The values of the event in a list

Execute a WQL query with custom flags and returns a ::class:`WmiEnumeration` that can be used to iter the result with timeouts :retur

Ask the EPMapper for ALPC endpoints of ``targetiid:version`` (maximum of ``nb_response``) :param str targetiid: The IID of the requested inte

Return the :class:`TaskFolder` with ``name`` :rtype: :class:`TaskFolder`

Craft an ALPC message containing an RPC request to call ``method_offset`` of interface ``IID` with ``params``. Can be used to craft re

Retrieve the security descriptor described by the binary ``data``. Binary security descriptor can be found in the registry for example

Return the :class:`ChannelConfig` for the channel ``name``

The :class:`PublisherMetadata` for the publisher ``name``

Retrieve the security descriptor for the service named ``service``

Process the data directories. This method will load the data directories which might not have been loaded if the "fast_load" option w

Retrieve the object ``name`` in the current directory. :rtype: :class:`KernelObject`

.

Return embded :class:`Certificate` number ``index``. .. note:: Not all embded certificate are directly used to sign the :class:`

Return the double word value at the given RVA. Returns None if the value can't be read, i.e. the RVA can't be mapped to a file offset

Return the metadata for the event ID ``id`` :rtype: :class:`EventMetadata`

Return the bitness in which the exception occured. Useful when debugingg a 32b process from a 64bits one :return: :class:`int`

Get the ``Windows`` HANDLE of a python :class:`file`

Get the memory breakpoint that handle ``addr`` Return values are: * ``False`` if the page has no memory breakpoint (real fault)

Gets the physical address in the PE file from an RVA value.

Return the list of properties names available for the current object. If ``system_properties`` is ``False`` property names begining with ``_``

Return the quad-word value at the given RVA. Returns None if the value can't be read, i.e. the RVA can't be mapped to a file offset.

TODO: DOC

Get the return address of the current target, only valid in the trigger() function.

Get the RVA of the string.

Returns the signer informations for signer nb ``index`` :return: :class:`~windows.generated_def.winstructs.CMSG_SIGNER_INFO`

Get the text in its current state.

Retrieve the value of property ``name`` as a :class:`~windows.com.Variant` :return: :class:`~windows.com.Variant`

Retrieve the value of property ``name`` as a :class:`~windows.com.Variant` :return: :class:`~windows.com.Variant`

Postulate: PYDLL is already loaded in target process

get_vendor_id() == 'AuthenticAMD

Return :obj:`True` if DLL/Api can be found

get_vendor_id() == 'GenuineIntel