winappdbg.win32.advapi32

Wrapper for advapi32.dll in ctypes.

class winappdbg.win32.advapi32.ENUM_SERVICE_STATUSA

class winappdbg.win32.advapi32.ENUM_SERVICE_STATUSW

class winappdbg.win32.advapi32.ENUM_SERVICE_STATUS_PROCESSA

class winappdbg.win32.advapi32.ENUM_SERVICE_STATUS_PROCESSW

winappdbg.win32.advapi32.HWCT: alias of c_void_p

winappdbg.win32.advapi32.LPENUM_SERVICE_STATUSA: alias of LP_ENUM_SERVICE_STATUSA

winappdbg.win32.advapi32.LPENUM_SERVICE_STATUSW: alias of LP_ENUM_SERVICE_STATUSW

winappdbg.win32.advapi32.LPENUM_SERVICE_STATUS_PROCESSA: alias of LP_ENUM_SERVICE_STATUS_PROCESSA

winappdbg.win32.advapi32.LPENUM_SERVICE_STATUS_PROCESSW: alias of LP_ENUM_SERVICE_STATUS_PROCESSW

winappdbg.win32.advapi32.LPSERVICE_STATUS: alias of LP_SERVICE_STATUS

winappdbg.win32.advapi32.LPSERVICE_STATUS_PROCESS: alias of LP_SERVICE_STATUS_PROCESS

class winappdbg.win32.advapi32.LUID

class winappdbg.win32.advapi32.LUID_AND_ATTRIBUTES

winappdbg.win32.advapi32.PLUID: alias of LP_LUID

winappdbg.win32.advapi32.PSECURITY_IMPERSONATION_LEVEL: alias of LP_c_int

winappdbg.win32.advapi32.PSID_AND_ATTRIBUTES: alias of LP_SID_AND_ATTRIBUTES

winappdbg.win32.advapi32.PTOKEN_APPCONTAINER_INFORMATION: alias of LP_TOKEN_APPCONTAINER_INFORMATION

winappdbg.win32.advapi32.PTOKEN_ELEVATION_TYPE: alias of LP_c_int

winappdbg.win32.advapi32.PTOKEN_LINKED_TOKEN: alias of LP_TOKEN_LINKED_TOKEN

winappdbg.win32.advapi32.PTOKEN_MANDATORY_LABEL: alias of LP_TOKEN_MANDATORY_LABEL

winappdbg.win32.advapi32.PTOKEN_ORIGIN: alias of LP_TOKEN_ORIGIN

winappdbg.win32.advapi32.PTOKEN_OWNER: alias of LP_TOKEN_OWNER

winappdbg.win32.advapi32.PTOKEN_PRIMARY_GROUP: alias of LP_TOKEN_PRIMARY_GROUP

winappdbg.win32.advapi32.PTOKEN_PRIVILEGES: alias of LP_TOKEN_PRIVILEGES

winappdbg.win32.advapi32.PTOKEN_STATISTICS: alias of LP_TOKEN_STATISTICS

winappdbg.win32.advapi32.PTOKEN_TYPE: alias of LP_c_int

winappdbg.win32.advapi32.PTOKEN_USER: alias of LP_TOKEN_USER

winappdbg.win32.advapi32.PWAITCHAIN_NODE_INFO: alias of LP_WAITCHAIN_NODE_INFO

class winappdbg.win32.advapi32.RegistryKeyHandle(aHandle=None, bOwnership=True): Registry key handle.

winappdbg.win32.advapi32.SAFER_LEVEL_HANDLE: alias of c_void_p

winappdbg.win32.advapi32.SAFER_POLICY_INFO_CLASS: alias of c_uint

winappdbg.win32.advapi32.SC_ENUM_TYPE: alias of c_int

winappdbg.win32.advapi32.SC_HANDLE: alias of c_void_p

winappdbg.win32.advapi32.SC_STATUS_TYPE: alias of c_int

winappdbg.win32.advapi32.SECURITY_IMPERSONATION_LEVEL: alias of c_int

class winappdbg.win32.advapi32.SERVICE_STATUS

class winappdbg.win32.advapi32.SERVICE_STATUS_PROCESS

class winappdbg.win32.advapi32.SID_AND_ATTRIBUTES

class winappdbg.win32.advapi32.SaferLevelHandle(aHandle=None, bOwnership=True)

Safer level handle.

