PythonForWindows (PFW)

PythonForWindows (PFW) provides Pythonic abstractions for interacting with Windows OS features on X86/X64 architectures (supporting both 32-bit and 64-bit Python). It aims to thin the barrier between Python and native execution.

Key features include:

• An ALPC-RPC Client.
• Generated ctypes definitions for Windows APIs.

The library has no external dependencies but relies heavily on the built-in ctypes module.

The windows module is the primary entry point installed via setup.py. It provides access to the current state of the Windows system and offers several submodules for interfacing with Windows and executing native code.

Core objects available directly in the windows namespace include:

• system: An instance of windows.winobject.system.System representing system state.
• current_process: An instance of windows.winobject.process.CurrentProcess representing the active process.
• current_thread: An instance of windows.winobject.process.CurrentThread representing the active thread.

The windows.alpc module provides classes for sending and receiving Advanced Local Procedure Call (ALPC) messages over an ALPC port. It allows for high-performance inter-process communication (IPC) on Windows by providing abstractions for messages, ports, and client/server roles.

Key components include:

• Messages: Representing the data being transferred.
• Ports: The communication channels.
• Client/Server roles: Classes to implement either the requester (AlpcClient) or the listener (AlpcServer).

The windows.security module provides access to Windows security primitives, specifically SecurityDescriptor, Acl (Access Control List), and Ace (Access Control Entry) structures. It also serves as the official entry point for retrieving the Token class, which is deeply related to security descriptors.

import windows.security

# Accessing the Token class via the security module
token_class = windows.security.Token
print(token_class)

The windows.winproxy module provides a Pythonic wrapper around various Windows API DLLs. It is built upon ctypes and windows.generated_def.winfuncs.

Key behaviors:

• Lazy Loading: The relevant DLL is loaded automatically the first time an API from that DLL is called.
• Argument Passing: Parameters can be passed using either ordinals (positional arguments) or keyword arguments.
• Mandatory Parameters: Some functions are 'transparent proxies' where all parameters are mandatory. If a parameter with the default value NeededParameter is not provided, the call will raise a TypeError.
• Error Handling: If an API call fails, the module raises a subclass of WindowsError (specifically WinproxyError).

The windows.native_exec module allows you to create Python functions that call native code. It also includes a simple assembler for x86 and x64 architectures.

Key components:

• windows.native_exec.create_function: Used to create functions from native code.
• windows.native_exec.cpuid: Interface for native CPUID instructions.
• windows.native_exec.simple_x86: X86 assembler.
• windows.native_exec.simple_x64: X64 assembler.
• windows.native_exec.nativeutils: Pre-defined native utility functions.

The windows.rpc module provides tools for Microsoft Remote Procedure Call (MS-RPC) operations using ALPC. It allows you to find interface endpoints, connect to them, bind to interfaces, perform calls, and handle NDR (Network Data Representation) marshalling/unmarshalling.

Key capabilities include:

• Finding interface endpoints via UUID.
• Connecting to an endpoint and binding to an interface.
• Marshalling data using the windows.rpc.ndr module.

The WMI module uses several specialized classes to represent the hierarchy of WMI data:

• WmiNamespace: Represents a specific WMI namespace (e.g., root\cimv2).
• WmiObject: Represents a single WMI instance. It supports item access via __getitem__ and __setitem__, and can be invoked via __call__.
• WmiEnumeration: Represents a collection of WMI objects. It supports iteration (__iter__) and invocation (__call__).
• WmiCallResult: Represents the result of a WMI method call.