Generic PE format error exception.

Prepare structure object to extract members from data. Format is a list containing definitions for the elements of the structure.

No idea for the name: represent the modRM for single args + encoding in reg (/7 in cmp in man intel)

No idea for the name: represent the modRM for single args + encoding in reg (/7 in cmp in man intel)

A windows registry key

Represent a full ALPC Message: a :class:`AlpcMessagePort` and a :class:`MessageAttribute`

An Event provider

TODO

Represent an object in the Object Manager namespace

The WmiObject (which wrap ``IWbemClassObject``) contains and manipulates both class definitions and class object instances. Can be used as a mappi

A certificate store

The current process

An Event Log channel

A folder of tasks

Represent an enumeration of object that can be itered

Holds exported symbols' information. ordinal: ordinal of the symbol address: address of the symbol name: name of the symbol (

Holds import descriptor information. dll: name of the imported DLL imports: list of imported symbols (ImportData instances) str

Create a UNIQUE PTR around a given Ndr type

A Portable Executable representation. This class provides access to most of the information in a PE file. It expects to be supplied the name

Holds resource directory entry data. struct: IMAGE_RESOURCE_DIRECTORY_ENTRY structure name: If the resource is identified by name t

Represent a service on the system

Extends Structure's functionality with support for bitfields such as: ('B:4,LowerHalf', 'B:4,UpperHalf') To this end, two lists are m

A scheduled task

A Process on the system

The result of a WMI call/query. Real result value type depends of the context

Raw result of the CPUID instruction

Special NOP used in shellcode reduction

Holds base relocation information. struct: IMAGE_BASE_RELOCATION structure entries: list of relocation data (RelocationData instances)

Holds bound import descriptor data. This directory entry will provide information on the DLLs this PE file has been bound to (if bound at all

Holds bound import forwarder reference data. Contains the same information as the bound descriptor but for forwarded DLLs, if any. struc

Represent a PKCS #7 message (see `Low-level Message Functions <https://msdn.microsoft.com/en-us/library/windows/desktop/aa380252(v=vs.85).aspx#low

The current thread

Holds debug information. struct: IMAGE_DEBUG_DIRECTORY structure entries: list of entries (IMAGE_DEBUG_TYPE instances)

A jump to a label :NAME

A Device class, which is mainly a :class:`GUID` with additional attributes

A device instances, can be itered to retrieve the underliyings :class:`DeviceInstance`

An instance of a Device. The properties are from the page https://docs.microsoft.com/en-us/windows/win32/api/setupapi/nf-setupapi-setupdigetdevic

A context manager that disable the SysWow64 Filesystem Redirection :: if is_process_32_bits: def pop_calc_64():

Convenience class for dumping the PE information.

Represent an ETW Trace for tracing/processing events