span class="n">get_current_process_syswow_peb</span><span class="p">()</span></div>
<span class="c1"># TODO: use ctypes.string_ad / ctypes.wstring_at for read_string / read_wstring ?</span>
<div class="viewcode-block" id="WinThread"><a class="viewcode-back" href="../../../process.html#windows.winobject.process.WinThread">[docs]</a><span class="k">class</span> <span class="nc">WinThread</span><span class="p">(</span><span class="n">Thread</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;Represent a thread &quot;&quot;&quot;</span>
<span class="k">def</span> <span class="nf">__init__</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">tid</span><span class="o">=</span><span class="kc">None</span><span class="p">,</span> <span class="n">handle</span><span class="o">=</span><span class="kc">None</span><span class="p">,</span> <span class="n">owner_pid</span><span class="o">=</span><span class="kc">None</span><span class="p">,</span> <span class="n">owner</span><span class="o">=</span><span class="kc">None</span><span class="p">):</span>
<span class="k">if</span> <span class="n">tid</span> <span class="ow">is</span> <span class="kc">None</span> <span class="ow">and</span> <span class="n">handle</span> <span class="ow">is</span> <span class="kc">None</span><span class="p">:</span>
<span class="k">raise</span> <span class="ne">ValueError</span><span class="p">(</span><span class="s2">&quot;Need at least &lt;pid&gt; or &lt;handle&gt; to create a </span><span class="si">{0}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="nb">type</span><span class="p">(</span><span class="bp">self</span><span class="p">)</span><span class="o">.</span><span class="vm">__name__</span><span class="p">))</span>
<span class="k">if</span> <span class="n">tid</span> <span class="ow">is</span> <span class="ow">not</span> <span class="kc">None</span><span class="p">:</span> <span class="bp">self</span><span class="o">.</span><span class="n">_tid</span> <span class="o">=</span> <span class="n">tid</span>
<span class="k">if</span> <span class="n">handle</span> <span class="ow">is</span> <span class="ow">not</span> <span class="kc">None</span><span class="p">:</span> <span class="bp">self</span><span class="o">.</span><span class="n">_handle</span> <span class="o">=</span> <span class="n">handle</span>
<span class="k">if</span> <span class="n">owner</span> <span class="ow">is</span> <span class="ow">not</span> <span class="kc">None</span><span class="p">:</span> <span class="bp">self</span><span class="o">.</span><span class="n">_owner</span> <span class="o">=</span> <span class="n">owner</span>
<span class="k">if</span> <span class="n">owner_pid</span> <span class="ow">is</span> <span class="ow">not</span> <span class="kc">None</span><span class="p">:</span> <span class="bp">self</span><span class="o">.</span><span class="n">_owner_pid</span> <span class="o">=</span> <span class="n">owner_pid</span>
<span class="k">if</span> <span class="n">owner_pid</span> <span class="ow">is</span> <span class="kc">None</span> <span class="ow">and</span> <span class="n">owner</span><span class="p">:</span>
<span class="bp">self</span><span class="o">.</span><span class="n">_owner_pid</span> <span class="o">=</span> <span class="n">owner</span><span class="o">.</span><span class="n">pid</span>
<span class="nd">@classmethod</span>
<span class="k">def</span> <span class="nf">_from_THREADENTRY32</span><span class="p">(</span><span class="bp">cls</span><span class="p">,</span> <span class="n">entry</span><span class="p">,</span> <span class="n">owner</span><span class="o">=</span><span class="kc">None</span><span class="p">):</span>
<span class="n">tid</span> <span class="o">=</span> <span class="n">entry</span><span class="o">.</span><span class="n">th32ThreadID</span>
<span class="n">owner_pid</span> <span class="o">=</span> <span class="n">entry</span><span class="o">.</span><span class="n">th32OwnerProcessID</span>
<span class="k">return</span> <span class="bp">cls</span><span class="p">(</span><span class="n">tid</span><span class="o">=</span><span class="n">tid</span><span class="p">,</span> <span class="n">owner_pid</span><span class="o">=</span><span class="n">owner_pid</span><span class="p">,</span> <span class="n">owner</span><span class="o">=</span><span class="n">owner</span><span class="p">)</span>
<span class="nd">@classmethod</span>
<span class="k">def</span> <span class="nf">_from_handle</span><span class="p">(</span><span class="bp">cls</span><span class="p">,</span> <span class="n">handle</span><span class="p">):</span>
<span class="c1"># Create a DeadThread if thread is already dead ?</span>
<span class="k">return</span> <span class="n">WinThread</span><span class="p">(</span><span class="n">handle</span><span class="o">=</span><span class="n">handle</span><span class="p">)</span>
<span class="nd">@utils</span><span class="o">.</span><span class="n">fixedpropety</span>
<span class="k">def</span> <span class="nf">tid</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;Thread ID</span>
<span class="sd"> :type: :class:`int`&quot;&quot;&quot;</span>
<span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">_get_thread_id</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">)</span>
<span class="nd">@utils</span><span class="o">.</span><span class="n">fixedpropety</span>
<span class="k">def</span> <span class="nf">owner_pid</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="n">res</span> <span class="o">=</span> <span class="n">THREAD_BASIC_INFORMATION</span><span class="p">()</span>
<span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">NtQueryInformationThread</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">ThreadBasicInformation</span><span class="p">,</span> <span class="n">byref</span><span class="p">(</span><span class="n">res</span><span class="p">),</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">res</span><span class="p">))</span>
<span class="n">owner_id</span> <span class="o">=</span> <span class="n">res</span><span class="o">.</span><span class="n">ClientId</span><span class="o">.</span><span class="n">UniqueProcess</span>
<span class="k">return</span> <span class="n">owner_id</span>
<span class="nd">@utils</span><span class="o">.</span><span class="n">fixedpropety</span>
<span class="k">def</span> <span class="nf">owner</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;The Process owning the thread</span>
<span class="sd"> :type: :class:`WinProcess`</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="k">return</span> <span class="n">WinProcess</span><span class="p">(</span><span class="n">pid</span><span class="o">=</span><span class="bp">self</span><span class="o">.</span><span class="n">owner_pid</span><span class="p">)</span>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">context</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;The context of the thread, type depend of the target process.</span>
<span class="sd"> :type: :class:`windows.exception.ECONTEXT32` or :class:`windows.exception.ECONTEXT64` or :class:`windows.exception.ECONTEXTWOW64`</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">owner</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">32</span> <span class="ow">and</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">64</span><span class="p">:</span>
<span class="c1"># Wow64</span>
<span class="n">x</span> <span class="o">=</span> <span class="n">exception</span><span class="o">.</span><span class="n">ECONTEXTWOW64</span><span class="p">()</span>
<span class="n">x</span><span class="o">.</span><span class="n">ContextFlags</span> <span class="o">=</span> <span class="n">CONTEXT_ALL</span>
<span class="n">winproxy</span><span class="o">.</span><span class="n">Wow64GetThreadContext</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">x</span><span class="p">)</span>
<span class="k">return</span> <span class="n">x</span>
<span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">owner</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">64</span> <span class="ow">and</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">32</span><span class="p">:</span>
<span class="n">x</span> <span class="o">=</span> <span class="n">exception</span><span class="o">.</span><span class="n">ECONTEXT64</span><span class="o">.</span><span class="n">new_aligned</span><span class="p">()</span>
<span class="n">x</span><span class="o">.</span><span class="n">ContextFlags</span> <span class="o">=</span> <span class="n">CONTEXT_ALL</span>
<span class="n">windows</span><span class="o">.</span><span class="n">syswow64</span><span class="o">.</span><span class="n">NtGetContextThread_32_to_64</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">x</span><span class="p">)</span>
<span class="k">return</span> <span class="n">x</span>
<span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">owner</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">32</span><span class="p">:</span>
<span class="n">x</span> <span class="o">=</span> <span class="n">exception</span><span class="o">.</span><span class="n">ECONTEXT32</span><span class="p">()</span>
<span class="k">else</span><span class="p">:</span>
<span class="n">x</span> <span class="o">=</span> <span class="n">exception</span><span class="o">.</span><span class="n">ECONTEXT64</span><span class="o">.</span><span class="n">new_aligned</span><span class="p">()</span>
<span class="n">x</span><span class="o">.</span><span class="n">ContextFlags</span> <span class="o">=</span> <span class="n">CONTEXT_ALL</span>
<span class="n">winproxy</span><span class="o">.</span><span class="n">GetThreadContext</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">x</span><span class="p">)</span>
<span class="k">return</span> <span class="n">x</span>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">context_syswow</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;The 64 bits context of a syswow thread.</span>
<span class="sd"> :type: :class:`windows.exception.ECONTEXT64`</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="k">if</span> <span class="ow">not</span> <span class="bp">self</span><span class="o">.</span><span class="n">owner</span><span class="o">.</span><span class="n">is_wow_64</span><span class="p">:</span>
<span class="k">raise</span> <span class="ne">ValueError</span><span class="p">(</span><span class="s2">&quot;Not a syswow process&quot;</span><span class="p">)</span>
<span class="n">x</span> <span class="o">=</span> <span class="n">exception</span><span class="o">.</span><span class="n">ECONTEXT64</span><span class="o">.</span><span class="n">new_aligned</span><span class="p">()</span>
<span class="n">x</span><span class="o">.</span><span class="n">ContextFlags</span> <span class="o">=</span> <span class="n">CONTEXT_ALL</span>
<span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">64</span><span class="p">:</span>
<span class="n">winproxy</span><span class="o">.</span><span class="n">GetThreadContext</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">x</span><span class="p">)</span>
<span class="k">else</span><span class="p">:</span>
<span class="n">windows</span><span class="o">.</span><span class="n">syswow64</span><span class="o">.</span><span class="n">NtGetContextThread_32_to_64</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">x</span><span class="p">)</span>
<span class="k">return</span> <span class="n">x</span>
<div class="viewcode-block" id="WinThread.set_context"><a class="viewcode-back" href="../../../process.html#windows.winobject.process.WinThread.set_context">[docs]</a> <span class="k">def</span> <span class="nf">set_context</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">context</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;Set the thread&#39;s context to ``context``&quot;&quot;&quot;</span>
<span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">owner</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">bitness</span><span class="p">:</span>
<span class="k">return</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">SetThreadContext</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">context</span><span class="p">)</span>
