intellicrack.bridges.win32_types

Shared Win32 ctypes structures, constants, and DLL helpers.

Pure type definitions and constant values for Win32 API interop. Used by ProcessBridge and other bridge modules that need direct Windows API access. Contains no business logic.

PE_HEADER_OFFSET: Final[int] = 60: Offset of the e_lfanew field inside the DOS header pointing to the NT headers.

PE_MAGIC_OFFSET: Final[int] = 64: Byte immediately following the e_lfanew field (4-byte little-endian).

NT_HEADERS_OPTIONAL_OFFSET: Final[int] = 24: Offset from the NT headers signature to the start of the OptionalHeader.

class OVERLAPPED[source]

Bases: Structure

Windows OVERLAPPED structure for asynchronous (overlapped) file I/O.

Required alongside FILE_FLAG_OVERLAPPED for ReadFile/ WriteFile/ConnectNamedPipe calls that must be able to run concurrently on one handle from different threads (for example a named-pipe client’s background reader thread and its command-writer thread) without one operation blocking the other’s completion, which a synchronous (non-overlapped) handle does not support safely.

Internal: Structure/Union member

InternalHigh: Structure/Union member

Offset: Structure/Union member

OffsetHigh: Structure/Union member

hEvent: Structure/Union member

class PROCESSENTRY32[source]

Bases: Structure

Windows PROCESSENTRY32 structure for process snapshot enumeration.

cntThreads: Structure/Union member

cntUsage: Structure/Union member

dwFlags: Structure/Union member

dwSize: Structure/Union member

pcPriClassBase: Structure/Union member

szExeFile: Structure/Union member

th32DefaultHeapID: Structure/Union member

th32ModuleID: Structure/Union member

th32ParentProcessID: Structure/Union member

th32ProcessID: Structure/Union member

class THREADENTRY32[source]

Bases: Structure

Windows THREADENTRY32 structure for thread snapshot enumeration.

cntUsage: Structure/Union member

dwFlags: Structure/Union member

dwSize: Structure/Union member

th32OwnerProcessID: Structure/Union member

th32ThreadID: Structure/Union member

tpBasePri: Structure/Union member

tpDeltaPri: Structure/Union member

class MODULEENTRY32[source]

Bases: Structure

Windows MODULEENTRY32 structure for module snapshot enumeration.

GlblcntUsage: Structure/Union member

ProccntUsage: Structure/Union member

dwSize: Structure/Union member

hModule: Structure/Union member

modBaseAddr: Structure/Union member

modBaseSize: Structure/Union member

szExePath: Structure/Union member

szModule: Structure/Union member

th32ModuleID: Structure/Union member

th32ProcessID: Structure/Union member

class MEMORY_BASIC_INFORMATION[source]

Bases: Structure

Windows MEMORY_BASIC_INFORMATION structure for virtual memory queries.

AllocationBase: Structure/Union member

AllocationProtect: Structure/Union member

BaseAddress: Structure/Union member

Protect: Structure/Union member

RegionSize: Structure/Union member

State: Structure/Union member

Type: Structure/Union member

MemoryBasicInformation: alias of MEMORY_BASIC_INFORMATION

class PROCESS_MEMORY_COUNTERS[source]

Bases: Structure

Windows PROCESS_MEMORY_COUNTERS structure from psapi.

PageFaultCount: Structure/Union member

PagefileUsage: Structure/Union member

PeakPagefileUsage: Structure/Union member

PeakWorkingSetSize: Structure/Union member

QuotaNonPagedPoolUsage: Structure/Union member

QuotaPagedPoolUsage: Structure/Union member

QuotaPeakNonPagedPoolUsage: Structure/Union member

QuotaPeakPagedPoolUsage: Structure/Union member

WorkingSetSize: Structure/Union member

cb: Structure/Union member

class LUID[source]

Bases: Structure

Windows LUID structure for privilege identification.

HighPart: Structure/Union member

LowPart: Structure/Union member

class LUID_AND_ATTRIBUTES[source]

Bases: Structure

Windows LUID_AND_ATTRIBUTES structure for privilege state.

Attributes: Structure/Union member

Luid: Structure/Union member

class TOKEN_PRIVILEGES[source]

Bases: Structure

Windows TOKEN_PRIVILEGES structure for privilege adjustment.

PrivilegeCount: Structure/Union member

Privileges: Structure/Union member

class UNICODE_STRING[source]

Bases: Structure

Windows UNICODE_STRING structure from ntdll.

Buffer: Structure/Union member

Length: Structure/Union member

MaximumLength: Structure/Union member

class PROCESS_BASIC_INFORMATION[source]

Bases: Structure

NtQueryInformationProcess result for ProcessBasicInformation.

