Base module used by all TWAPI components
This module implements core commands required by all other TWAPI components and some functionality commonly required in all Windows application.
get_version returns TWAPI version information. export_public_commands and import_commands enable export and import of commands defined in the TWAPI namespace.
Several Win32 and TWAPI commands return operating system handles to various types of resources. The following commands allow manipulation and retrieval of information regarding handles.
The command create_file returns a handle to a file or device.
The operating system associated with a Tcl channel can be retrieved using the get_tcl_channel_handle command.
The command duplicate_handle can be used to duplicate a handle, for example to pass down to a child process with different access rights.
The command close_handle closes a operating system handle and frees resources associated with it.
An application can wait on a handle to be signalled using the wait_on_handle command. The wait can be cancelled by calling cancel_wait_on_handle command.
The twapi_base package includes some commonly used commands related to user accounts. The command lookup_account_name, map_account_to_name, lookup_account_sid and map_account_to_sid translate between user and group account names and their SID's. The command is_valid_sid_syntax validates the syntax of an SID.
A more complete set of commands related to accounts, credentials and security are in the twapi_account and twapi_security packages.
Commands read_credentials, credentials_dialog and confirm_credentials allow interfacing to the Windows credentials manager and getting user credentials such as passwords from the user.
Passwords are sensitive data and need to be protected in memory. For example, in case of error exceptions being logged to file, plaintext passwords should not be exposed. The above commands return passwords in an encrypted form. TWAPI commands that deal with passwords expect them to be passed in this encrypted form. The conceal and reveal commands can also be used for this purpose. Note however using conceal is not as secure as the argument passed to it is still in clear text.
Commands for writing to the Windows event log are included in the twapi_base package. Documentation for these is however part of the twapi_eventlog package.
The twapi_base module also provides various facilities for generating and handing errors and Tcl exceptions.
TWAPI generates Tcl exceptions when errors are encountered. Information pertaining to the error is stored in Tcl global variables as with any standard Tcl errors. The global variable errorInfo contains a traceback of the Tcl stack when the error occured. The global errorCode contains a list with additional information about the error. The first element is the error class and determines the format of the rest of the list. This may take one of the following values:
TWAPI_WIN32 | This error class corresponds to Windows error
codes. The second element of the list is the integer Windows error
code. The map_windows_error can be used to retrieve the
correesponding text description. The third element is the
corresponding localized text string describing the error. The
fourth element is optional and its format is dependent on the
specific error code. The command win32_error can be used to generate an error in this format. |
TWAPI | This error class is used for non-Windows related errors, for example invalid options to commands. The format is similar to that of TWAPI_WIN32 except that the error code is an internal TWAPI error code and the text is not localized. |
For handling errors, the command trap provides exception handling with finalization features.
For troubleshooting and debug purposes, TWAPI provides the debuglog command which writes to an internal log. This command is normally a no-op and must be enabled with debuglog_enable for logging to have effect. It can be disabled again with debuglog_disable. The current contents of the debug log can be retrieved with debuglog_get.
Some TWAPI commands return data in a form that is similar to a table with named columns. For example, the event tracing module returns a list of event trace records. The form of the returned data is called a record array and is intended to be opaque and manipulated through the recordarray command. The command takes various forms shown in the table below and is flexible enough to retrieve data as dictionaries or lists as well as support operations like filtering and column slicing.
recordarray cell | Returns the value in a specified field in a specific record. |
recordarray column | Returns values for a specified field for all records. |
recordarray concat | Returns a record array containing records from one or more record arrays. |
recordarray fields | Returns field names for the records in the record array. |
recordarray get | Returns another record array containing a subset of the records and fields. |
recordarray getdict | Returns a dictionary containing a subset of the records and fields. |
recordarray getlist | Returns a list containing a subset of the records and fields. |
recordarray index | Returns the record at a specified position in list or dictionary format. |
recordarray iterate | Iterates over the records in the record array. |
recordarray range | Returns a new record array containing records in the specified range. |
recordarray rename | Renames one or more fields in the record array. |
recordarray size | Returns the number of records in the record array. |
Many record array commands accept some of the following common options:
-filter FILTERLIST | Specifies a list of matching filters. Only the
records matching all the filter expressions in FILTERLIST are returned. FILTERLIST is
a list of filter expressions. Each filter expression is a 3 or 4
element list consisting of a record field name, a matching
operator, the value to match and optionally a fourth element
-nocase which may be used with any of the string
or pattern matching operators to indicate that character case
should be ignored. The matching operator must be one of the
following:
|
||||||||||||||||||||
-format FORMAT | Specifies the format of each record element
returned. FORMAT may be one of the following
values:
|
||||||||||||||||||||
-slice FIELDLIST | Specifies that the return value should only include the fields specified in FIELDLIST and in that order. |
Here is an example that returns a plain list of PID of processes that have a privileged port (any port under 1024) open. get_tcp_connections returns a record array.
recordarray getlist [get_tcp_connections] -filter {{-localport < 1024}} -slice -pid -format flat
Another example, which shows all services that are marked as interacting with the desktop, returned as a dictionary keyed by the service name.
recordarray getdict [get_multiple_service_status] -filter {{interactive == 1}} -key name
parses an argument list based on specified options. The command expand_environment_strings replaces environment variables in a string with their values. format_message formats a operating system or application message.
