winKernel module

Functions that wrap Windows API functions from kernel32.dll and advapi32.dll.

When working on this file, consider moving to winAPI.

winKernel.GetStdHandle(handleID)
winKernel.CreateFile(fileName, desiredAccess, shareMode, securityAttributes, creationDisposition, flags, templateFile)
winKernel.createEvent(eventAttributes=None, manualReset=False, initialState=False, name=None)
winKernel.createWaitableTimer(securityAttributes=None, manualReset=False, name=None)

Wrapper to the kernel32 CreateWaitableTimer function. Consult https://msdn.microsoft.com/en-us/library/windows/desktop/ms682492.aspx for Microsoft’s documentation. In contrast with the original function, this wrapper assumes the following defaults. @param securityAttributes: Defaults to C{None};

The timer object gets a default security descriptor and the handle cannot be inherited. The ACLs in the default security descriptor for a timer come from the primary or impersonation token of the creator.

@type securityAttributes: pointer to L{SECURITY_ATTRIBUTES} @param manualReset: Defaults to C{False} which means the timer is a synchronization timer.

If C{True}, the timer is a manual-reset notification timer.

@type manualReset: bool @param name: Defaults to C{None}, the timer object is created without a name. @type name: str

winKernel.setWaitableTimer(handle, dueTime, period=0, completionRoutine=None, arg=None, resume=False)

Wrapper to the kernel32 SETWaitableTimer function. Consult https://msdn.microsoft.com/en-us/library/windows/desktop/ms686289.aspx for Microsoft’s documentation. @param handle: A handle to the timer object. @type handle: int @param dueTime: Relative time (in miliseconds).

Note that the original function requires relative time to be supplied as a negative nanoseconds value.

@type dueTime: int @param period: Defaults to 0, timer is only executed once.

Value should be supplied in miliseconds.

@type period: int @param completionRoutine: The function to be executed when the timer elapses. @type completionRoutine: L{PAPCFUNC} @param arg: Defaults to C{None}; a pointer to a structure that is passed to the completion routine. @type arg: L{ctypes.c_void_p} @param resume: Defaults to C{False}; the system is not restored.

If this parameter is TRUE, restores a system in suspended power conservation mode when the timer state is set to signaled.

@type resume: bool

winKernel.openProcess(*args)
winKernel.closeHandle(*args)
winKernel.GetSystemPowerStatus(sps: SystemPowerStatus) int
winKernel.getThreadLocale()
winKernel.suspendWow64Redirection()

Context manager which disables Wow64 redirection for a section of code and re-enables it afterwards

class winKernel.SYSTEMTIME

Bases: Structure

_fields_ = (('wYear', <class 'ctypes.c_ushort'>), ('wMonth', <class 'ctypes.c_ushort'>), ('wDayOfWeek', <class 'ctypes.c_ushort'>), ('wDay', <class 'ctypes.c_ushort'>), ('wHour', <class 'ctypes.c_ushort'>), ('wMinute', <class 'ctypes.c_ushort'>), ('wSecond', <class 'ctypes.c_ushort'>), ('wMilliseconds', <class 'ctypes.c_ushort'>))
wDay

Structure/Union member

wDayOfWeek

Structure/Union member

wHour

Structure/Union member

wMilliseconds

Structure/Union member

wMinute

Structure/Union member

wMonth

Structure/Union member

wSecond

Structure/Union member

wYear

Structure/Union member

class winKernel.FILETIME

Bases: Structure

_fields_ = (('dwLowDateTime', <class 'ctypes.c_ulong'>), ('dwHighDateTime', <class 'ctypes.c_ulong'>))
dwHighDateTime

Structure/Union member

dwLowDateTime

Structure/Union member

class winKernel.TIME_ZONE_INFORMATION

Bases: Structure

_fields_ = (('Bias', <class 'ctypes.c_long'>), ('StandardName', <class 'winKernel.c_wchar_Array_32'>), ('StandardDate', <class 'winKernel.SYSTEMTIME'>), ('StandardBias', <class 'ctypes.c_long'>), ('DaylightName', <class 'winKernel.c_wchar_Array_32'>), ('DaylightDate', <class 'winKernel.SYSTEMTIME'>), ('DaylightBias', <class 'ctypes.c_long'>))
Bias

Structure/Union member

DaylightBias

Structure/Union member

DaylightDate

Structure/Union member

DaylightName

Structure/Union member

StandardBias

Structure/Union member

StandardDate

Structure/Union member

StandardName

Structure/Union member

winKernel.time_tToFileTime(time_tToConvert: float) FILETIME

Converts time_t as returned from time.time to a FILETIME structure. Based on a code snipped from: https://docs.microsoft.com/en-us/windows/win32/sysinfo/converting-a-time-t-value-to-a-file-time

winKernel.FileTimeToSystemTime(lpFileTime: FILETIME, lpSystemTime: SYSTEMTIME) None
winKernel.SystemTimeToTzSpecificLocalTime(lpTimeZoneInformation: TIME_ZONE_INFORMATION | None, lpUniversalTime: SYSTEMTIME, lpLocalTime: SYSTEMTIME) None

