Return size of the structure.

Pack a PSID :param PSID psid:

Return the value of the property ``name``. The return value depends of the type of the property and can vary

Returns a string representation of the structure.

Apply structure format to raw data. Returns an unpacked structure object if successful, None otherwise.

Adds a line. The line can be indented with the optional argument 'indent'.

Get data regardless of the section where it lies on. Given a RVA and the size of the chunk to retrieve, this method will find the sec

Write `data` at `addr`

Adds a newline.

Adds a list of lines. The list can be indented with the optional argument 'indent'.

Get the file offset corresponding to this RVA. Given a RVA , this method will find the section where the data lies and return the off

Adds a header element.

A context-manager that disable all memory breakpoints and restore them on exit

Read ``size`` from ``addr`` :return: The data read :rtype: :class:`str`

Adds some text, no newline will be appended. The text can be indented with the optional argument 'indent'.

Return context of current exception

Read the flags from a dictionary and return them in a usable form. Will return a list of (flag, value) for all flags in "flag_dict" matching

Change the access right of one or more page of the process

Return ``True`` if current process have been detached by user callback

Get an Unicode string located at the given address.

Get an ASCII string located at the given address.

The properties of the object (include system properties)

Retrieve a value from the event. ``name`` is an XPath expressions that uniquely identify a node or attribute in the event. (see https:

write a qword at ``addr``

Return a new :class:`SecurityDescriptor` from the ``SDDL``. :returns: :class:`SecurityDescriptor` .. warning:: At the m

Get the section containing the given address.

Overwrite the bytes at the given file offset with the given string. Return True if successful, False otherwise. It can fail if the of

Return the certificate that match `issuer` and `serialnumber` :return: :class:`Certificate` -- ``None`` if certificate is not found

Convert two bytes of data to a word (little endian) 'offset' is assumed to index into a word array. So setting it to N will return a