Returns true is the unpacked data is all zeros.

ContextManager to allocate memory and free it :type: :class:`int` -- the address of the allocated memory

Initialize a new :class:`EventTraceProperties`

Create a :class:`PipeConnection` from pipe handle `phandle`

Get data chunk from a section. Allows to query data from the section by passing the addresses where the PE file would be loaded by de

Convert four bytes of data to a double word (little endian) 'offset' is assumed to index into a dword array. So setting it to N will

The reference index of the ``PublisherMetadataChannel``

Return ``True`` if the new Evt-API is implemented on the current computer see: https://msdn.microsoft.com/en-us/library/windows/desktop/aa385

Will process the flags and set attributes in the object accordingly. The object "obj" will gain attributes named after the flags provided in

Discard some bytes to align the remaining stream on ``size``

Check if ``filename`` embeds a valid signature. :return: :class:`int`: ``0`` if ``filename`` have a valid signature else the error

A convenient wrapper arround :func:`windows.winproxy.CreateProcessA`

Create a remote thread :rtype: :class:`WinThread` or :class:`DeadThread`

Exit the thread

Return ExceptionCode of current exception

Get an ASCII string from data.

Return the list of warnings. Non-critical problems found when parsing the PE file are appended to a list of warnings. This method ret

Check whether the file is a standard DLL. This will return true only if the image has the IMAGE_FILE_DLL flag set.

Return ``True`` if ``attribute`` is valid

Called on exception event other that known breakpoint or requested single step. ``exception`` is one of the following type: * :class:

Read a ``DWORD`` at ``addr``

Read an ascii string at ``addr``

The type (Primary / Impersonation) of the token

Default ``QueryInterface`` implementation that returns ``self`` if piid is the implemented interface

Check whether the section contains the address provided.

Return a Python :class:`file` around a ``Windows`` HANDLE

Delete a breakpoint, if targets is ``None``: delete it from all targets

Dump all the PE header information into human readable string.

Get the section containing the given file offset.

Extracts the VendorId string from CPUID :rtype: :class:`str`

Return the word value at the given RVA. Returns None if the value can't be read, i.e. the RVA can't be mapped to a file offset.

Load a module at a given ``addr``. The module to load can be pass via a ``file_handle`` or the direct ``path`` of the file to load. :

Return a new :class:`ECONTEXT64` aligned on 16 bits temporary workaround or horrible hack ? choose your side

Parse and process the PE file's data directories. If the optional argument 'directories' is given, only the directories at the specif

r""":func:`WmiRequester.query` for default WMI namespace 'root\\cimv2

Read a ``PTR`` at ``addr``

Read a windows UTF16 string at ``addr``

Set the value for ``name`` to ``value``. if ``type`` is None try to guess items

Overwrite, with the given string, the bytes at the file offset corresponding to the given RVA. Return True if successful, False other

Set the word value at the file offset corresponding to the given RVA.