<span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">64</span> <span class="ow">and</span> <span class="bp">self</span><span class="o">.</span><span class="n">owner</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">32</span><span class="p">:</span>
<span class="k">return</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">Wow64SetThreadContext</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">context</span><span class="p">)</span>
<span class="k">return</span> <span class="n">windows</span><span class="o">.</span><span class="n">syswow64</span><span class="o">.</span><span class="n">NtSetContextThread_32_to_64</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">byref</span><span class="p">(</span><span class="n">context</span><span class="p">))</span></div>
<div class="viewcode-block" id="WinThread.set_syswow_context"><a class="viewcode-back" href="../../../process.html#windows.winobject.process.WinThread.set_syswow_context">[docs]</a> <span class="k">def</span> <span class="nf">set_syswow_context</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">context</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;Set a syswow thread&#39;s 64 context to ``context``&quot;&quot;&quot;</span>
<span class="k">if</span> <span class="ow">not</span> <span class="bp">self</span><span class="o">.</span><span class="n">owner</span><span class="o">.</span><span class="n">is_wow_64</span><span class="p">:</span>
<span class="k">raise</span> <span class="ne">ValueError</span><span class="p">(</span><span class="s2">&quot;Not a syswow process&quot;</span><span class="p">)</span>
<span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">64</span><span class="p">:</span>
<span class="k">return</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">SetThreadContext</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">context</span><span class="p">)</span>
<span class="k">return</span> <span class="n">windows</span><span class="o">.</span><span class="n">syswow64</span><span class="o">.</span><span class="n">NtSetContextThread_32_to_64</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">byref</span><span class="p">(</span><span class="n">context</span><span class="p">))</span></div>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">start_address</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;The start address of the thread</span>
<span class="sd"> :type: :class:`int`</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">32</span> <span class="ow">and</span> <span class="bp">self</span><span class="o">.</span><span class="n">owner</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">64</span><span class="p">:</span>
<span class="n">res</span> <span class="o">=</span> <span class="n">ULONGLONG</span><span class="p">()</span>
<span class="n">windows</span><span class="o">.</span><span class="n">syswow64</span><span class="o">.</span><span class="n">NtQueryInformationThread_32_to_64</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">ThreadQuerySetWin32StartAddress</span><span class="p">,</span> <span class="n">byref</span><span class="p">(</span><span class="n">res</span><span class="p">),</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">res</span><span class="p">))</span>
<span class="k">return</span> <span class="n">res</span><span class="o">.</span><span class="n">value</span>
<span class="n">res_size</span> <span class="o">=</span> <span class="nb">max</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">owner</span><span class="o">.</span><span class="n">bitness</span><span class="p">,</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">bitness</span><span class="p">)</span>
<span class="k">if</span> <span class="n">res_size</span> <span class="o">==</span> <span class="mi">32</span><span class="p">:</span>
<span class="n">res</span> <span class="o">=</span> <span class="n">ULONG</span><span class="p">()</span>
<span class="k">else</span><span class="p">:</span>
<span class="n">res</span> <span class="o">=</span> <span class="n">ULONGLONG</span><span class="p">()</span>
<span class="n">winproxy</span><span class="o">.</span><span class="n">NtQueryInformationThread</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">ThreadQuerySetWin32StartAddress</span><span class="p">,</span> <span class="n">byref</span><span class="p">(</span><span class="n">res</span><span class="p">),</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">res</span><span class="p">))</span>
<span class="k">return</span> <span class="n">res</span><span class="o">.</span><span class="n">value</span>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">teb_base</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;The address of the thread&#39;s TEB</span>
<span class="sd"> :type: :class:`int`</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">32</span> <span class="ow">and</span> <span class="bp">self</span><span class="o">.</span><span class="n">owner</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">64</span><span class="p">:</span>
<span class="n">restype</span> <span class="o">=</span> <span class="n">rctypes</span><span class="o">.</span><span class="n">transform_type_to_remote64bits</span><span class="p">(</span><span class="n">THREAD_BASIC_INFORMATION</span><span class="p">)</span>
<span class="n">ressize</span> <span class="o">=</span> <span class="p">(</span><span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">restype</span><span class="p">))</span>
<span class="c1"># Manual aligned allocation :DDDD</span>
<span class="n">nb_qword</span> <span class="o">=</span> <span class="p">(</span><span class="n">ressize</span> <span class="o">+</span> <span class="mi">8</span><span class="p">)</span> <span class="o">/</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">ULONGLONG</span><span class="p">)</span>
<span class="n">buffer</span> <span class="o">=</span> <span class="p">(</span><span class="n">nb_qword</span> <span class="o">*</span> <span class="n">ULONGLONG</span><span class="p">)()</span>
<span class="n">struct_address</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">addressof</span><span class="p">(</span><span class="n">buffer</span><span class="p">)</span>
<span class="k">if</span> <span class="p">(</span><span class="n">struct_address</span> <span class="o">&amp;</span> <span class="mh">0xf</span><span class="p">)</span> <span class="ow">not</span> <span class="ow">in</span> <span class="p">[</span><span class="mi">0</span><span class="p">,</span> <span class="mi">8</span><span class="p">]:</span>
<span class="k">raise</span> <span class="ne">ValueError</span><span class="p">(</span><span class="s2">&quot;ULONGLONG array not aligned on 8&quot;</span><span class="p">)</span>
<span class="n">windows</span><span class="o">.</span><span class="n">syswow64</span><span class="o">.</span><span class="n">NtQueryInformationThread_32_to_64</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">ThreadBasicInformation</span><span class="p">,</span> <span class="n">struct_address</span><span class="p">,</span> <span class="n">ressize</span><span class="p">)</span>
<span class="k">return</span> <span class="n">restype</span><span class="p">(</span><span class="n">struct_address</span><span class="p">,</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="p">)</span><span class="o">.</span><span class="n">TebBaseAddress</span>
<span class="n">res</span> <span class="o">=</span> <span class="n">THREAD_BASIC_INFORMATION</span><span class="p">()</span>
<span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">NtQueryInformationThread</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">ThreadBasicInformation</span><span class="p">,</span> <span class="n">byref</span><span class="p">(</span><span class="n">res</span><span class="p">),</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">res</span><span class="p">))</span>
<span class="k">return</span> <span class="n">res</span><span class="o">.</span><span class="n">TebBaseAddress</span>
<div class="viewcode-block" id="WinThread.exit"><a class="viewcode-back" href="../../../process.html#windows.winobject.process.WinThread.exit">[docs]</a> <span class="k">def</span> <span class="nf">exit</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">code</span><span class="o">=</span><span class="mi">0</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;Exit the thread&quot;&quot;&quot;</span>
<span class="k">return</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">TerminateThread</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">code</span><span class="p">)</span></div>
<div class="viewcode-block" id="WinThread.resume"><a class="viewcode-back" href="../../../process.html#windows.winobject.process.WinThread.resume">[docs]</a> <span class="k">def</span> <span class="nf">resume</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;Resume the thread&quot;&quot;&quot;</span>
<span class="k">return</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">ResumeThread</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">)</span></div>
<div class="viewcode-block" id="WinThread.suspend"><a class="viewcode-back" href="../../../process.html#windows.winobject.process.WinThread.suspend">[docs]</a> <span class="k">def</span> <span class="nf">suspend</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;Suspend the thread&quot;&quot;&quot;</span>
<span class="k">return</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">SuspendThread</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">)</span></div>
<span class="k">def</span> <span class="nf">_get_handle</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="k">return</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">OpenThread</span><span class="p">(</span><span class="n">dwThreadId</span><span class="o">=</span><span class="bp">self</span><span class="o">.</span><span class="n">tid</span><span class="p">)</span>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">is_exit</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;``True`` if the thread is terminated</span>
<span class="sd"> :type: :class:`bool`</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">exit_code</span> <span class="o">!=</span> <span class="n">STILL_ACTIVE</span>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">exit_code</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;The exit code of the thread : ``STILL_ACTIVE`` means the process is not dead</span>
<span class="sd"> :type: :class:`int`</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="n">res</span> <span class="o">=</span> <span class="n">DWORD</span><span class="p">()</span>
<span class="n">winproxy</span><span class="o">.</span><span class="n">GetExitCodeThread</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">byref</span><span class="p">(</span><span class="n">res</span><span class="p">))</span>
<span class="k">return</span> <span class="n">res</span><span class="o">.</span><span class="n">value</span>
<span class="k">def</span> <span class="nf">__repr__</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="n">owner</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">owner</span>
<span class="k">if</span> <span class="n">owner</span> <span class="ow">is</span> <span class="kc">None</span><span class="p">:</span>
<span class="n">owner_name</span> <span class="o">=</span> <span class="s2">&quot;&lt;Dead process with pid </span><span class="si">{0}</span><span class="s2">&gt;&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="nb">hex</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">th32OwnerProcessID</span><span class="p">))</span>
<span class="k">else</span><span class="p">:</span>
<span class="k">try</span><span class="p">:</span>
<span class="n">owner_name</span> <span class="o">=</span> <span class="n">owner</span><span class="o">.</span><span class="n">name</span>
<span class="k">except</span> <span class="ne">EnvironmentError</span><span class="p">:</span>
<span class="n">owner_name</span> <span class="o">=</span> <span class="s2">&quot;!cannot-retrieve-owner-name&quot;</span>
