Add memory-region query, enumeration, and scoped protection

Implements VirtualQueryEx + MEMORY_BASIC_INFORMATION wrappers, the immutable MemoryRegion record, the ProtectionScope disposable helper, and MemoryBase.QueryRegion/EnumerateRegions/ChangeProtection. Closes section 1 of add-thread-region-finder.
2026-07-22 16:04:15 +02:00
parent e8c84f0ba1
commit f0faca3112
7 changed files with 504 additions and 0 deletions
@@ -173,4 +173,46 @@ internal static partial class NativeMethods
        SafeMemoryHandle handle,
        uint milliseconds);

+    // ── Memory query ───────────────────────────────────────────────────────
+
+    /// <summary>Retrieves information about a range of pages in the virtual address space of a specified process.</summary>
+    [LibraryImport("kernel32.dll", SetLastError = true)]
+    internal static partial nuint VirtualQueryEx(
+        SafeMemoryHandle process,
+        IntPtr address,
+        out MemoryBasicInformation buffer,
+        nuint length);
+
+    // ── Thread enumeration ─────────────────────────────────────────────────
+
+    /// <summary>Takes a snapshot of the specified processes, as well as the heaps, modules, and threads used by these processes.</summary>
+    [LibraryImport("kernel32.dll", SetLastError = true)]
+    internal static partial SafeMemoryHandle CreateToolhelp32Snapshot(
+        SnapshotFlags dwFlags,
+        int th32ProcessID);
+
+    /// <summary>Retrieves information about the first thread of any process encountered in a system snapshot.</summary>
+    [LibraryImport("kernel32.dll", SetLastError = true)]
+    [return: MarshalAs(UnmanagedType.Bool)]
+    internal static partial bool Thread32First(
+        SafeMemoryHandle hSnapshot,
+        ref ThreadEntry32 lpte);
+
+    /// <summary>Retrieves information about the next thread of any process encountered in a system snapshot.</summary>
+    [LibraryImport("kernel32.dll", SetLastError = true)]
+    [return: MarshalAs(UnmanagedType.Bool)]
+    internal static partial bool Thread32Next(
+        SafeMemoryHandle hSnapshot,
+        ref ThreadEntry32 lpte);
+
+    /// <summary>Retrieves timing information for the specified thread.</summary>
+    [LibraryImport("kernel32.dll", SetLastError = true)]
+    [return: MarshalAs(UnmanagedType.Bool)]
+    internal static partial bool GetThreadTimes(
+        SafeMemoryHandle thread,
+        out long creationTime,
+        out long exitTime,
+        out long kernelTime,
+        out long userTime);
+
 }