# Path: nitro/backends/process.py
# class Process:
#     """
#     Base class for processes. ``Process`` provides accesss to information about a
#     particular process as well as a method for reading and writing its memory.
#     """
# 
#     __slots__ = (
#         "libvmi",
#         "cr3",
#     )
# 
#     def __init__(self, libvmi, cr3):
#         self.libvmi = libvmi
#         self.cr3 = cr3
# 
#     @property
#     def pid(self):
#         raise NotImplementedError("pid must be overridden by a subclass")
# 
#     @property
#     def name(self):
#         raise NotImplementedError("name must be overridden by a subclass")
# 
#     def as_dict(self):
#         """
#         Returns a dictionary representing the process.
# 
#         :rtype: dict
#         """
#         return {
#             'name': self.name,
#             'pid': self.pid
#         }
# 
#     def read_memory(self, addr, count):
#         """
#         Read ``count`` bytes at address ``addr`` from the process' address space.
#         
#         :raises: LibvmiError
#         """
#         buffer, bytes_read = self.libvmi.read_va(addr, self.pid, count)
#         if bytes_read != count:
#             raise RuntimeError('Fail to read memory')
#         return buffer
# 
#     def write_memory(self, addr, buffer):
#         """
#         Write ``buffer`` at address ``addr`` in the process' address space.
# 
#         :raises: LibvmiError
#         """
#         self.libvmi.write_va(addr, self.pid, buffer)
# 
# Path: nitro/backends/windows/types.py
# class PEB(WinStruct):
#     __slots__ = (
#         'ProcessParameters'
#     )
# 
#     _fields_ = [
#         (0x20, 'ProcessParameters', 'P')
#     ]
# 
#     def __init__(self, addr, process):
#         super().__init__(addr, process)
#         self.ProcessParameters = RtlUserProcessParameters(
#             self.ProcessParameters, process)
# 
# class UnicodeString(WinStruct):
#     __slots__ = (
#         'Length',
#         'MaximumLength',
#         'Buffer',
#     )
# 
#     _fields_ = [
#         (0, 'Length', 'H'),
#         (0x2, 'MaximumLength', 'H'),
#         (0x8, 'Buffer', 'P'),
#     ]
# 
#     def __init__(self, addr, process):
#         super().__init__(addr, process)
#         buffer = process.read_memory(self.Buffer, self.Length)
#         try:
#             string = buffer.decode('utf-16-le')
#         except UnicodeDecodeError:
#             raise ValueError('UnicodeDecodeError')
#         self.Buffer = string
# 
# class LargeInteger(WinStruct):
#     __slots__ = (
#         'LowPart',
#         'HighPart'
#         'QuadPart'
#     )
# 
#     _fields_ = [
#         (0, 'LowPart', 'I'),
#         (4, 'HighPart', 'I'),
#         (0, 'QuadPart', 'q')
#     ]
# 
#     def __init__(self, addr, process):
#         super().__init__(addr, process)


import datetime
from nitro.backends.process import Process
from nitro.backends.windows.types import PEB, UnicodeString, LargeInteger
        "name",
        "pid",
        "iswow64",
        "create_time",
        "path",
        "command_line",
        "parent_pid",
        "symbols"
    )

    def __init__(self, libvmi, cr3, eproc, symbols):
        super().__init__(libvmi, cr3)
        self.eproc = eproc
        self.symbols = symbols

        # get name
        image_file_name_off = self.symbols['offsets']['EPROCESS']['ImageFileName']
        image_file_name_addr = self.eproc + image_file_name_off
        self.name = self.libvmi.read_str_va(image_file_name_addr, 0)
        # get pid
        unique_processid_off = self.symbols['offsets']['EPROCESS']['UniqueProcessId']
        unique_processid_addr = self.eproc + unique_processid_off
        self.pid = self.libvmi.read_addr_va(unique_processid_addr, 0)
        # get command line
        peb_off = self.symbols['offsets']['EPROCESS']['Peb']
        peb_addr = self.libvmi.read_addr_va(self.eproc + peb_off, 0)
        peb = PEB(peb_addr, self)
        self.command_line = peb.ProcessParameters.CommandLine.Buffer
        # get full path
        seauditprocess_off = self.symbols['offsets']['EPROCESS']['SeAuditProcessCreationInfo']