<span class="k">return</span> <span class="s1">&#39;&lt;</span><span class="si">{0}</span><span class="s1"> </span><span class="si">{1}</span><span class="s1"> owner &quot;</span><span class="si">{2}</span><span class="s1">&quot; at </span><span class="si">{3}</span><span class="s1">&gt;&#39;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="vm">__class__</span><span class="o">.</span><span class="vm">__name__</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">tid</span><span class="p">,</span> <span class="n">owner_name</span><span class="p">,</span> <span class="nb">hex</span><span class="p">(</span><span class="nb">id</span><span class="p">(</span><span class="bp">self</span><span class="p">)))</span>
<span class="nd">@staticmethod</span>
<span class="k">def</span> <span class="nf">_get_thread_id_by_api</span><span class="p">(</span><span class="n">handle</span><span class="p">):</span>
<span class="k">return</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">GetThreadId</span><span class="p">(</span><span class="n">handle</span><span class="p">)</span>
<span class="nd">@staticmethod</span>
<span class="k">def</span> <span class="nf">_get_thread_id_manual</span><span class="p">(</span><span class="n">handle</span><span class="p">):</span>
<span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">32</span> <span class="ow">and</span> <span class="bp">self</span><span class="o">.</span><span class="n">owner</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">64</span><span class="p">:</span>
<span class="k">raise</span> <span class="ne">NotImplementedError</span><span class="p">(</span><span class="s2">&quot;[_get_thread_id_manual] 32 -&gt; 64 (XP64 bits + Syswow process ?)&quot;</span><span class="p">)</span>
<span class="n">res</span> <span class="o">=</span> <span class="n">THREAD_BASIC_INFORMATION</span><span class="p">()</span>
<span class="n">windows</span><span class="o">.</span><span class="n">winproxy</span><span class="o">.</span><span class="n">NtQueryInformationThread</span><span class="p">(</span><span class="n">handle</span><span class="p">,</span> <span class="n">ThreadBasicInformation</span><span class="p">,</span> <span class="n">byref</span><span class="p">(</span><span class="n">res</span><span class="p">),</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">res</span><span class="p">))</span>
<span class="n">id2</span> <span class="o">=</span> <span class="n">res</span><span class="o">.</span><span class="n">ClientId</span><span class="o">.</span><span class="n">UniqueThread</span>
<span class="k">return</span> <span class="n">id2</span>
<span class="k">if</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">is_implemented</span><span class="p">(</span><span class="n">winproxy</span><span class="o">.</span><span class="n">GetThreadId</span><span class="p">):</span>
<span class="n">_get_thread_id</span> <span class="o">=</span> <span class="n">_get_thread_id_by_api</span>
<span class="k">else</span><span class="p">:</span>
<span class="n">_get_thread_id</span> <span class="o">=</span> <span class="n">_get_thread_id_manual</span></div>
<div class="viewcode-block" id="WinProcess"><a class="viewcode-back" href="../../../process.html#windows.winobject.process.WinProcess">[docs]</a><span class="k">class</span> <span class="nc">WinProcess</span><span class="p">(</span><span class="n">Process</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;A Process on the system&quot;&quot;&quot;</span>
<span class="k">def</span> <span class="nf">__init__</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">pid</span><span class="o">=</span><span class="kc">None</span><span class="p">,</span> <span class="n">handle</span><span class="o">=</span><span class="kc">None</span><span class="p">,</span> <span class="n">name</span><span class="o">=</span><span class="kc">None</span><span class="p">,</span> <span class="n">ppid</span><span class="o">=</span><span class="kc">None</span><span class="p">):</span>
<span class="k">if</span> <span class="n">pid</span> <span class="ow">is</span> <span class="kc">None</span> <span class="ow">and</span> <span class="n">handle</span> <span class="ow">is</span> <span class="kc">None</span><span class="p">:</span>
<span class="k">raise</span> <span class="ne">ValueError</span><span class="p">(</span><span class="s2">&quot;Need at least &lt;pid&gt; or &lt;handle&gt; to create a </span><span class="si">{0}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="nb">type</span><span class="p">(</span><span class="bp">self</span><span class="p">)</span><span class="o">.</span><span class="vm">__name__</span><span class="p">))</span>
<span class="k">if</span> <span class="n">pid</span> <span class="ow">is</span> <span class="ow">not</span> <span class="kc">None</span><span class="p">:</span> <span class="bp">self</span><span class="o">.</span><span class="n">_pid</span> <span class="o">=</span> <span class="n">pid</span>
<span class="k">if</span> <span class="n">handle</span> <span class="ow">is</span> <span class="ow">not</span> <span class="kc">None</span><span class="p">:</span> <span class="bp">self</span><span class="o">.</span><span class="n">_handle</span> <span class="o">=</span> <span class="n">handle</span>
<span class="k">if</span> <span class="n">name</span> <span class="ow">is</span> <span class="ow">not</span> <span class="kc">None</span><span class="p">:</span> <span class="bp">self</span><span class="o">.</span><span class="n">_name</span> <span class="o">=</span> <span class="n">name</span>
<span class="k">if</span> <span class="n">ppid</span> <span class="ow">is</span> <span class="ow">not</span> <span class="kc">None</span><span class="p">:</span> <span class="bp">self</span><span class="o">.</span><span class="n">_ppid</span> <span class="o">=</span> <span class="n">ppid</span>
<span class="nd">@staticmethod</span>
<span class="k">def</span> <span class="nf">_from_handle</span><span class="p">(</span><span class="n">handle</span><span class="p">):</span>
<span class="c1">#pid = winproxy.GetProcessId(handle)</span>
<span class="c1">#proc = [p for p in windows.system.processes if p.pid == pid][0]</span>
<span class="c1">#proc._handle = handle</span>
<span class="c1">#dbgprint(&quot;Process {0} from handle {1}&quot;.format(proc, hex(handle)), &quot;HANDLE&quot;)</span>
<span class="k">return</span> <span class="n">WinProcess</span><span class="p">(</span><span class="n">handle</span><span class="o">=</span><span class="n">handle</span><span class="p">)</span>
<span class="nd">@classmethod</span>
<span class="k">def</span> <span class="nf">_from_PROCESSENTRY32</span><span class="p">(</span><span class="bp">cls</span><span class="p">,</span> <span class="n">entry</span><span class="p">):</span>
<span class="c1">#print(&quot;_from_PROCESSENTRY32&quot;)</span>
<span class="n">name</span> <span class="o">=</span> <span class="n">entry</span><span class="o">.</span><span class="n">szExeFile</span><span class="o">.</span><span class="n">decode</span><span class="p">()</span>
<span class="n">pid</span> <span class="o">=</span> <span class="n">entry</span><span class="o">.</span><span class="n">th32ProcessID</span>
<span class="n">ppid</span> <span class="o">=</span> <span class="n">entry</span><span class="o">.</span><span class="n">th32ParentProcessID</span>
<span class="k">return</span> <span class="bp">cls</span><span class="p">(</span><span class="n">pid</span><span class="o">=</span><span class="n">pid</span><span class="p">,</span> <span class="n">name</span><span class="o">=</span><span class="n">name</span><span class="p">,</span> <span class="n">ppid</span><span class="o">=</span><span class="n">ppid</span><span class="p">)</span>
<span class="nd">@utils</span><span class="o">.</span><span class="n">fixedpropety</span>
<span class="k">def</span> <span class="nf">name</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;Name of the process</span>
<span class="sd"> :type: :class:`str`</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="n">buffer</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">c_buffer</span><span class="p">(</span><span class="mh">0x1024</span><span class="p">)</span>
<span class="n">rsize</span> <span class="o">=</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">GetProcessImageFileNameA</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">limited_handle</span><span class="p">,</span> <span class="n">buffer</span><span class="p">)</span>
<span class="c1"># GetProcessImageFileNameA returns the fullpath</span>
<span class="k">return</span> <span class="n">buffer</span><span class="p">[:</span><span class="n">rsize</span><span class="p">]</span><span class="o">.</span><span class="n">decode</span><span class="p">()</span><span class="o">.</span><span class="n">split</span><span class="p">(</span><span class="s2">&quot;</span><span class="se">\\</span><span class="s2">&quot;</span><span class="p">)[</span><span class="o">-</span><span class="mi">1</span><span class="p">]</span>
<span class="nd">@utils</span><span class="o">.</span><span class="n">fixedpropety</span>
<span class="k">def</span> <span class="nf">pid</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;Process ID</span>
<span class="sd"> :type: :class:`int`</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="k">return</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">GetProcessId</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">)</span>
<span class="k">def</span> <span class="nf">_get_handle</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="k">return</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">OpenProcess</span><span class="p">(</span><span class="n">dwProcessId</span><span class="o">=</span><span class="bp">self</span><span class="o">.</span><span class="n">pid</span><span class="p">)</span>
<span class="k">def</span> <span class="nf">__repr__</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="k">try</span><span class="p">:</span>
<span class="n">exe_name</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">name</span>
<span class="k">except</span> <span class="ne">WindowsError</span> <span class="k">as</span> <span class="n">e</span><span class="p">:</span>
<span class="n">exe_name</span> <span class="o">=</span> <span class="s2">&quot;!cannot-retrieve-name&quot;</span>
<span class="k">try</span><span class="p">:</span>
<span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">is_exit</span><span class="p">:</span>
<span class="k">return</span> <span class="s1">&#39;&lt;</span><span class="si">{0}</span><span class="s1"> &quot;</span><span class="si">{1}</span><span class="s1">&quot; pid </span><span class="si">{2}</span><span class="s1"> (DEAD) at </span><span class="si">{3}</span><span class="s1">&gt;&#39;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="vm">__class__</span><span class="o">.</span><span class="vm">__name__</span><span class="p">,</span> <span class="n">exe_name</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">pid</span><span class="p">,</span> <span class="nb">hex</span><span class="p">(</span><span class="nb">id</span><span class="p">(</span><span class="bp">self</span><span class="p">)))</span>
<span class="k">except</span> <span class="ne">WindowsError</span><span class="p">:</span> <span class="c1"># Cannot open process</span>
<span class="k">pass</span>
<span class="k">return</span> <span class="s1">&#39;&lt;</span><span class="si">{0}</span><span class="s1"> &quot;</span><span class="si">{1}</span><span class="s1">&quot; pid </span><span class="si">{2}</span><span class="s1"> at </span><span class="si">{3}</span><span class="s1">&gt;&#39;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="vm">__class__</span><span class="o">.</span><span class="vm">__name__</span><span class="p">,</span> <span class="n">exe_name</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">pid</span><span class="p">,</span> <span class="nb">hex</span><span class="p">(</span><span class="nb">id</span><span class="p">(</span><span class="bp">self</span><span class="p">)))</span>
