[WIP] api may change

Return an iterator with a custom ``timeout``

Computes how many UNWIND_CODE structures UNWIND_CODE occupies. May be called before initialize() and, for that reason, should not rely on

Parse a memory access string of format ``[EXPR]`` or ``seg:[EXPR]`` ``EXPR`` may describe: ``BASE | INDEX * SCALE | DISPLACEMENT`` or any comb

Parse a memory access string of format [EXPR] or seg:[EXPR] EXPR may describe: BASE | INDEX * SCALE | DISPLACEMENT or any combinaison (in this

Return the next object in the enumeration with `timeout`. :raises: ``WindowsError(WBEM_S_TIMEDOUT)`` if timeout expire :returns: :cla

Called on create_process event :param CREATE_PROCESS_DEBUG_INFO create_process:

Called on create_thread event :param CREATE_THREAD_DEBUG_INFO create_thread:

Called on exit_process event :param EXIT_PROCESS_DEBUG_INFO exit_process:

Called on exit_thread event :param EXIT_THREAD_DEBUG_INFO exit_thread:

Called on load_dll event :param LOAD_DLL_DEBUG_INFO load_dll:

Called on debug_string event :param OUTPUT_DEBUG_STRING_INFO debug_string:

Called on rip_info event :param RIP_INFO rip_info:

Called on the first breakpoint event occuring in the debugger. This callback allow to setup hook / interact with the debugee when ready:

Called on unload_dll event :param UNLOAD_DLL_DEBUG_INFO unload_dll:

Open the Evt channel with ``name`` :rtype: :class:`EvtChannel`

Open the evtx file with ``filename`` :rtype: :class:`EvtFile`

Open the Evt publisher with ``name`` :rtype: :class:`EvtPublisher`

Parse a data entry from the resources directory.

Parse a directory entry from the resources directory.

Parses the rich header see http://www.ntcore.com/files/richsign.htm for more information Structure: 00 DanS ^ checksum, check

Fetch the PE file sections. The sections will be readily available in the "sections" attribute. Its attributes will contain all the s

Parse version information structure. The date will be made available in three attributes of the PE object. VS_VERSIONINFO will con

Process the event retrieved by the trace. This function will call ``callback`` with any :class:`EventRecord` in the trace. ``begin/end

Query the event with the ``ids`` or perform a query with the raw query ``filter`` Both parameters are mutually exclusive. .. note::

Resolve the link object with path ``linkpath``

Send an object from the pipe

Apply the relocation information to the image using the provided image base. This method will apply the relocation information to the image.

Reopen the registry key with a new ``sam`` :rtype: :class:`PyHKey`

Re-setup all memory breakpoints, affecting pages access rights. If target is ``None``, use ``current_process`` ``data`` is the

Called at the return of the function if :func:`break_on_ret` was called

r""":func:`WmiRequester.select` for default WMI namespace 'root\\cimv2

Send an object on the pipe

Send and receive a message with ``flags``. :param alpc_message: The message to send. If ``alpc_message`` is a :class:`str` it build an Al

Set the path of the ``dbghelp.dll`` file to use. It allow to configure a different version of the DLL handling PDB downloading. If ``path`` is a

Set the double word value at the file offset corresponding to the given RVA.

Setup a hook on the entry and return it. You MUST keep a reference to the hook while the hook is enabled. :param callback: the hook

Set the quad-word value at the file offset corresponding to the given RVA.

Set a syswow thread's 64 context to ``context``

Set the word value at the given file offset.

Make the current thread to single step

stop the tracing. ``soft`` will allow to stop a non-existing trace that do not exists/run. This allow for simpler script that stop/st

Resolve the target of a symbolic link object. :rtype: :class:`str` or None if object is not a link

Create a remote structure for a 32bits target process

Create a remote structure for a 64bits target process

Create a remote union for a 32bits target process