Check whether the file is a Windows driver. This will return true only if there are reliable indicators of the image being a driver.

Check whether the file is a standard executable. This will return true only if the file has the IMAGE_FILE_EXECUTABLE_IMAGE flag set

Called on exception

Called on requested single step ``exception`` is one of the following type: * :class:`windows.winobject.exception.EEXCEPTION_DEBUG_IN

Parse the imported symbols. It will fill a list, which will be available as the dictionary attribute "imports". Its keys will be the

Query the memory informations about page at ``addr`` :rtype: :class:`~windows.generated_def.winstructs.MEMORY_BASIC_INFORMATION`

Read a ``ULONG64`` at ``addr``

Return the name and values of the registers :returns: [(reg_name, value)] -- A :class:`list` of :class:`tuple`

Resolve ``name_or_addr``. If its an int -> Return the :class:`SymbolInfo` at the address. If its a string -> Return the :class:`Symbo

Resume the thread

Set the double word value at the given file offset.

Suspend the thread

Unpacks the UNWIND_INFO "in two calls", with the first call establishing a full size of the structure and the second, performing the actual un

write a dword at ``addr``

Default ``AddRef`` implementation that returns ``1``

Returns a :class:`PEFile` to explore a PE loaded at `baseaddr` in process `target`. :rtype: :class:`PEFile` .. note:: If target is

Parse a Portable Executable file. Loads a PE file, parsing all its structures and making them available through the instance's attrib

Add the intial exe file described by create_process_event to the list of module in the process

Returns 32 or 64

The generator code behind __iter__. Allow to iter over the services on the system