<div class="viewcode-block" id="WinProcess.virtual_alloc"><a class="viewcode-back" href="../../../process.html#windows.winobject.process.WinProcess.virtual_alloc">[docs]</a> <span class="k">def</span> <span class="nf">virtual_alloc</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">size</span><span class="p">,</span> <span class="n">prot</span><span class="o">=</span><span class="n">PAGE_EXECUTE_READWRITE</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;Allocate memory in the process</span>
<span class="sd"> :return: The address of the allocated memory</span>
<span class="sd"> :rtype: :class:`int`</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="k">return</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">VirtualAllocEx</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">dwSize</span><span class="o">=</span><span class="n">size</span><span class="p">,</span> <span class="n">flProtect</span><span class="o">=</span><span class="n">prot</span><span class="p">)</span></div>
<div class="viewcode-block" id="WinProcess.virtual_free"><a class="viewcode-back" href="../../../process.html#windows.winobject.process.WinProcess.virtual_free">[docs]</a> <span class="k">def</span> <span class="nf">virtual_free</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">addr</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;Free memory in the process by virtual_alloc&quot;&quot;&quot;</span>
<span class="k">return</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">VirtualFreeEx</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">addr</span><span class="p">)</span></div>
<div class="viewcode-block" id="WinProcess.write_memory"><a class="viewcode-back" href="../../../process.html#windows.winobject.process.WinProcess.write_memory">[docs]</a> <span class="k">def</span> <span class="nf">write_memory</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">addr</span><span class="p">,</span> <span class="n">data</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;Write `data` at `addr`&quot;&quot;&quot;</span>
<span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">32</span> <span class="ow">and</span> <span class="bp">self</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">64</span><span class="p">:</span>
<span class="k">if</span> <span class="ow">not</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">is_implemented</span><span class="p">(</span><span class="n">winproxy</span><span class="o">.</span><span class="n">NtWow64WriteVirtualMemory64</span><span class="p">):</span>
<span class="k">raise</span> <span class="ne">ValueError</span><span class="p">(</span><span class="s2">&quot;NtWow64WriteVirtualMemory64 non available in ntdll: cannot write into 64bits processus&quot;</span><span class="p">)</span>
<span class="k">return</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">NtWow64WriteVirtualMemory64</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">addr</span><span class="p">,</span> <span class="n">data</span><span class="p">,</span> <span class="nb">len</span><span class="p">(</span><span class="n">data</span><span class="p">))</span>
<span class="k">return</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">WriteProcessMemory</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">addr</span><span class="p">,</span> <span class="n">lpBuffer</span><span class="o">=</span><span class="n">data</span><span class="p">)</span></div>
<span class="k">def</span> <span class="nf">low_read_memory</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">addr</span><span class="p">,</span> <span class="n">buffer_addr</span><span class="p">,</span> <span class="n">size</span><span class="p">):</span>
<span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">32</span> <span class="ow">and</span> <span class="bp">self</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">64</span><span class="p">:</span>
<span class="c1"># OptionalExport can be None (see winproxy.py)</span>
<span class="k">if</span> <span class="ow">not</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">is_implemented</span><span class="p">(</span><span class="n">winproxy</span><span class="o">.</span><span class="n">NtWow64ReadVirtualMemory64</span><span class="p">):</span>
<span class="k">raise</span> <span class="ne">ValueError</span><span class="p">(</span><span class="s2">&quot;NtWow64ReadVirtualMemory64 non available in ntdll: cannot read into 64bits processus&quot;</span><span class="p">)</span>
<span class="k">return</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">NtWow64ReadVirtualMemory64</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">addr</span><span class="p">,</span> <span class="n">buffer_addr</span><span class="p">,</span> <span class="n">size</span><span class="p">)</span>
<span class="c1">#if self.is_wow_64 and addr &gt; 0xffffffff:</span>
<span class="c1"># return winproxy.NtWow64ReadVirtualMemory64(self.handle, addr, buffer_addr, size)</span>
<span class="k">return</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">ReadProcessMemory</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">addr</span><span class="p">,</span> <span class="n">lpBuffer</span><span class="o">=</span><span class="n">buffer_addr</span><span class="p">,</span> <span class="n">nSize</span><span class="o">=</span><span class="n">size</span><span class="p">)</span>
<div class="viewcode-block" id="WinProcess.read_memory"><a class="viewcode-back" href="../../../process.html#windows.winobject.process.WinProcess.read_memory">[docs]</a> <span class="k">def</span> <span class="nf">read_memory</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">addr</span><span class="p">,</span> <span class="n">size</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;Read ``size`` from ``addr``</span>
<span class="sd"> :return: The data read</span>
<span class="sd"> :rtype: :class:`str`</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="n">buffer</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">create_string_buffer</span><span class="p">(</span><span class="n">size</span><span class="p">)</span>
<span class="bp">self</span><span class="o">.</span><span class="n">low_read_memory</span><span class="p">(</span><span class="n">addr</span><span class="p">,</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">byref</span><span class="p">(</span><span class="n">buffer</span><span class="p">),</span> <span class="n">size</span><span class="p">)</span>
<span class="k">return</span> <span class="n">buffer</span><span class="p">[:]</span></div>
<span class="c1"># Simple cache test</span>
<span class="c1"># real_read = read_memory</span>
<span class="c1">#</span>
<span class="c1"># def read_memory(self, addr, size):</span>
<span class="c1"># &quot;&quot;&quot;Cached version for test&quot;&quot;&quot;</span>
<span class="c1"># dbgprint(&#39;Read remote Memory of {0}&#39;.format(self), &#39;READMEM&#39;)</span>
<span class="c1"># if not hasattr(self, &quot;_cache_cache&quot;):</span>
<span class="c1"># self._cache_cache = {}</span>
<span class="c1"># page_addr = addr &amp; 0xfffffffffffff000</span>
<span class="c1"># if page_addr in self._cache_cache:</span>
<span class="c1"># #print(&quot;CACHED Read on page {0}&quot;.format(hex(page_addr)))</span>
<span class="c1"># page_data = self._cache_cache[page_addr]</span>
<span class="c1"># return page_data[addr &amp; 0xfff: (addr &amp; 0xfff) + size]</span>
<span class="c1"># else:</span>
<span class="c1"># page_data = self.real_read(page_addr, 0x1000)</span>
<span class="c1"># self._cache_cache[page_addr] = page_data</span>
<span class="c1"># return page_data[addr &amp; 0xfff: (addr &amp; 0xfff) + size]</span>
<div class="viewcode-block" id="WinProcess.read_memory_into"><a class="viewcode-back" href="../../../process.html#windows.winobject.process.WinProcess.read_memory_into">[docs]</a> <span class="k">def</span> <span class="nf">read_memory_into</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">addr</span><span class="p">,</span> <span class="n">struct</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;Read a :mod:`ctypes` struct from `addr`</span>
<span class="sd"> :returns: struct</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="bp">self</span><span class="o">.</span><span class="n">low_read_memory</span><span class="p">(</span><span class="n">addr</span><span class="p">,</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">byref</span><span class="p">(</span><span class="n">struct</span><span class="p">),</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">struct</span><span class="p">))</span>
<span class="k">return</span> <span class="n">struct</span></div>
<div class="viewcode-block" id="WinProcess.create_thread"><a class="viewcode-back" href="../../../process.html#windows.winobject.process.WinProcess.create_thread">[docs]</a> <span class="k">def</span> <span class="nf">create_thread</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">addr</span><span class="p">,</span> <span class="n">param</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;Create a remote thread</span>
<span class="sd"> :rtype: :class:`WinThread` or :class:`DeadThread`</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">32</span> <span class="ow">and</span> <span class="bp">self</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">64</span><span class="p">:</span>
<span class="n">thread_handle</span> <span class="o">=</span> <span class="n">HANDLE</span><span class="p">()</span>
<span class="n">windows</span><span class="o">.</span><span class="n">syswow64</span><span class="o">.</span><span class="n">NtCreateThreadEx_32_to_64</span><span class="p">(</span><span class="n">ThreadHandle</span><span class="o">=</span><span class="n">byref</span><span class="p">(</span><span class="n">thread_handle</span><span class="p">)</span> <span class="p">,</span><span class="n">ProcessHandle</span><span class="o">=</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">lpStartAddress</span><span class="o">=</span><span class="n">addr</span><span class="p">,</span> <span class="n">lpParameter</span><span class="o">=</span><span class="n">param</span><span class="p">)</span>
<span class="k">return</span> <span class="n">WinThread</span><span class="o">.</span><span class="n">_from_handle</span><span class="p">(</span><span class="n">thread_handle</span><span class="o">.</span><span class="n">value</span><span class="p">)</span>
<span class="k">return</span> <span class="n">WinThread</span><span class="o">.</span><span class="n">_from_handle</span><span class="p">(</span><span class="n">winproxy</span><span class="o">.</span><span class="n">CreateRemoteThread</span><span class="p">(</span><span class="n">hProcess</span><span class="o">=</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">lpStartAddress</span><span class="o">=</span><span class="n">addr</span><span class="p">,</span> <span class="n">lpParameter</span><span class="o">=</span><span class="n">param</span><span class="p">))</span></div>
<div class="viewcode-block" id="WinProcess.load_library"><a class="viewcode-back" href="../../../process.html#windows.winobject.process.WinProcess.load_library">[docs]</a> <span class="k">def</span> <span class="nf">load_library</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">dll_path</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;Load the library in remote process</span>
<span class="sd"> :rtype: :class:`LoadedModule`</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="n">dllbase</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">injection</span><span class="o">.</span><span class="n">load_dll_in_remote_process</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">dll_path</span><span class="p">)</span>
<span class="k">return</span> <span class="p">[</span><span class="n">m</span> <span class="k">for</span> <span class="n">m</span> <span class="ow">in</span> <span class="bp">self</span><span class="o">.</span><span class="n">peb</span><span class="o">.</span><span class="n">modules</span> <span class="k">if</span> <span class="n">m</span><span class="o">.</span><span class="n">baseaddr</span> <span class="o">==</span> <span class="n">dllbase</span><span class="p">][</span><span class="mi">0</span><span class="p">]</span></div>