# Path: nitro/backends/process.py
# class Process:
#     """
#     Base class for processes. ``Process`` provides accesss to information about a
#     particular process as well as a method for reading and writing its memory.
#     """
# 
#     __slots__ = (
#         "libvmi",
#         "cr3",
#     )
# 
#     def __init__(self, libvmi, cr3):
#         self.libvmi = libvmi
#         self.cr3 = cr3
# 
#     @property
#     def pid(self):
#         raise NotImplementedError("pid must be overridden by a subclass")
# 
#     @property
#     def name(self):
#         raise NotImplementedError("name must be overridden by a subclass")
# 
#     def as_dict(self):
#         """
#         Returns a dictionary representing the process.
# 
#         :rtype: dict
#         """
#         return {
#             'name': self.name,
#             'pid': self.pid
#         }
# 
#     def read_memory(self, addr, count):
#         """
#         Read ``count`` bytes at address ``addr`` from the process' address space.
#         
#         :raises: LibvmiError
#         """
#         buffer, bytes_read = self.libvmi.read_va(addr, self.pid, count)
#         if bytes_read != count:
#             raise RuntimeError('Fail to read memory')
#         return buffer
# 
#     def write_memory(self, addr, buffer):
#         """
#         Write ``buffer`` at address ``addr`` in the process' address space.
# 
#         :raises: LibvmiError
#         """
#         self.libvmi.write_va(addr, self.pid, buffer)
# 
# Path: nitro/backends/windows/types.py
# class PEB(WinStruct):
#     __slots__ = (
#         'ProcessParameters'
#     )
# 
#     _fields_ = [
#         (0x20, 'ProcessParameters', 'P')
#     ]
# 
#     def __init__(self, addr, process):
#         super().__init__(addr, process)
#         self.ProcessParameters = RtlUserProcessParameters(
#             self.ProcessParameters, process)
# 
# class UnicodeString(WinStruct):
#     __slots__ = (
#         'Length',
#         'MaximumLength',
#         'Buffer',
#     )
# 
#     _fields_ = [
#         (0, 'Length', 'H'),
#         (0x2, 'MaximumLength', 'H'),
#         (0x8, 'Buffer', 'P'),
#     ]
# 
#     def __init__(self, addr, process):
#         super().__init__(addr, process)
#         buffer = process.read_memory(self.Buffer, self.Length)
#         try:
#             string = buffer.decode('utf-16-le')
#         except UnicodeDecodeError:
#             raise ValueError('UnicodeDecodeError')
#         self.Buffer = string
# 
# class LargeInteger(WinStruct):
#     __slots__ = (
#         'LowPart',
#         'HighPart'
#         'QuadPart'
#     )
# 
#     _fields_ = [
#         (0, 'LowPart', 'I'),
#         (4, 'HighPart', 'I'),
#         (0, 'QuadPart', 'q')
#     ]
# 
#     def __init__(self, addr, process):
#         super().__init__(addr, process)


# Path: nitro/backends/windows/process.py
import datetime
from nitro.backends.process import Process
from nitro.backends.windows.types import PEB, UnicodeString, LargeInteger

        "name",
        "pid",
        "iswow64",
        "create_time",
        "path",
        "command_line",
        "parent_pid",
        "symbols"
    )

    def __init__(self, libvmi, cr3, eproc, symbols):
        super().__init__(libvmi, cr3)
        self.eproc = eproc
        self.symbols = symbols

        # get name
        image_file_name_off = self.symbols['offsets']['EPROCESS']['ImageFileName']
        image_file_name_addr = self.eproc + image_file_name_off
        self.name = self.libvmi.read_str_va(image_file_name_addr, 0)
        # get pid
        unique_processid_off = self.symbols['offsets']['EPROCESS']['UniqueProcessId']
        unique_processid_addr = self.eproc + unique_processid_off
        self.pid = self.libvmi.read_addr_va(unique_processid_addr, 0)
        # get command line
        peb_off = self.symbols['offsets']['EPROCESS']['Peb']
        peb_addr = self.libvmi.read_addr_va(self.eproc + peb_off, 0)
        peb = PEB(peb_addr, self)
        self.command_line = peb.ProcessParameters.CommandLine.Buffer
        # get full path
        seauditprocess_off = self.symbols['offsets']['EPROCESS']['SeAuditProcessCreationInfo']

        seauditprocesscreationinfo_offs = self.eproc + seauditprocess_off