AffinityMask: Structure/Union member

BasePriority: Structure/Union member

ExitStatus: Structure/Union member

InheritedFromUniqueProcessId: Structure/Union member

PebBaseAddress: Structure/Union member

UniqueProcessId: Structure/Union member

class THREAD_BASIC_INFORMATION[source]

Bases: Structure

NtQueryInformationThread result for ThreadBasicInformation.

AffinityMask: Structure/Union member

BasePriority: Structure/Union member

ClientId_UniqueProcess: Structure/Union member

ClientId_UniqueThread: Structure/Union member

ExitStatus: Structure/Union member

Priority: Structure/Union member

TebBaseAddress: Structure/Union member

class SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX[source]

Bases: Structure

Single handle entry from SystemExtendedHandleInformation.

CreatorBackTraceIndex: Structure/Union member

GrantedAccess: Structure/Union member

HandleAttributes: Structure/Union member

HandleValue: Structure/Union member

Object: Structure/Union member

ObjectTypeIndex: Structure/Union member

Reserved: Structure/Union member

UniqueProcessId: Structure/Union member

class SYSTEM_HANDLE_INFORMATION_EX[source]

Bases: Structure

Header for SystemExtendedHandleInformation result buffer.

Handles: Structure/Union member

NumberOfHandles: Structure/Union member

Reserved: Structure/Union member

class HEAPLIST32[source]

Bases: Structure

Windows HEAPLIST32 structure for heap snapshot enumeration.

dwFlags: Structure/Union member

dwSize: Structure/Union member

th32HeapID: Structure/Union member

th32ProcessID: Structure/Union member

class HEAPENTRY32[source]

Bases: Structure

Windows HEAPENTRY32 structure for heap block enumeration.

dwAddress: Structure/Union member

dwBlockSize: Structure/Union member

dwFlags: Structure/Union member

dwLockCount: Structure/Union member

dwResvd: Structure/Union member

dwSize: Structure/Union member

hHandle: Structure/Union member

th32HeapID: Structure/Union member

th32ProcessID: Structure/Union member

class M128A[source]

Bases: Structure

128-bit register value for XMM/SSE context.

High: Structure/Union member

Low: Structure/Union member

class CONTEXT64[source]

Bases: Structure

AMD64 CONTEXT structure for GetThreadContext/SetThreadContext.

ContextFlags: Structure/Union member

DebugControl: Structure/Union member

Dr0: Structure/Union member

Dr1: Structure/Union member

Dr2: Structure/Union member

Dr3: Structure/Union member

Dr6: Structure/Union member

Dr7: Structure/Union member

EFlags: Structure/Union member

FltSave: Structure/Union member

LastBranchFromRip: Structure/Union member

LastBranchToRip: Structure/Union member

LastExceptionFromRip: Structure/Union member

LastExceptionToRip: Structure/Union member

MxCsr: Structure/Union member

P1Home: Structure/Union member

P2Home: Structure/Union member

P3Home: Structure/Union member

P4Home: Structure/Union member

P5Home: Structure/Union member

P6Home: Structure/Union member

R10: Structure/Union member

R11: Structure/Union member

R12: Structure/Union member

R13: Structure/Union member

R14: Structure/Union member

R15: Structure/Union member

R8: Structure/Union member

R9: Structure/Union member

Rax: Structure/Union member

Rbp: Structure/Union member

Rbx: Structure/Union member

Rcx: Structure/Union member

Rdi: Structure/Union member

Rdx: Structure/Union member

Rip: Structure/Union member

Rsi: Structure/Union member

Rsp: Structure/Union member

SegCs: Structure/Union member

SegDs: Structure/Union member

SegEs: Structure/Union member

SegFs: Structure/Union member

SegGs: Structure/Union member

SegSs: Structure/Union member

VectorControl: Structure/Union member

VectorRegister: Structure/Union member

class FLOATING_SAVE_AREA[source]

Bases: Structure

I386 FLOATING_SAVE_AREA structure.

ControlWord: Structure/Union member

DataOffset: Structure/Union member

DataSelector: Structure/Union member

ErrorOffset: Structure/Union member

ErrorSelector: Structure/Union member

RegisterArea: Structure/Union member

Spare0: Structure/Union member

StatusWord: Structure/Union member

TagWord: Structure/Union member

class CONTEXT32[source]

Bases: Structure

I386 CONTEXT structure for 32-bit thread context.

ContextFlags: Structure/Union member

Dr0: Structure/Union member

Dr1: Structure/Union member

Dr2: Structure/Union member

Dr3: Structure/Union member

Dr6: Structure/Union member

Dr7: Structure/Union member

EFlags: Structure/Union member

Eax: Structure/Union member

Ebp: Structure/Union member

Ebx: Structure/Union member

Ecx: Structure/Union member

Edi: Structure/Union member

Edx: Structure/Union member

Eip: Structure/Union member

Esi: Structure/Union member

Esp: Structure/Union member

FloatSave: Structure/Union member

SegCs: Structure/Union member

SegDs: Structure/Union member

SegEs: Structure/Union member

SegFs: Structure/Union member

SegGs: Structure/Union member

SegSs: Structure/Union member

WOW64_CONTEXT

WOW64 thread context alias.