<div class="viewcode-block" id="WinProcess.execute_python"><a class="viewcode-back" href="../../../process.html#windows.winobject.process.WinProcess.execute_python">[docs]</a> <span class="k">def</span> <span class="nf">execute_python</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">pycode</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;Execute Python code into the remote process.</span>
<span class="sd"> This function waits for the remote process to end and</span>
<span class="sd"> raises an exception if the remote thread raised one</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="k">return</span> <span class="n">injection</span><span class="o">.</span><span class="n">safe_execute_python</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">pycode</span><span class="p">)</span></div>
<div class="viewcode-block" id="WinProcess.execute_python_unsafe"><a class="viewcode-back" href="../../../process.html#windows.winobject.process.WinProcess.execute_python_unsafe">[docs]</a> <span class="k">def</span> <span class="nf">execute_python_unsafe</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">pycode</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;Execute Python code into the remote process.</span>
<span class="sd"> :rtype: :rtype: :class:`WinThread` or :class:`DeadThread` : The thread executing the python code</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="k">return</span> <span class="n">injection</span><span class="o">.</span><span class="n">execute_python_code</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">pycode</span><span class="p">)</span></div>
<span class="nd">@utils</span><span class="o">.</span><span class="n">fixedpropety</span>
<span class="k">def</span> <span class="nf">peb_addr</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;The address of the PEB</span>
<span class="sd"> :type: :class:`int`</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">32</span> <span class="ow">and</span> <span class="bp">self</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">64</span><span class="p">:</span>
<span class="n">x</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">remotectypes</span><span class="o">.</span><span class="n">transform_type_to_remote64bits</span><span class="p">(</span><span class="n">PROCESS_BASIC_INFORMATION</span><span class="p">)</span>
<span class="c1"># Fuck-it &lt;3</span>
<span class="n">data</span> <span class="o">=</span> <span class="p">(</span><span class="n">ctypes</span><span class="o">.</span><span class="n">c_char</span> <span class="o">*</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">x</span><span class="p">))()</span>
<span class="n">windows</span><span class="o">.</span><span class="n">syswow64</span><span class="o">.</span><span class="n">NtQueryInformationProcess_32_to_64</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">ProcessInformation</span><span class="o">=</span><span class="n">data</span><span class="p">,</span> <span class="n">ProcessInformationLength</span><span class="o">=</span><span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">x</span><span class="p">))</span>
<span class="n">peb_offset</span> <span class="o">=</span> <span class="n">x</span><span class="o">.</span><span class="n">PebBaseAddress</span><span class="o">.</span><span class="n">offset</span>
<span class="n">peb_addr</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">unpack</span><span class="p">(</span><span class="s2">&quot;&lt;Q&quot;</span><span class="p">,</span> <span class="n">data</span><span class="p">[</span><span class="n">x</span><span class="o">.</span><span class="n">PebBaseAddress</span><span class="o">.</span><span class="n">offset</span><span class="p">:</span> <span class="n">x</span><span class="o">.</span><span class="n">PebBaseAddress</span><span class="o">.</span><span class="n">offset</span><span class="o">+</span><span class="mi">8</span><span class="p">])[</span><span class="mi">0</span><span class="p">]</span>
<span class="k">elif</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">64</span> <span class="ow">and</span> <span class="bp">self</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">32</span><span class="p">:</span>
<span class="n">information_type</span> <span class="o">=</span> <span class="mi">26</span>
<span class="n">y</span> <span class="o">=</span> <span class="n">ULONGLONG</span><span class="p">()</span>
<span class="n">winproxy</span><span class="o">.</span><span class="n">NtQueryInformationProcess</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">information_type</span><span class="p">,</span> <span class="n">byref</span><span class="p">(</span><span class="n">y</span><span class="p">),</span> <span class="n">sizeof</span><span class="p">(</span><span class="n">y</span><span class="p">))</span>
<span class="n">peb_addr</span> <span class="o">=</span> <span class="n">y</span><span class="o">.</span><span class="n">value</span>
<span class="k">else</span><span class="p">:</span>
<span class="n">information_type</span> <span class="o">=</span> <span class="mi">0</span>
<span class="n">x</span> <span class="o">=</span> <span class="n">PROCESS_BASIC_INFORMATION</span><span class="p">()</span>
<span class="n">winproxy</span><span class="o">.</span><span class="n">NtQueryInformationProcess</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">information_type</span><span class="p">,</span> <span class="n">x</span><span class="p">)</span>
<span class="n">peb_addr</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">cast</span><span class="p">(</span><span class="n">x</span><span class="o">.</span><span class="n">PebBaseAddress</span><span class="p">,</span> <span class="n">PVOID</span><span class="p">)</span><span class="o">.</span><span class="n">value</span>
<span class="k">if</span> <span class="n">peb_addr</span> <span class="ow">is</span> <span class="kc">None</span><span class="p">:</span>
<span class="k">raise</span> <span class="ne">ValueError</span><span class="p">(</span><span class="s2">&quot;Could not get peb addr of process </span><span class="si">{0}</span><span class="s2">&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">name</span><span class="p">))</span>
<span class="k">return</span> <span class="n">peb_addr</span>
<span class="c1"># Not a fixedpropety to prevent ref-cycle and uncollectable WinProcess</span>
<span class="c1"># Try with a weakref ?</span>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">peb</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;The PEB of the process (see :mod:`remotectypes`)</span>
<span class="sd"> :type: :class:`PEB`</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">32</span> <span class="ow">and</span> <span class="bp">self</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">64</span><span class="p">:</span>
<span class="k">return</span> <span class="n">RemotePEB64</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">peb_addr</span><span class="p">,</span> <span class="bp">self</span><span class="p">)</span>
<span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">64</span> <span class="ow">and</span> <span class="bp">self</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">32</span><span class="p">:</span>
<span class="k">return</span> <span class="n">RemotePEB32</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">peb_addr</span><span class="p">,</span> <span class="bp">self</span><span class="p">)</span>
<span class="k">return</span> <span class="n">RemotePEB</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">peb_addr</span><span class="p">,</span> <span class="bp">self</span><span class="p">)</span>
<span class="nd">@utils</span><span class="o">.</span><span class="n">fixedpropety</span>
<span class="k">def</span> <span class="nf">peb_syswow_addr</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="k">if</span> <span class="ow">not</span> <span class="bp">self</span><span class="o">.</span><span class="n">is_wow_64</span><span class="p">:</span>
<span class="k">raise</span> <span class="ne">ValueError</span><span class="p">(</span><span class="s2">&quot;Not a syswow process&quot;</span><span class="p">)</span>
<span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">64</span><span class="p">:</span>
<span class="n">information_type</span> <span class="o">=</span> <span class="mi">0</span>
<span class="n">x</span> <span class="o">=</span> <span class="n">PROCESS_BASIC_INFORMATION</span><span class="p">()</span>
<span class="n">winproxy</span><span class="o">.</span><span class="n">NtQueryInformationProcess</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">information_type</span><span class="p">,</span> <span class="n">x</span><span class="p">)</span>
<span class="n">peb_addr</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">cast</span><span class="p">(</span><span class="n">x</span><span class="o">.</span><span class="n">PebBaseAddress</span><span class="p">,</span> <span class="n">PVOID</span><span class="p">)</span><span class="o">.</span><span class="n">value</span>
<span class="k">return</span> <span class="n">peb_addr</span>
<span class="k">else</span><span class="p">:</span> <span class="c1">#current is 32bits</span>
<span class="n">x</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">remotectypes</span><span class="o">.</span><span class="n">transform_type_to_remote64bits</span><span class="p">(</span><span class="n">PROCESS_BASIC_INFORMATION</span><span class="p">)</span>
<span class="c1"># Fuck-it &lt;3</span>
<span class="n">data</span> <span class="o">=</span> <span class="p">(</span><span class="n">ctypes</span><span class="o">.</span><span class="n">c_char</span> <span class="o">*</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">x</span><span class="p">))()</span>
<span class="n">windows</span><span class="o">.</span><span class="n">syswow64</span><span class="o">.</span><span class="n">NtQueryInformationProcess_32_to_64</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">ProcessInformation</span><span class="o">=</span><span class="n">data</span><span class="p">,</span> <span class="n">ProcessInformationLength</span><span class="o">=</span><span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">x</span><span class="p">))</span>
<span class="n">peb_offset</span> <span class="o">=</span> <span class="n">x</span><span class="o">.</span><span class="n">PebBaseAddress</span><span class="o">.</span><span class="n">offset</span>
<span class="n">peb_addr</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">unpack</span><span class="p">(</span><span class="s2">&quot;&lt;Q&quot;</span><span class="p">,</span> <span class="n">data</span><span class="p">[</span><span class="n">x</span><span class="o">.</span><span class="n">PebBaseAddress</span><span class="o">.</span><span class="n">offset</span><span class="p">:</span> <span class="n">x</span><span class="o">.</span><span class="n">PebBaseAddress</span><span class="o">.</span><span class="n">offset</span><span class="o">+</span><span class="mi">8</span><span class="p">])[</span><span class="mi">0</span><span class="p">]</span>
<span class="k">return</span> <span class="n">peb_addr</span>
<span class="c1"># Not a fixedpropety to prevent ref-cycle and uncollectable WinProcess</span>
<span class="c1"># Try with a weakref ?</span>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">peb_syswow</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;The 64bits PEB of a SysWow64 process</span>
<span class="sd"> :type: :class:`PEB`</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="k">if</span> <span class="ow">not</span> <span class="bp">self</span><span class="o">.</span><span class="n">is_wow_64</span><span class="p">:</span>
<span class="k">raise</span> <span class="ne">ValueError</span><span class="p">(</span><span class="s2">&quot;Not a syswow process&quot;</span><span class="p">)</span>
<span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">64</span><span class="p">:</span>