Commands large_system_time_to_secs_since_1970, large_system_time_to_timelist, secs_since_1970_to_large_system_time and timelist_to_large_system_time convert between various time formats.
A Universally Unique Identifier (UUID) can be generated by the command new_uuid. A nil UUID can be generated by nil_uuid.
The commands load_library and free_library can be used to load and free DLL's.
The commands tclcast and tcltype are useful for manipulating internal Tcl value types. This is sometimes useful and required when dealing with external APIs and data formats like COM. hex32 and hex64 format numbers as fixed length hexadecimal strings. lambda returns an anonymous proc definition based on the Tcl apply command.
-access ACCESSRIGHTS | Specifies the desired access rights and may be specified as a list of integer access rights flags or symbols as described in Access Rights. Defaults to generic_read. |
-createdisposition DISPOSITION | DISPOSITION must be one of create_always, create_new, open_always, open_existing or truncate_existing. Refer to the Windows SDK for the meaning. Defaults to open_always. |
-flags FLAGS | An integer bit mask corresponding to the dwFlagsAndAttributes parameter to CreateFile function. See the Windows SDK for detail. Defaults to 0. |
-inherit BOOL | If true, the returned handle is inheritable by child processes. Defaults to false. |
-secd SECURITY_DESCRIPTOR | Specifies a security descriptor to be attached to the file or device if it has to be created. Defaults to a null security descriptor which results in the process' default security descriptor being applied. |
-share | Specifies the sharing mode of the object. This is list containing zero or more of the constants read, write and delete that control what kind of shared access should be allowed while the file or device is open. Defaults to {read write delete}. |
-templatefile | A handle to a template file with the GENERIC_READ access right from which file attributes and extended attributes are to be copied for the file that is being created. Defaults to NULL. |
-bitmap HANDLE | Specifies a hande to a bitmap to be displayed in the dialog. |
-caption CAPTION | Specifies a caption to be displayed. |
-expectconfirmation BOOLEAN | See read_credentials. |
-forceui BOOLEAN | See read_credentials. |
-message MESSAGE | Specifies a message to be displayed to the user. |
-parent HWIN | Specifies the handle of a windows to be used as the parent for the dialog. |
-password PASSWORD | See read_credentials. |
-persist BOOLEAN | See read_credentials. |
-showsaveoption BOOLEAN | See read_credentials. |
-target TARGETNAME | See read_credentials. |
-type TARGETTYPE | See read_credentials. |
-username USERNAME | See read_credentials. |
-access ACCESSRIGHTS | Specifies the access rights desired for the new handle. If unspecified, the new handle is created with the same access rights as the original one. ACCESSRIGHTS is a list of symbolic constants and bit masks as specified in Access Rights. |
-closesource | If specified, HANDLE is closed after it is duplicated. |
-inherit | If specified, the new handle marked as inheritable. By default, the duplicated handle cannot be inherited by child processes. |
-sourcepid SOURCEPID | Specifies the PID of the process in whose context HANDLE is a valid handle. Defaults to the current process. |
-targetpid TARGETPID | Specifies the PID of the process in whose context the new handle is to be created. Specifying this also impacts the format of the returned handle value. |
-module MODULE | Specifies that the format string is to be loaded from the module identified by MODULE. MODULE may either be a handle returned from a command such as load_library or the path to a DLL. If this option is specified, options -messageid and -langid must also be specified. This option cannot be used with the -fmtstring option. |
-fmtstring FORMATSTRING | Specifies that FORMATSTRING should be used as the format string for the message. Cannot be used with the -module option. |
-messageid MESSAGEID | Specifies the message identifier of the format string. This option cannot be used with the -fmtstring option. |
-langid LANGID | Specifies the language identifier to be used in constructing the message. This option cannot be used with the -fmtstring option. |
-includesystem | Specifies that the system message tables should also be searched in addition to the message tables in the module specified by -module. This option cannot be used with the -fmtstring option. |
-params PARAMLIST | Specifies a list of positional parameters that are to be used to replace the %N format insert sequences in the format string. If the number of parameters does not match the number of escape sequences, a Tcl exception may be generated. |
-ignoreinserts | If specified, the %N format insert sequences are not replaced in the returned string. |
-width MAXLINEWIDTH | If MAXLINEWIDTH is 0 (default), the returned string contains the same line breaks as in the original format string. The -width option may be used to control the maximum line width in the created message. If MAXLINEWIDTH is between 1 and 254, the command will insert line end characters at appropriate points in the message. In this case, line end characters in the original message are ignored. However, hard coded line end characters, specified as %n in the format string are kept. A MAXLINEWIDTH value of -1 also ignores line end characters while keeping the hard coded %n line end specifiers, but does not insert any line end characters to limit the line length and to terminate the message. |