The WOW64 subsystem exposes the same I386 CONTEXT layout under the name WOW64_CONTEXT for use with Wow64GetThreadContext / Wow64SetThreadContext against 32-bit threads hosted inside a 64-bit process. The layout is identical to CONTEXT32, so aliasing keeps the Win32 types surface minimal while making call sites self-documenting.

class ADDRESS64[source]

Bases: Structure

DbgHelp ADDRESS64 structure for stack walking.

Mode: Structure/Union member

Offset: Structure/Union member

Segment: Structure/Union member

class STACKFRAME64[source]

Bases: Structure

DbgHelp STACKFRAME64 structure for stack frame enumeration.

AddrBStore: Structure/Union member

AddrFrame: Structure/Union member

AddrPC: Structure/Union member

AddrReturn: Structure/Union member

AddrStack: Structure/Union member

Far: Structure/Union member

FuncTableEntry: Structure/Union member

KdHelp: Structure/Union member

Params: Structure/Union member

Reserved: Structure/Union member

Virtual: Structure/Union member

class SYMBOL_INFO[source]

Bases: Structure

DbgHelp SYMBOL_INFO structure for symbol resolution.

Address: Structure/Union member

Flags: Structure/Union member

Index: Structure/Union member

MaxNameLen: Structure/Union member

ModBase: Structure/Union member

Name: Structure/Union member

NameLen: Structure/Union member

Register: Structure/Union member

Reserved: Structure/Union member

Scope: Structure/Union member

Size: Structure/Union member

SizeOfStruct: Structure/Union member

Tag: Structure/Union member

TypeIndex: Structure/Union member

Value: Structure/Union member

class EXCEPTION_REGISTRATION_RECORD[source]

Bases: Structure

SEH exception registration record (linked list node).

Handler: Structure/Union member

Next: Structure/Union member

class SERVICE_STATUS_PROCESS[source]

Bases: Structure

Windows SERVICE_STATUS_PROCESS structure from advapi32.

dwCheckPoint: Structure/Union member

dwControlsAccepted: Structure/Union member

dwCurrentState: Structure/Union member

dwProcessId: Structure/Union member

dwServiceFlags: Structure/Union member

dwServiceSpecificExitCode: Structure/Union member

dwServiceType: Structure/Union member

dwWaitHint: Structure/Union member

dwWin32ExitCode: Structure/Union member

class ENUM_SERVICE_STATUS_PROCESSW[source]

Bases: Structure

Windows ENUM_SERVICE_STATUS_PROCESSW structure for service enumeration.

ServiceStatusProcess: Structure/Union member

lpDisplayName: Structure/Union member

lpServiceName: Structure/Union member

class IO_COUNTERS[source]

Bases: Structure

Windows IO_COUNTERS structure for job object info.

OtherOperationCount: Structure/Union member

OtherTransferCount: Structure/Union member

ReadOperationCount: Structure/Union member

ReadTransferCount: Structure/Union member

WriteOperationCount: Structure/Union member

WriteTransferCount: Structure/Union member

class JOBOBJECT_BASIC_LIMIT_INFORMATION[source]

Bases: Structure

Windows JOBOBJECT_BASIC_LIMIT_INFORMATION structure.

ActiveProcessLimit: Structure/Union member

Affinity: Structure/Union member

LimitFlags: Structure/Union member

MaximumWorkingSetSize: Structure/Union member

MinimumWorkingSetSize: Structure/Union member

PerJobUserTimeLimit: Structure/Union member

PerProcessUserTimeLimit: Structure/Union member

PriorityClass: Structure/Union member

SchedulingClass: Structure/Union member

class JOBOBJECT_EXTENDED_LIMIT_INFORMATION[source]

Bases: Structure

Windows JOBOBJECT_EXTENDED_LIMIT_INFORMATION structure.

BasicLimitInformation: Structure/Union member

IoInfo: Structure/Union member

JobMemoryLimit: Structure/Union member

PeakJobMemoryUsed: Structure/Union member

PeakProcessMemoryUsed: Structure/Union member

ProcessMemoryLimit: Structure/Union member

class PROCESS_MITIGATION_DEP_POLICY[source]

Bases: Structure

DEP mitigation policy flags.

Flags: Structure/Union member

Permanent: Structure/Union member

class PROCESS_MITIGATION_ASLR_POLICY[source]

Bases: Structure

ASLR mitigation policy flags.

Flags: Structure/Union member

class PROCESS_MITIGATION_DYNAMIC_CODE_POLICY[source]

Bases: Structure

Dynamic code mitigation policy flags.