<span class="k">return</span> <span class="n">RemotePEB</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">peb_syswow_addr</span><span class="p">,</span> <span class="bp">self</span><span class="p">)</span>
<span class="k">else</span><span class="p">:</span> <span class="c1">#current is 32bits</span>
<span class="k">return</span> <span class="n">RemotePEB64</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">peb_syswow_addr</span><span class="p">,</span> <span class="n">windows</span><span class="o">.</span><span class="n">syswow64</span><span class="o">.</span><span class="n">ReadSyswow64Process</span><span class="p">(</span><span class="bp">self</span><span class="p">))</span>
<div class="viewcode-block" id="WinProcess.exit"><a class="viewcode-back" href="../../../process.html#windows.winobject.process.WinProcess.exit">[docs]</a> <span class="k">def</span> <span class="nf">exit</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">code</span><span class="o">=</span><span class="mi">0</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;Exit the process&quot;&quot;&quot;</span>
<span class="k">return</span> <span class="n">winproxy</span><span class="o">.</span><span class="n">TerminateProcess</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">handle</span><span class="p">,</span> <span class="n">code</span><span class="p">)</span></div></div>
<span class="k">def</span> <span class="nf">transform_ctypes_fields</span><span class="p">(</span><span class="n">struct</span><span class="p">,</span> <span class="n">replacement</span><span class="p">):</span>
<span class="k">return</span> <span class="p">[(</span><span class="n">name</span><span class="p">,</span> <span class="n">replacement</span><span class="o">.</span><span class="n">get</span><span class="p">(</span><span class="n">name</span><span class="p">,</span> <span class="nb">type</span><span class="p">))</span> <span class="k">for</span> <span class="n">name</span><span class="p">,</span> <span class="nb">type</span> <span class="ow">in</span> <span class="n">struct</span><span class="o">.</span><span class="n">_fields_</span><span class="p">]</span>
<div class="viewcode-block" id="LoadedModule"><a class="viewcode-back" href="../../../process.html#windows.winobject.process.LoadedModule">[docs]</a><span class="k">class</span> <span class="nc">LoadedModule</span><span class="p">(</span><span class="n">LDR_DATA_TABLE_ENTRY</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;An entry in the PEB Ldr list&quot;&quot;&quot;</span>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">baseaddr</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;Base address of the module</span>
<span class="sd"> :type: :class:`int`</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">DllBase</span>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">name</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;Name of the module</span>
<span class="sd"> :type: :class:`str`</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">BaseDllName</span><span class="o">.</span><span class="n">str</span><span class="o">.</span><span class="n">lower</span><span class="p">()</span>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">fullname</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;Full name of the module (path)</span>
<span class="sd"> :type: :class:`str`</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">FullDllName</span><span class="o">.</span><span class="n">str</span><span class="o">.</span><span class="n">lower</span><span class="p">()</span>
<span class="k">def</span> <span class="nf">__repr__</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="k">return</span> <span class="s1">&#39;&lt;</span><span class="si">{0}</span><span class="s1"> &quot;</span><span class="si">{1}</span><span class="s1">&quot; at </span><span class="si">{2}</span><span class="s1">&gt;&#39;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="vm">__class__</span><span class="o">.</span><span class="vm">__name__</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">name</span><span class="p">,</span> <span class="nb">hex</span><span class="p">(</span><span class="nb">id</span><span class="p">(</span><span class="bp">self</span><span class="p">)))</span>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">pe</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;A PE representation of the module</span>
<span class="sd"> :type: :class:`windows.pe_parse.PEFile`</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="k">return</span> <span class="n">pe_parse</span><span class="o">.</span><span class="n">GetPEFile</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">baseaddr</span><span class="p">)</span></div>
<span class="k">class</span> <span class="nc">LIST_ENTRY_PTR</span><span class="p">(</span><span class="n">PVOID</span><span class="p">):</span>
<span class="k">def</span> <span class="nf">TO_LDR_ENTRY</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="k">return</span> <span class="n">LDR_DATA_TABLE_ENTRY</span><span class="o">.</span><span class="n">from_address</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">value</span> <span class="o">-</span> <span class="n">sizeof</span><span class="p">(</span><span class="n">PVOID</span><span class="p">)</span> <span class="o">*</span> <span class="mi">2</span><span class="p">)</span>
<div class="viewcode-block" id="PEB"><a class="viewcode-back" href="../../../process.html#windows.winobject.process.PEB">[docs]</a><span class="k">class</span> <span class="nc">PEB</span><span class="p">(</span><span class="n">gdef</span><span class="o">.</span><span class="n">PEB</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;The PEB (Process Environment Block) of the current process&quot;&quot;&quot;</span>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">exe</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;The executable of the process, as pointed by PEB.ImageBaseAddress</span>
<span class="sd"> :type: :class:`windows.pe_parse.PEFile`</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="k">return</span> <span class="n">windows</span><span class="o">.</span><span class="n">pe_parse</span><span class="o">.</span><span class="n">GetPEFile</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">ImageBaseAddress</span><span class="p">)</span>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">imagepath</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;The ImagePathName of the PEB</span>
<span class="sd"> :type: :class:`~windows.generated_def.winstructs.LSA_UNICODE_STRING`</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">ProcessParameters</span><span class="o">.</span><span class="n">contents</span><span class="o">.</span><span class="n">ImagePathName</span>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">commandline</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;The CommandLine of the PEB</span>
<span class="sd"> :type: :class:`~windows.generated_def.winstructs.LSA_UNICODE_STRING`</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">ProcessParameters</span><span class="o">.</span><span class="n">contents</span><span class="o">.</span><span class="n">CommandLine</span>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">modules</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;The loaded modules present in the PEB</span>
<span class="sd"> :type: [:class:`LoadedModule`] -- List of loaded modules</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="n">res</span> <span class="o">=</span> <span class="p">[]</span>
<span class="n">list_entry_ptr</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">cast</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">Ldr</span><span class="o">.</span><span class="n">contents</span><span class="o">.</span><span class="n">InMemoryOrderModuleList</span><span class="o">.</span><span class="n">Flink</span><span class="p">,</span> <span class="n">LIST_ENTRY_PTR</span><span class="p">)</span>
<span class="n">current_dll</span> <span class="o">=</span> <span class="n">list_entry_ptr</span><span class="o">.</span><span class="n">TO_LDR_ENTRY</span><span class="p">()</span>
<span class="k">while</span> <span class="n">current_dll</span><span class="o">.</span><span class="n">DllBase</span><span class="p">:</span>
<span class="n">res</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">current_dll</span><span class="p">)</span>
<span class="n">list_entry_ptr</span> <span class="o">=</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">cast</span><span class="p">(</span><span class="n">current_dll</span><span class="o">.</span><span class="n">InMemoryOrderLinks</span><span class="o">.</span><span class="n">Flink</span><span class="p">,</span> <span class="n">LIST_ENTRY_PTR</span><span class="p">)</span>
<span class="n">current_dll</span> <span class="o">=</span> <span class="n">list_entry_ptr</span><span class="o">.</span><span class="n">TO_LDR_ENTRY</span><span class="p">()</span>
<span class="k">return</span> <span class="p">[</span><span class="n">LoadedModule</span><span class="o">.</span><span class="n">from_address</span><span class="p">(</span><span class="n">addressof</span><span class="p">(</span><span class="n">LDR</span><span class="p">))</span> <span class="k">for</span> <span class="n">LDR</span> <span class="ow">in</span> <span class="n">res</span><span class="p">]</span>
<span class="nd">@staticmethod</span>
<span class="k">def</span> <span class="nf">_extract_environment</span><span class="p">(</span><span class="n">env_block_addr</span><span class="p">,</span> <span class="n">target</span><span class="p">):</span>
<span class="n">result</span> <span class="o">=</span> <span class="p">[]</span>
<span class="k">while</span> <span class="kc">True</span><span class="p">:</span>
<span class="n">venv</span> <span class="o">=</span> <span class="n">target</span><span class="o">.</span><span class="n">read_wstring</span><span class="p">(</span><span class="n">env_block_addr</span><span class="p">)</span>
<span class="k">if</span> <span class="ow">not</span> <span class="n">venv</span><span class="p">:</span>
<span class="k">return</span> <span class="n">result</span>
<span class="n">result</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">venv</span><span class="p">)</span>
<span class="n">env_block_addr</span> <span class="o">+=</span> <span class="p">((</span><span class="nb">len</span><span class="p">(</span><span class="n">venv</span><span class="p">)</span> <span class="o">+</span> <span class="mi">1</span><span class="p">)</span> <span class="o">*</span> <span class="mi">2</span><span class="p">)</span>
<span class="c1"># raise RuntimeError(&quot;Out of infinite loop&quot;)</span>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">environment</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="c1"># TODO: Tests</span>
<span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">_extract_environment</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">ProcessParameters</span><span class="o">.</span><span class="n">contents</span><span class="o">.</span><span class="n">Environment</span><span class="p">,</span> <span class="n">windows</span><span class="o">.</span><span class="n">current_process</span><span class="p">)</span>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">apisetmap</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;The :class:`~windows.winobject.apisetmap.ApiSetMap` of the process</span>
<span class="sd"> :rtype: A subclass of :class:`~windows.winobject.apisetmap.ApiSetMap`</span>
<span class="sd"> :raise: :class:`~exception.NotImplementedError` -- Before ``6.2`` ApiSetMap did not exist</span>
<span class="sd"> :raise: :class:`~exception.NotImplementedError` -- Not implemented for remote process</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="k">if</span> <span class="n">windows</span><span class="o">.</span><span class="n">system</span><span class="o">.</span><span class="n">version</span> <span class="o">&lt;</span> <span class="p">(</span><span class="mi">6</span><span class="p">,</span><span class="mi">2</span><span class="p">):</span>