Seealso:: http://msdn.microsoft.com/en-us/library/ms722425(VS.85).aspx

class winappdbg.win32.advapi32.ServiceControlManagerHandle(aHandle=None, bOwnership=True)

Service Control Manager (SCM) handle.

Seealso:: http://msdn.microsoft.com/en-us/library/windows/desktop/ms684323(v=vs.85).aspx

class winappdbg.win32.advapi32.ServiceHandle(aHandle=None, bOwnership=True)

Service handle.

Seealso:: http://msdn.microsoft.com/en-us/library/windows/desktop/ms684330(v=vs.85).aspx

class winappdbg.win32.advapi32.ServiceStatus(raw): Wrapper for the SERVICE_STATUS structure.

class winappdbg.win32.advapi32.ServiceStatusEntry(raw): Service status entry returned by EnumServicesStatus().

class winappdbg.win32.advapi32.ServiceStatusProcess(raw): Wrapper for the SERVICE_STATUS_PROCESS structure.

class winappdbg.win32.advapi32.ServiceStatusProcessEntry(raw): Service status entry returned by EnumServicesStatusEx().

class winappdbg.win32.advapi32.TOKEN_APPCONTAINER_INFORMATION

winappdbg.win32.advapi32.TOKEN_ELEVATION_TYPE: alias of c_int

winappdbg.win32.advapi32.TOKEN_INFORMATION_CLASS: alias of c_int

class winappdbg.win32.advapi32.TOKEN_LINKED_TOKEN

class winappdbg.win32.advapi32.TOKEN_MANDATORY_LABEL

class winappdbg.win32.advapi32.TOKEN_ORIGIN

class winappdbg.win32.advapi32.TOKEN_OWNER

class winappdbg.win32.advapi32.TOKEN_PRIMARY_GROUP

class winappdbg.win32.advapi32.TOKEN_PRIVILEGES

class winappdbg.win32.advapi32.TOKEN_STATISTICS

winappdbg.win32.advapi32.TOKEN_TYPE: alias of c_int

class winappdbg.win32.advapi32.TOKEN_USER

class winappdbg.win32.advapi32.ThreadWaitChainSessionHandle(aHandle=None)

Thread wait chain session handle.

Returned by OpenThreadWaitChainSession().

Seealso:: Handle

dup()

Return type:: Handle
Returns:: A new handle to the same Win32 object.

wait(dwMilliseconds=None)

Wait for the Win32 object to be signaled.

Parameters:: dwMilliseconds (int) – (Optional) Timeout value in milliseconds. Use INFINITE or None for no timeout.

class winappdbg.win32.advapi32.TokenHandle(aHandle=None, bOwnership=True)

Access token handle.

Seealso:: Handle

class winappdbg.win32.advapi32.WAITCHAIN_NODE_INFO

winappdbg.win32.advapi32.WCT_OBJECT_STATUS: alias of c_uint

winappdbg.win32.advapi32.WCT_OBJECT_TYPE: alias of c_uint

class winappdbg.win32.advapi32.WaitChainNodeInfo(aStructure)

Represents a node in the wait chain.

It’s a wrapper on the WAITCHAIN_NODE_INFO structure.

The following members are defined only if the node is of WctThreadType type:

ProcessId
ThreadId
WaitTime
ContextSwitches

Seealso:: GetThreadWaitChain()

ObjectName: unicode: Object name. May be an empty string.

ObjectType: int

Object type. Should be one of the following values:

WctCriticalSectionType
WctSendMessageType
WctMutexType
WctAlpcType
WctComType
WctThreadWaitType
WctProcessWaitType
WctThreadType
WctComActivationType
WctUnknownType

ObjectStatus: int

Wait status. Should be one of the following values:

WctStatusNoAccess (ACCESS_DENIED for this object)
WctStatusRunning (Thread status)
WctStatusBlocked (Thread status)
WctStatusPidOnly (Thread status)
WctStatusPidOnlyRpcss (Thread status)
WctStatusOwned (Dispatcher object status)
WctStatusNotOwned (Dispatcher object status)
WctStatusAbandoned (Dispatcher object status)
WctStatusUnknown (All objects)
WctStatusError (All objects)

ProcessId: int: Process global ID.

ThreadId: int: Thread global ID.

WaitTime: int: Wait time.

ContextSwitches: int: Number of context switches.