Flags: Structure/Union member

class PROCESS_MITIGATION_STRICT_HANDLE_CHECK_POLICY[source]

Bases: Structure

Strict handle check mitigation policy flags.

Flags: Structure/Union member

class PROCESS_MITIGATION_SYSTEM_CALL_DISABLE_POLICY[source]

Bases: Structure

System call disable mitigation policy flags.

Flags: Structure/Union member

class PROCESS_MITIGATION_CONTROL_FLOW_GUARD_POLICY[source]

Bases: Structure

Control Flow Guard mitigation policy flags.

Flags: Structure/Union member

class PROCESS_MITIGATION_BINARY_SIGNATURE_POLICY[source]

Bases: Structure

Binary signature mitigation policy flags.

Flags: Structure/Union member

class PROCESS_MITIGATION_IMAGE_LOAD_POLICY[source]

Bases: Structure

Image load mitigation policy flags.

Flags: Structure/Union member

class PROCESS_MITIGATION_FONT_DISABLE_POLICY[source]

Bases: Structure

Font disable mitigation policy flags.

Flags: Structure/Union member

get_kernel32()[source]

Cached handle to kernel32.dll.

Returns:: Handle to kernel32.dll.
Return type:: WinDLL
Raises:: OSError – If kernel32.dll cannot be loaded.

get_ntdll()[source]

Cached handle to ntdll.dll.

Returns:: Handle to ntdll.dll.
Return type:: WinDLL
Raises:: OSError – If ntdll.dll cannot be loaded.

get_advapi32()[source]

Cached handle to advapi32.dll.

Returns:: Handle to advapi32.dll.
Return type:: WinDLL
Raises:: OSError – If advapi32.dll cannot be loaded.

get_user32()[source]

Cached handle to user32.dll.

Returns:: Handle to user32.dll.
Return type:: WinDLL
Raises:: OSError – If user32.dll cannot be loaded.

get_dbghelp()[source]

Cached handle to dbghelp.dll.

Returns:: Handle to dbghelp.dll.
Return type:: WinDLL
Raises:: OSError – If dbghelp.dll cannot be loaded.

get_psapi()[source]

Cached handle to psapi.dll.

Returns:: Handle to psapi.dll.
Return type:: WinDLL
Raises:: OSError – If psapi.dll cannot be loaded.

class MemoryProtectionFlags[source]

Bases: TypedDict

Decoded Win32 page protection flags.

Captures the structured access bits behind a PAGE_* constant so callers can reason about each capability without parsing a string.

Variables:

read (bool) – True when the region is readable.
write (bool) – True when the region is writable.
execute (bool) – True when the region is executable.
copy_on_write (bool) – True when PAGE_WRITECOPY semantics apply.
guard (bool) – True when PAGE_GUARD is set.
raw (int) – The original PAGE_* value for round-tripping.

read: bool

write: bool

execute: bool

copy_on_write: bool

guard: bool

raw: int

decode_protection(prot)[source]

Decode a Win32 memory protection constant into structured flags.

Splits the raw PAGE_* value into its individual access bits so bridges can preserve the semantics of WriteCopy, Guard, and the underlying R/W/X capabilities without dropping information through a string round-trip.

Parameters:: prot (int) – Win32 PAGE_* protection value (may include modifier bits like PAGE_GUARD).
Returns:: Decoded flags including the original raw value. Unknown base protections leave every access flag cleared and emit a debug log entry.
Return type:: MemoryProtectionFlags

protection_to_string(prot)[source]

Convert a Win32 memory protection constant to a human-readable string.

Thin formatter built on top of decode_protection(); preserves the legacy rwx/rw-c/+G rendering used by MemoryRegion and the audit log fields. Use decode_protection() directly when you need to branch on individual access bits.

Parameters:: prot (int) – Win32 PAGE_* protection value.
Returns:: Protection string like rwx, r--, rw-c, +G.
Return type:: str

state_to_string(state)[source]

Convert a Win32 memory state constant to a human-readable string.

Recognised values render the canonical lowercase label. Unknown values render "unknown(0x...)" and emit a debug log so the offending state cannot vanish silently into a generic bucket.

Parameters:: state (int) – Win32 MEM_* state value.
Returns:: State label such as committed, reserved, free, or unknown(0x...) for unrecognised values.
Return type:: str

mem_type_to_string(mem_type)[source]

Convert a Win32 memory type constant to a human-readable string.

Recognised values render the canonical lowercase label. Unknown values render "unknown(0x...)" and emit a debug log so the offending type cannot vanish silently into a generic bucket.

Parameters:: mem_type (int) – Win32 MEM_* type value.
Returns:: Type label such as private, mapped, image, or unknown(0x...) for unrecognised values.
Return type:: str