namespace WhiteMagic.Native;
///
/// Access rights that open a process object.
///
[Flags]
public enum ProcessAccess : uint
{
/// The right to terminate the process with TerminateProcess.
Terminate = 0x0001,
/// The right to create a thread in the process.
CreateThread = 0x0002,
/// The right to operate on the address space of the process.
VmOperation = 0x0008,
/// The right to read memory with ReadProcessMemory.
VmRead = 0x0010,
/// The right to write memory with WriteProcessMemory.
VmWrite = 0x0020,
/// The right to duplicate a handle with DuplicateHandle.
DupHandle = 0x0040,
/// The right to set information about the process.
SetInformation = 0x0200,
/// The right to read information about the process, such as the exit code.
QueryInformation = 0x0400,
/// The right to suspend or resume the process.
SuspendResume = 0x0800,
/// The right to read a limited set of information about the process.
QueryLimitedInformation = 0x1000,
/// The right to use the process object for synchronization.
Synchronize = 0x00100000,
/// All access rights for a process object.
AllAccess = 0x001F0000 | Synchronize | 0xFFFF,
}
///
/// Access rights that open a thread object.
///
[Flags]
public enum ThreadAccess : uint
{
/// The right to terminate the thread with TerminateThread.
Terminate = 0x0001,
/// The right to suspend and resume the thread.
SuspendResume = 0x0002,
/// The right to read the thread context with GetThreadContext.
GetContext = 0x0008,
/// The right to set the thread context with SetThreadContext.
SetContext = 0x0010,
/// The right to query information from the thread.
QueryInformation = 0x0040,
/// The right to set information on the thread.
SetInformation = 0x0020,
/// All access rights for a thread object.
AllAccess = 0x001F0FFF,
}
///
/// Values that control how VirtualAllocEx allocates memory.
///
[Flags]
public enum MemoryAllocationType : uint
{
/// Commit physical storage for the reserved pages. The pages start as zero.
Commit = 0x00001000,
/// Reserve a range of address space without physical storage.
Reserve = 0x00002000,
/// Reset the data in the range to indicate that it is no longer of interest.
Reset = 0x00080000,
/// Allocate memory at the highest possible address.
TopDown = 0x00100000,
}
///
/// Values that protect a block of memory.
///
[Flags]
public enum MemoryProtectionType : uint
{
/// No access to the committed pages.
NoAccess = 0x01,
/// Read access to the committed pages.
ReadOnly = 0x02,
/// Read and write access to the committed pages.
ReadWrite = 0x04,
/// Copy-on-write access to the committed pages.
WriteCopy = 0x08,
/// Execute access to the committed pages.
Execute = 0x10,
/// Execute and read access to the committed pages.
ExecuteRead = 0x20,
/// Execute, read, and write access to the committed pages.
ExecuteReadWrite = 0x40,
/// Execute and copy-on-write access to the committed pages.
ExecuteWriteCopy = 0x80,
/// The pages in the range become guard pages.
Guard = 0x100,
/// The system does not cache the committed pages.
NoCache = 0x200,
/// The system uses write-combined access for the pages.
WriteCombine = 0x400,
}
///
/// Values that control how VirtualFreeEx frees memory.
///
[Flags]
public enum MemoryFreeType : uint
{
/// Decommit the committed pages. The address range stays reserved.
Decommit = 0x4000,
/// Release the range of pages. The size must be zero.
Release = 0x8000,
}
///
/// Values that set the initial state of a new thread.
///
[Flags]
public enum ThreadCreationFlags : uint
{
/// The thread runs immediately after creation.
RunImmediately = 0,
/// The thread starts in a suspended state. Call ResumeThread to start it.
CreateSuspended = 0x00000004,
/// The stack-size parameter sets the reserve size of the stack.
StackSizeParamIsAReservation = 0x00010000,
}
///
/// Flags that select the registers that the thread-context functions read or write.
/// There are separate constants for 32-bit (x86/WOW64) and 64-bit (AMD64) contexts.
///
public static class ContextFlags
{
/// Architecture identifier for x86 contexts.
public const uint X86 = 0x00010000;
/// Architecture identifier for AMD64 contexts.
public const uint Amd64 = 0x00100000;
/// x86: SS:SP, CS:IP, FLAGS, and BP.
public const uint X86Control = X86 | 0x01;
/// x86: AX, BX, CX, DX, SI, and DI.
public const uint X86Integer = X86 | 0x02;
/// x86: DS, ES, FS, and GS.
public const uint X86Segments = X86 | 0x04;
/// x86: control, integer, and segment registers.
public const uint X86Full = X86Control | X86Integer | X86Segments;
/// AMD64: SegSs, Rsp, SegCs, Rip, and EFlags.
public const uint Amd64Control = Amd64 | 0x01;
/// AMD64: Rax, Rcx, Rdx, Rbx, Rbp, Rsi, Rdi, and R8 to R15.
public const uint Amd64Integer = Amd64 | 0x02;
/// AMD64: SegDs, SegEs, SegFs, and SegGs.
public const uint Amd64Segments = Amd64 | 0x04;
/// AMD64: control, integer, and segment registers.
public const uint Amd64Full = Amd64Control | Amd64Integer | Amd64Segments;
}
///
/// Values that describe the state of memory pages returned by VirtualQueryEx.
///
public enum MemoryState : uint
{
/// Indicates committed pages for which physical storage has been allocated.
Commit = 0x1000,
/// Indicates reserved pages where a range of the virtual address space is reserved without any physical storage being allocated.
Reserve = 0x2000,
/// Indicates free pages not accessible to the calling process and available to be allocated.
Free = 0x10000,
}
///
/// Values that describe the type of memory pages returned by VirtualQueryEx.
///
public enum MemoryType : uint
{
/// Indicates that the memory pages within the region are private.
Private = 0x20000,
/// Indicates that the memory pages within the region are mapped into the view of a section.
Mapped = 0x40000,
/// Indicates that the memory pages within the region are mapped into the view of an image section.
Image = 0x1000000,
}
///
/// Flags used by CreateToolhelp32Snapshot to specify the portions of the system to include in the snapshot.
///
[Flags]
public enum SnapshotFlags : uint
{
/// Enumerate the heap list.
HeapList = 0x00000001,
/// Enumerate the process list.
Process = 0x00000002,
/// Enumerate the thread list.
Thread = 0x00000004,
/// Enumerate the module list.
Module = 0x00000008,
/// Enumerate the 32-bit module list for the specified process.
Module32 = 0x00000010,
/// Include all processes and threads in the system.
All = 0x0000001F,
/// Indicate that the snapshot handle is to be inheritable.
Inherit = 0x80000000,
}