<span class="k">raise</span> <span class="ne">NotImplementedError</span><span class="p">(</span><span class="s2">&quot;ApiSetMap does not exist prior to Windows 7&quot;</span><span class="p">)</span>
<span class="k">return</span> <span class="n">apisetmap</span><span class="o">.</span><span class="n">get_api_set_map_for_current_process</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">ApiSetMap</span><span class="p">)</span></div>
<span class="c1"># Memory stuff</span>
<span class="k">class</span> <span class="nc">EPSAPI_WORKING_SET_BLOCK_BASE</span><span class="p">(</span><span class="nb">object</span><span class="p">):</span>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">protection</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">Flags</span> <span class="o">&amp;</span> <span class="mb">0b11111</span>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">sharecount</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="k">return</span> <span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">Flags</span> <span class="o">&gt;&gt;</span> <span class="mi">5</span><span class="p">)</span> <span class="o">&amp;</span> <span class="mb">0b111</span>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">shared</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="k">return</span> <span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">Flags</span> <span class="o">&gt;&gt;</span> <span class="mi">8</span><span class="p">)</span> <span class="o">&amp;</span> <span class="mi">1</span>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">virtualpage</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="k">return</span> <span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">Flags</span> <span class="o">&gt;&gt;</span> <span class="mi">12</span><span class="p">)</span>
<span class="k">class</span> <span class="nc">EPSAPI_WORKING_SET_BLOCK</span><span class="p">(</span><span class="n">EPSAPI_WORKING_SET_BLOCK_BASE</span><span class="p">,</span> <span class="n">PSAPI_WORKING_SET_BLOCK</span><span class="p">):</span>
<span class="k">pass</span>
<span class="k">class</span> <span class="nc">EPSAPI_WORKING_SET_BLOCK32</span><span class="p">(</span><span class="n">EPSAPI_WORKING_SET_BLOCK_BASE</span><span class="p">,</span> <span class="n">PSAPI_WORKING_SET_BLOCK32</span><span class="p">):</span>
<span class="k">pass</span>
<span class="k">class</span> <span class="nc">EPSAPI_WORKING_SET_BLOCK64</span><span class="p">(</span><span class="n">EPSAPI_WORKING_SET_BLOCK_BASE</span><span class="p">,</span> <span class="n">PSAPI_WORKING_SET_BLOCK64</span><span class="p">):</span>
<span class="k">pass</span>
<span class="k">class</span> <span class="nc">EPSAPI_WORKING_SET_EX_BLOCK_BASE</span><span class="p">(</span><span class="nb">object</span><span class="p">):</span>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">valid</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">Flags</span> <span class="o">&amp;</span> <span class="mb">0b1</span>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">sharecount</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="k">return</span> <span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">Flags</span> <span class="o">&gt;&gt;</span> <span class="mi">1</span><span class="p">)</span> <span class="o">&amp;</span> <span class="mb">0b111</span>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">shared</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="k">return</span> <span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">Flags</span> <span class="o">&gt;&gt;</span> <span class="mi">15</span><span class="p">)</span> <span class="o">&amp;</span> <span class="mi">1</span>
<span class="k">class</span> <span class="nc">EPSAPI_WORKING_SET_EX_BLOCK</span><span class="p">(</span><span class="n">EPSAPI_WORKING_SET_EX_BLOCK_BASE</span><span class="p">,</span> <span class="n">PSAPI_WORKING_SET_EX_BLOCK</span><span class="p">):</span>
<span class="k">pass</span>
<span class="k">class</span> <span class="nc">EPSAPI_WORKING_SET_EX_BLOCK32</span><span class="p">(</span><span class="n">EPSAPI_WORKING_SET_EX_BLOCK_BASE</span><span class="p">,</span> <span class="n">PSAPI_WORKING_SET_EX_BLOCK32</span><span class="p">):</span>
<span class="k">pass</span>
<span class="k">class</span> <span class="nc">EPSAPI_WORKING_SET_EX_BLOCK64</span><span class="p">(</span><span class="n">EPSAPI_WORKING_SET_EX_BLOCK_BASE</span><span class="p">,</span> <span class="n">PSAPI_WORKING_SET_EX_BLOCK64</span><span class="p">):</span>
<span class="k">pass</span>
<span class="k">class</span> <span class="nc">EPSAPI_WORKING_SET_EX_INFORMATION</span><span class="p">(</span><span class="n">ctypes</span><span class="o">.</span><span class="n">Structure</span><span class="p">):</span>
<span class="n">_fields_</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">utils</span><span class="o">.</span><span class="n">transform_ctypes_fields</span><span class="p">(</span><span class="n">PSAPI_WORKING_SET_EX_INFORMATION</span><span class="p">,</span> <span class="p">{</span><span class="s2">&quot;VirtualAttributes&quot;</span><span class="p">:</span> <span class="n">EPSAPI_WORKING_SET_EX_BLOCK</span><span class="p">})</span>
<span class="k">class</span> <span class="nc">EPSAPI_WORKING_SET_EX_INFORMATION32</span><span class="p">(</span><span class="n">ctypes</span><span class="o">.</span><span class="n">Structure</span><span class="p">):</span>
<span class="n">_fields_</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">utils</span><span class="o">.</span><span class="n">transform_ctypes_fields</span><span class="p">(</span><span class="n">PSAPI_WORKING_SET_EX_INFORMATION32</span><span class="p">,</span> <span class="p">{</span><span class="s2">&quot;VirtualAttributes&quot;</span><span class="p">:</span> <span class="n">EPSAPI_WORKING_SET_EX_BLOCK32</span><span class="p">})</span>
<span class="k">class</span> <span class="nc">EPSAPI_WORKING_SET_EX_INFORMATION64</span><span class="p">(</span><span class="n">ctypes</span><span class="o">.</span><span class="n">Structure</span><span class="p">):</span>
<span class="n">_fields_</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">utils</span><span class="o">.</span><span class="n">transform_ctypes_fields</span><span class="p">(</span><span class="n">PSAPI_WORKING_SET_EX_INFORMATION64</span><span class="p">,</span> <span class="p">{</span><span class="s2">&quot;VirtualAttributes&quot;</span><span class="p">:</span> <span class="n">EPSAPI_WORKING_SET_EX_BLOCK64</span><span class="p">})</span>
<span class="k">class</span> <span class="nc">RemoteLoadedModule</span><span class="p">(</span><span class="n">rctypes</span><span class="o">.</span><span class="n">RemoteStructure</span><span class="o">.</span><span class="n">from_structure</span><span class="p">(</span><span class="n">LoadedModule</span><span class="p">)):</span>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">pe</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;A PE representation of the module</span>
<span class="sd"> :type: :class:`windows.pe_parse.PEFile`</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="k">return</span> <span class="n">pe_parse</span><span class="o">.</span><span class="n">GetPEFile</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">baseaddr</span><span class="p">,</span> <span class="n">target</span><span class="o">=</span><span class="bp">self</span><span class="o">.</span><span class="n">_target</span><span class="p">)</span>
<span class="k">class</span> <span class="nc">RemotePEB</span><span class="p">(</span><span class="n">rctypes</span><span class="o">.</span><span class="n">RemoteStructure</span><span class="o">.</span><span class="n">from_structure</span><span class="p">(</span><span class="n">PEB</span><span class="p">)):</span>
<span class="k">def</span> <span class="nf">ptr_flink_to_remote_module</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">ptr_value</span><span class="p">):</span>
<span class="k">return</span> <span class="n">RemoteLoadedModule</span><span class="p">(</span><span class="n">ptr_value</span> <span class="o">-</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">ctypes</span><span class="o">.</span><span class="n">c_void_p</span><span class="p">)</span> <span class="o">*</span> <span class="mi">2</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">_target</span><span class="p">)</span>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">exe</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;The executable of the process, as pointed by PEB.ImageBaseAddress</span>
<span class="sd"> :type: :class:`windows.pe_parse.PEFile`</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="k">return</span> <span class="n">pe_parse</span><span class="o">.</span><span class="n">GetPEFile</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">ImageBaseAddress</span><span class="p">,</span> <span class="n">target</span><span class="o">=</span><span class="bp">self</span><span class="o">.</span><span class="n">_target</span><span class="p">)</span>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">modules</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;The loaded modules present in the PEB</span>
<span class="sd"> :type: [:class:`LoadedModule`] -- List of loaded modules</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="n">res</span> <span class="o">=</span> <span class="p">[]</span>
<span class="k">if</span> <span class="ow">not</span> <span class="bp">self</span><span class="o">.</span><span class="n">Ldr</span><span class="o">.</span><span class="n">value</span><span class="p">:</span>
<span class="k">raise</span> <span class="ne">ValueError</span><span class="p">(</span><span class="s2">&quot;PEB-&gt;Ldr is NULL: cannot walk the module list&quot;</span><span class="p">)</span>
<span class="n">list_entry_ptr</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">Ldr</span><span class="o">.</span><span class="n">contents</span><span class="o">.</span><span class="n">InMemoryOrderModuleList</span><span class="o">.</span><span class="n">Flink</span><span class="o">.</span><span class="n">raw_value</span>
<span class="n">current_dll</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">ptr_flink_to_remote_module</span><span class="p">(</span><span class="n">list_entry_ptr</span><span class="p">)</span>
<span class="k">while</span> <span class="n">current_dll</span><span class="o">.</span><span class="n">DllBase</span><span class="p">:</span>
<span class="n">res</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">current_dll</span><span class="p">)</span>
<span class="n">list_entry_ptr</span> <span class="o">=</span> <span class="n">current_dll</span><span class="o">.</span><span class="n">InMemoryOrderLinks</span><span class="o">.</span><span class="n">Flink</span><span class="o">.</span><span class="n">raw_value</span>
<span class="n">current_dll</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">ptr_flink_to_remote_module</span><span class="p">(</span><span class="n">list_entry_ptr</span><span class="p">)</span>
<span class="k">return</span> <span class="n">res</span>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">environment</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="c1"># TODO: Tests</span>
<span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">_extract_environment</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">ProcessParameters</span><span class="o">.</span><span class="n">contents</span><span class="o">.</span><span class="n">Environment</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">_target</span><span class="p">)</span>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">apisetmap</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="k">raise</span> <span class="ne">NotImplementedError</span><span class="p">(</span><span class="s2">&quot;ApiSetMap for remote process not implemented yet&quot;</span><span class="p">)</span>
<span class="k">if</span> <span class="n">CurrentProcess</span><span class="p">()</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">32</span><span class="p">:</span>
