2. The windows objects

Through the system object many classes representing various Windows parts are accessible.

This sections describes them by group of relation.

• 2.1. Processes and Threads
  • 2.1.1. CurrentProcess
  • 2.1.2. CurrentThread
  • 2.1.3. WinProcess
  • 2.1.4. WinThread
• 2.2. PEB Exploration
  • 2.2.1. PEB
  • 2.2.2. LoadedModule
  • 2.2.3. ApiSetMap
• 2.3. PEFile - Parsing loaded PE
  • 2.3.1. windows.pe_parse
    • 2.3.1.1. PEFile
    • 2.3.1.2. IATEntry
• 2.4. Token
  • 2.4.1. Token
  • 2.4.2. TokenGroups
  • 2.4.3. TokenPrivileges
  • 2.4.4. TokenSecurityAttributesInformation
  • 2.4.5. TokenSecurityAttributeV1
• 2.5. Exception and Context related structures
  • 2.5.1. Exception Records
  • 2.5.2. EXCEPTION DEBUG INFO
  • 2.5.3. Context
  • 2.5.4. EXCEPTION POINTERS
  • 2.5.5. Vectored Exception
• 2.6. Registry
  • 2.6.1. Registry
  • 2.6.2. PyHKey
  • 2.6.3. KeyValue
• 2.7. Network
  • 2.7.1. Connections
  • 2.7.2. Firewall
• 2.8. Service
  • 2.8.1. ServiceManager
  • 2.8.2. Service
• 2.9. Volume – The logical drives
• 2.10. WMI – Make request to WMI
  • 2.10.1. WmiManager
  • 2.10.2. WmiNamespace
  • 2.10.3. WmiObject
  • 2.10.4. WmiCallResult
  • 2.10.5. WmiEnumeration
• 2.11. Handle – Processes handles
• 2.12. System Module – Loaded kernel modules
  • 2.12.1. SystemModule
  • 2.12.2. SystemModuleWow64
  • 2.12.3. BaseSystemModule
• 2.13. Object Manager – Kernel objects
  • 2.13.1. ObjectManager
  • 2.13.2. KernelObject
• 2.14. Device Manager
  • 2.14.1. DeviceManager
  • 2.14.2. DeviceClass
  • 2.14.3. DeviceInformationSet
  • 2.14.4. DeviceInstance
  • 2.14.5. LogicalConfiguration
  • 2.14.6. ResourceDescriptor
    • 2.14.6.1. Concrete ResourceDescriptor
• 2.15. Task scheduler
  • 2.15.1. TaskService
  • 2.15.2. TaskFolder
  • 2.15.3. Task
  • 2.15.4. TaskDefinition
    • 2.15.4.1. TaskPrincipal
    • 2.15.4.2. TaskRegistrationInfo
  • 2.15.5. Action
    • 2.15.5.1. Action
    • 2.15.5.2. ExecAction
    • 2.15.5.3. ComHandlerAction
  • 2.15.6. Trigger
  • 2.15.7. Collections
    • 2.15.7.1. TaskFolderCollection
    • 2.15.7.2. TaskCollection
    • 2.15.7.3. ActionCollection
    • 2.15.7.4. TriggerCollection
• 2.16. Event Log
  • 2.16.1. EvtlogManager
  • 2.16.2. Channel
    • 2.16.2.1. EvtChannel
    • 2.16.2.2. ChannelConfig
  • 2.16.3. Publisher
    • 2.16.3.1. EvtPublisher
    • 2.16.3.2. PublisherMetadata
  • 2.16.4. EvtFile
  • 2.16.5. Event
    • 2.16.5.1. EvtEvent
    • 2.16.5.2. EventMetadata
    • 2.16.5.3. EvtQuery
  • 2.16.6. TODO
• 2.17. ETW – Event Tracing for Windows
  • 2.17.1. EtwManager
  • 2.17.2. Tracing Events
    • 2.17.2.1. EtwTrace
    • 2.17.2.2. EventTraceProperties
    • 2.17.2.3. EventRecord