comobj_ootype | The underlying object system on which the TWAPI COM support is built. |
compiler | The compiler used for the build (e.g. vc++) |
compiler_version | The version of the build compiler. |
opts | List of additional options used in the build. |
platform | One of x86 or x64. |
sdk_version | Version of the Windows SDK used for the build. |
tcl_header_version | Version of the Tcl headers used for the build. |
tea | Boolean indicating whether the build used Tcl Extension Architecture or native builds. |
-dontresolverefs | Normally, if the module being loaded is a DLL, the system will load any other modules referenced by it and also call its DllMain function to initialize it. If this option is specified, neither of these actions will be done. |
-datafile | If specified, the module is loaded as a data file as opposed to an executable module. This is useful when the file is being loaded only to extract resources or format messages. |
-alteredpath | Uses an alternative search strategy to find modules referenced by this module. See the Windows SDK for more details. |
-all | Returns all values. |
-sid | Returns the SID for the account. |
-domain | Returns the domain in which the account was found. |
-system | Specifies the name of the system on which the account is to be looked up. If unspecified, the local system is used. |
-type | Returns the account type. This may be one of user, group (domain group), domain, alias (system local group), logonid, wellknowngroup, deletedaccount, invalid, unknown, computer or label. The logonid type is returned for SID's that identify a logon session. |
-all | Returns all values. |
-name | Returns the name for the account. |
-domain | Returns the domain in which the account was found. |
-system | Specifies the name of the system on which the account is to be looked up. If unspecified, the local system is used. |
-type | Returns the account type. This may be one of user, group (domain group), domain, alias (system local group), wellknowngroup, deletedaccount, invalid, unknown, or computer. |
-expectconfirmation | option lets the manager know the application will call confirm_credentials after verifying credentials. If false, the credentials manager will not hold on to the credentials and confirm_credentials need not be called. Generally, if -persist is specified as true, this option should also be specified as true and confirm_credentials called after verifying the credentials. |
-forceui BOOLEAN | If specified as true, the user is prompted even if the credentials manager already has the requested credentials. Default is false. |
-password PASSWORD | The password to be used as default. PASSWORD must be in the form accepted by reveal which is also the form returned by this command. Plain text passwords are not supported by this command. |
-persist BOOLEAN | If true, credentials are to be persisted by the credentials manager if so desired by the user. Default is false. |
-showsaveoption BOOLEAN | Specifies whether the user should be given the option to save the credentials. Defaults to true (meaning user is given the choice). If specified as false, credentials are persisted depending on the -persist option. |
-target TARGETNAME | Name of the target for the credentials, for example the server name. This is used as the key when retrieving credentials. |
-type TARGETTYPE | Specifies the type of credentials. TARGETTYPE must be generic (default) or domain. |
-username USERNAME | The user name to display as the default. Defaults to the empty string. |
-expectconfirmation BOOLEAN | The credentials manager can persist credentials that are valid so they can be returned later without prompting the user. The application needs to inform it whether the returned credentials are valid or not by calling confirm_credentials. When true, |
-wait MILLISECS | Specifies the number of number of milliseconds to wait for the handle to be signalled. The default is -1 which indicates no timeout. |
-async SCRIPT | If specified, the command returns immediately.
SCRIPT is then invoked when the handle is
signalled or the timeout specified through -wait
has elapsed. Note that if a timeout is specified with the -wait option, the timeout does not cancel the wait and
the script is invoked repeatedly every MILLISECONDS if the handle is not signalled. Two additional arguments are appended to SCRIPT - HANDLE and the return value (signalled etc.). Once a handle is registered for asynchronous notification, it must not be used for synchronous notification unless the asynchronous notification is first canceled through the cancel_wait_on_handle command. If the handle was already registered for asynchronous notification, the previously registered script is replaced with SCRIPT. |
-executeonce BOOLEAN | If this option is specified as true, the SCRIPT is executed only once, even if the object HANDLE stays in a signalled state. Default is false. This option is ignored if -async is not specified. |
Copyright © 2004-2012 Ashok P. Nadkarni