Wrapper for SystemTimeToTzSpecificLocalTime from kernel32. :param lpTimeZoneInformation: Either TIME_ZONE_INFORMATION containing info about the desired time zone or None when the current time zone as configured in Windows settings should be used. :param lpUniversalTime: SYSTEMTIME structure containing time in UTC wwhich you wish to convert. : param lpLocalTime: A SYSTEMTIME structure in which time converted to the desired time zone would be placed. :raises WinError

winKernel.GetDateFormatEx(Locale, dwFlags, date, lpFormat)
winKernel.GetTimeFormatEx(Locale, dwFlags, date, lpFormat)
winKernel.virtualAllocEx(*args)
winKernel.virtualFreeEx(*args)
winKernel.readProcessMemory(*args)
winKernel.writeProcessMemory(*args)
winKernel.waitForSingleObject(handle, timeout)
winKernel.waitForSingleObjectEx(handle, timeout, alertable)
winKernel.SetProcessShutdownParameters(level, flags)
winKernel.GetExitCodeProcess(process)
winKernel.TerminateProcess(process, exitCode)
winKernel.GetDriveType(rootPathName)
class winKernel.SECURITY_ATTRIBUTES(**kwargs)

Bases: Structure

_fields_ = (('nLength', <class 'ctypes.c_ulong'>), ('lpSecurityDescriptor', <class 'ctypes.c_void_p'>), ('bInheritHandle', <class 'ctypes.c_long'>))
bInheritHandle

Structure/Union member

lpSecurityDescriptor

Structure/Union member

nLength

Structure/Union member

winKernel.CreatePipe(pipeAttributes, size)
class winKernel.STARTUPINFOW(**kwargs)

Bases: Structure

_fields_ = (('cb', <class 'ctypes.c_ulong'>), ('lpReserved', <class 'ctypes.c_wchar_p'>), ('lpDesktop', <class 'ctypes.c_wchar_p'>), ('lpTitle', <class 'ctypes.c_wchar_p'>), ('dwX', <class 'ctypes.c_ulong'>), ('dwY', <class 'ctypes.c_ulong'>), ('dwXSize', <class 'ctypes.c_ulong'>), ('dwYSize', <class 'ctypes.c_ulong'>), ('dwXCountChars', <class 'ctypes.c_ulong'>), ('dwYCountChars', <class 'ctypes.c_ulong'>), ('dwFillAttribute', <class 'ctypes.c_ulong'>), ('dwFlags', <class 'ctypes.c_ulong'>), ('wShowWindow', <class 'ctypes.c_ushort'>), ('cbReserved2', <class 'ctypes.c_ushort'>), ('lpReserved2', <class 'ctypes.wintypes.LP_c_byte'>), ('hSTDInput', <class 'ctypes.c_void_p'>), ('hSTDOutput', <class 'ctypes.c_void_p'>), ('hSTDError', <class 'ctypes.c_void_p'>))
cb

Structure/Union member

cbReserved2

Structure/Union member

dwFillAttribute

Structure/Union member

dwFlags

Structure/Union member

dwX

Structure/Union member

dwXCountChars

Structure/Union member

dwXSize

Structure/Union member

dwY

Structure/Union member

dwYCountChars

Structure/Union member

dwYSize

Structure/Union member

hSTDError

Structure/Union member

hSTDInput

Structure/Union member

hSTDOutput

Structure/Union member

lpDesktop

Structure/Union member

lpReserved

Structure/Union member

lpReserved2

Structure/Union member

lpTitle

Structure/Union member

wShowWindow

Structure/Union member

winKernel.STARTUPINFO

alias of STARTUPINFOW

class winKernel.PROCESS_INFORMATION

Bases: Structure

_fields_ = (('hProcess', <class 'ctypes.c_void_p'>), ('hThread', <class 'ctypes.c_void_p'>), ('dwProcessID', <class 'ctypes.c_ulong'>), ('dwThreadID', <class 'ctypes.c_ulong'>))
dwProcessID

Structure/Union member

dwThreadID

Structure/Union member

hProcess

Structure/Union member

hThread

Structure/Union member

winKernel.CreateProcessAsUser(token, applicationName, commandLine, processAttributes, threadAttributes, inheritHandles, creationFlags, environment, currentDirectory, startupInfo, processInformation)
winKernel.GetCurrentProcess()
winKernel.OpenProcessToken(ProcessHandle, DesiredAccess)
winKernel.DuplicateHandle(sourceProcessHandle, sourceHandle, targetProcessHandle, desiredAccess, inheritHandle, options)
class winKernel.HGLOBAL(h, autoFree=True)

Bases: c_void_p

A class for the HGLOBAL Windows handle type. This class can auto-free the handle when it goes out of scope, and also contains a classmethod for alloc, And a context manager compatible method for locking.

@param h: the raw Windows HGLOBAL handle @param autoFree: True by default, the handle will automatically be freed with GlobalFree when this object goes out of scope.

classmethod alloc(flags, size)

Allocates global memory with GlobalAlloc providing it as an instance of this class. This method Takes the same arguments as GlobalAlloc.

lock()

Used as a context manager, This method locks the global memory with GlobalLock, providing the usable memory address to the body of the ‘with’ statement. When the body completes, GlobalUnlock is automatically called.

forget()

Sets this HGLOBAL value to NULL, forgetting the existing value. Necessary if you pass this HGLOBAL to an API that takes ownership and therefore will handle freeing itself.

winKernel.moveFileEx(lpExistingFileName: str, lpNewFileName: str, dwFlags: int)
winKernel.SetThreadExecutionState(esFlags)
winKernel.LCIDToLocaleName(windowsLCID: c_ulong) str | None