<span class="k">class</span> <span class="nc">RemoteLoadedModule64</span><span class="p">(</span><span class="n">rctypes</span><span class="o">.</span><span class="n">transform_type_to_remote64bits</span><span class="p">(</span><span class="n">LoadedModule</span><span class="p">)):</span>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">pe</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;A PE representation of the module</span>
<span class="sd"> :type: :class:`windows.pe_parse.PEFile`</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="k">return</span> <span class="n">pe_parse</span><span class="o">.</span><span class="n">GetPEFile</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">baseaddr</span><span class="p">,</span> <span class="n">target</span><span class="o">=</span><span class="bp">self</span><span class="o">.</span><span class="n">_target</span><span class="p">)</span>
<span class="k">class</span> <span class="nc">RemotePEB64</span><span class="p">(</span><span class="n">rctypes</span><span class="o">.</span><span class="n">transform_type_to_remote64bits</span><span class="p">(</span><span class="n">PEB</span><span class="p">)):</span>
<span class="k">def</span> <span class="nf">ptr_flink_to_remote_module</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">ptr_value</span><span class="p">):</span>
<span class="k">return</span> <span class="n">RemoteLoadedModule64</span><span class="p">(</span><span class="n">ptr_value</span> <span class="o">-</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">rctypes</span><span class="o">.</span><span class="n">c_void_p64</span><span class="p">)</span> <span class="o">*</span> <span class="mi">2</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">_target</span><span class="p">)</span>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">exe</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;The executable of the process, as pointed by PEB.ImageBaseAddress</span>
<span class="sd"> :type: :class:`windows.pe_parse.PEFile`</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="k">return</span> <span class="n">pe_parse</span><span class="o">.</span><span class="n">GetPEFile</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">ImageBaseAddress</span><span class="p">,</span> <span class="n">target</span><span class="o">=</span><span class="bp">self</span><span class="o">.</span><span class="n">_target</span><span class="p">)</span>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">modules</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;The loaded modules present in the PEB</span>
<span class="sd"> :type: [:class:`LoadedModule`] -- List of loaded modules</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="n">res</span> <span class="o">=</span> <span class="p">[]</span>
<span class="k">if</span> <span class="ow">not</span> <span class="bp">self</span><span class="o">.</span><span class="n">Ldr</span><span class="o">.</span><span class="n">value</span><span class="p">:</span>
<span class="k">raise</span> <span class="ne">ValueError</span><span class="p">(</span><span class="s2">&quot;PEB-&gt;Ldr is NULL: cannot walk the module list&quot;</span><span class="p">)</span>
<span class="n">list_entry_ptr</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">Ldr</span><span class="o">.</span><span class="n">contents</span><span class="o">.</span><span class="n">InMemoryOrderModuleList</span><span class="o">.</span><span class="n">Flink</span><span class="o">.</span><span class="n">raw_value</span>
<span class="n">current_dll</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">ptr_flink_to_remote_module</span><span class="p">(</span><span class="n">list_entry_ptr</span><span class="p">)</span>
<span class="k">while</span> <span class="n">current_dll</span><span class="o">.</span><span class="n">DllBase</span><span class="p">:</span>
<span class="n">res</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">current_dll</span><span class="p">)</span>
<span class="n">list_entry_ptr</span> <span class="o">=</span> <span class="n">current_dll</span><span class="o">.</span><span class="n">InMemoryOrderLinks</span><span class="o">.</span><span class="n">Flink</span><span class="o">.</span><span class="n">raw_value</span>
<span class="n">current_dll</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">ptr_flink_to_remote_module</span><span class="p">(</span><span class="n">list_entry_ptr</span><span class="p">)</span>
<span class="k">return</span> <span class="n">res</span>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">environment</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="c1"># TODO: Tests</span>
<span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">_extract_environment</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">ProcessParameters</span><span class="o">.</span><span class="n">contents</span><span class="o">.</span><span class="n">Environment</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">_target</span><span class="p">)</span>
<span class="n">apisetmap</span> <span class="o">=</span> <span class="n">RemotePEB</span><span class="o">.</span><span class="n">apisetmap</span>
<span class="k">if</span> <span class="n">CurrentProcess</span><span class="p">()</span><span class="o">.</span><span class="n">bitness</span> <span class="o">==</span> <span class="mi">64</span><span class="p">:</span>
<span class="k">class</span> <span class="nc">RemoteLoadedModule32</span><span class="p">(</span><span class="n">rctypes</span><span class="o">.</span><span class="n">transform_type_to_remote32bits</span><span class="p">(</span><span class="n">LoadedModule</span><span class="p">)):</span>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">pe</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;A PE representation of the module</span>
<span class="sd"> :type: :class:`windows.pe_parse.PEFile`</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="k">return</span> <span class="n">pe_parse</span><span class="o">.</span><span class="n">GetPEFile</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">baseaddr</span><span class="p">,</span> <span class="n">target</span><span class="o">=</span><span class="bp">self</span><span class="o">.</span><span class="n">_target</span><span class="p">)</span>
<span class="k">class</span> <span class="nc">RemotePEB32</span><span class="p">(</span><span class="n">rctypes</span><span class="o">.</span><span class="n">transform_type_to_remote32bits</span><span class="p">(</span><span class="n">PEB</span><span class="p">)):</span>
<span class="k">def</span> <span class="nf">ptr_flink_to_remote_module</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">ptr_value</span><span class="p">):</span>
<span class="k">return</span> <span class="n">RemoteLoadedModule32</span><span class="p">(</span><span class="n">ptr_value</span> <span class="o">-</span> <span class="n">ctypes</span><span class="o">.</span><span class="n">sizeof</span><span class="p">(</span><span class="n">rctypes</span><span class="o">.</span><span class="n">c_void_p32</span><span class="p">)</span> <span class="o">*</span> <span class="mi">2</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">_target</span><span class="p">)</span>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">exe</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;The executable of the process, as pointed by PEB.ImageBaseAddress</span>
<span class="sd"> :type: :class:`windows.pe_parse.PEFile`</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="k">return</span> <span class="n">pe_parse</span><span class="o">.</span><span class="n">GetPEFile</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">ImageBaseAddress</span><span class="p">,</span> <span class="n">target</span><span class="o">=</span><span class="bp">self</span><span class="o">.</span><span class="n">_target</span><span class="p">)</span>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">modules</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="sd">&quot;&quot;&quot;The loaded modules present in the PEB</span>
<span class="sd"> :type: [:class:`LoadedModule`] -- List of loaded modules</span>
<span class="sd"> &quot;&quot;&quot;</span>
<span class="n">res</span> <span class="o">=</span> <span class="p">[]</span>
<span class="k">if</span> <span class="ow">not</span> <span class="bp">self</span><span class="o">.</span><span class="n">Ldr</span><span class="o">.</span><span class="n">value</span><span class="p">:</span>
<span class="k">raise</span> <span class="ne">ValueError</span><span class="p">(</span><span class="s2">&quot;PEB-&gt;Ldr is NULL: cannot walk the module list&quot;</span><span class="p">)</span>
<span class="n">list_entry_ptr</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">Ldr</span><span class="o">.</span><span class="n">contents</span><span class="o">.</span><span class="n">InMemoryOrderModuleList</span><span class="o">.</span><span class="n">Flink</span><span class="o">.</span><span class="n">raw_value</span>
<span class="n">current_dll</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">ptr_flink_to_remote_module</span><span class="p">(</span><span class="n">list_entry_ptr</span><span class="p">)</span>
<span class="k">while</span> <span class="n">current_dll</span><span class="o">.</span><span class="n">DllBase</span><span class="p">:</span>
<span class="n">res</span><span class="o">.</span><span class="n">append</span><span class="p">(</span><span class="n">current_dll</span><span class="p">)</span>
<span class="n">list_entry_ptr</span> <span class="o">=</span> <span class="n">current_dll</span><span class="o">.</span><span class="n">InMemoryOrderLinks</span><span class="o">.</span><span class="n">Flink</span><span class="o">.</span><span class="n">raw_value</span>
<span class="n">current_dll</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">ptr_flink_to_remote_module</span><span class="p">(</span><span class="n">list_entry_ptr</span><span class="p">)</span>
<span class="k">return</span> <span class="n">res</span>
<span class="nd">@property</span>
<span class="k">def</span> <span class="nf">environment</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
<span class="c1"># TODO: Tests</span>
<span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">_extract_environment</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">ProcessParameters</span><span class="o">.</span><span class="n">contents</span><span class="o">.</span><span class="n">Environment</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">_target</span><span class="p">)</span>
<span class="n">apisetmap</span> <span class="o">=</span> <span class="n">RemotePEB</span><span class="o">.</span><span class="n">apisetmap</span>
</pre></div>
</div>
</div>
</div>
<div class="sphinxsidebar" role="navigation" aria-label="main navigation">
<div class="sphinxsidebarwrapper">
<div id="searchbox" style="display: none" role="search">
<h3>Quick search</h3>
<div class="searchformwrapper">
<form class="search" action="../../../search.html" method="get">
<input type="text" name="q" />
<input type="submit" value="Go" />
<input type="hidden" name="check_keywords" value="yes" />
<input type="hidden" name="area" value="default" />
</form>
</div>
</div>
<script type="text/javascript">$('#searchbox').show(0);</script>
</div>
</div>
<div class="clearer"></div>
</div>
<div class="related" role="navigation" aria-label="related navigation">
<h3>Navigation</h3>
<ul>
<li class="right" style="margin-right: 10px">
<a href="../../../genindex.html" title="General Index"
>index</a></li>
<li class="right" >
<a href="../../../py-modindex.html" title="Python Module Index"
>modules</a> |</li>
<li class="nav-item nav-item-0"><a href="../../../index.html">PythonForWindows 0.5 documentation</a> &#187;</li>
<li class="nav-item nav-item-1"><a href="../../index.html" >Module code</a> &#187;</li>
</ul>
</div>
<div class="footer" role="contentinfo">
&#169; Copyright 2015, Clement Rouault.
Created using <a href="http://sphinx-doc.org/">Sphinx</a> 1.7.5.
</div>
</body>
</html>
Reference in New Issue View Git Blame Copy Permalink