| use crate::winapi_local::um::winnt::PMEM_EXTENDED_PARAMETER; |
| use winapi::shared::basetsd::{PSIZE_T, PULONG_PTR, SIZE_T, ULONG_PTR}; |
| use winapi::shared::ntdef::{ |
| BOOLEAN, HANDLE, LARGE_INTEGER, NTSTATUS, PHANDLE, PLARGE_INTEGER, POBJECT_ATTRIBUTES, PULONG, |
| PUNICODE_STRING, PVOID, UCHAR, ULONG, ULONGLONG, UNICODE_STRING, USHORT, |
| }; |
| use winapi::um::winnt::{ |
| ACCESS_MASK, PCFG_CALL_TARGET_INFO, STANDARD_RIGHTS_REQUIRED, SYNCHRONIZE, |
| }; |
| ENUM!{enum MEMORY_INFORMATION_CLASS { |
| MemoryBasicInformation = 0, |
| MemoryWorkingSetInformation = 1, |
| MemoryMappedFilenameInformation = 2, |
| MemoryRegionInformation = 3, |
| MemoryWorkingSetExInformation = 4, |
| MemorySharedCommitInformation = 5, |
| MemoryImageInformation = 6, |
| MemoryRegionInformationEx = 7, |
| MemoryPrivilegedBasicInformation = 8, |
| MemoryEnclaveImageInformation = 9, |
| MemoryBasicInformationCapped = 10, |
| }} |
| STRUCT!{struct MEMORY_WORKING_SET_BLOCK { |
| Bitfields: ULONG_PTR, |
| }} |
| #[cfg(any(target_arch = "x86_64", target_arch = "aarch64"))] |
| BITFIELD!{MEMORY_WORKING_SET_BLOCK Bitfields: ULONG_PTR [ |
| Protection set_Protection[0..5], |
| ShareCount set_ShareCount[5..8], |
| Shared set_Shared[8..9], |
| Node set_Node[9..12], |
| VirtualPage set_VirtualPage[12..64], |
| ]} |
| #[cfg(target_arch = "x86")] |
| BITFIELD!{MEMORY_WORKING_SET_BLOCK Bitfields: ULONG_PTR [ |
| Protection set_Protection[0..5], |
| ShareCount set_ShareCount[5..8], |
| Shared set_Shared[8..9], |
| Node set_Node[9..12], |
| VirtualPage set_VirtualPage[12..32], |
| ]} |
| pub type PMEMORY_WORKING_SET_BLOCK = *mut MEMORY_WORKING_SET_BLOCK; |
| STRUCT!{struct MEMORY_WORKING_SET_INFORMATION { |
| NumberOfEntries: ULONG_PTR, |
| WorkingSetInfo: [MEMORY_WORKING_SET_BLOCK; 1], |
| }} |
| pub type PMEMORY_WORKING_SET_INFORMATION = *mut MEMORY_WORKING_SET_INFORMATION; |
| STRUCT!{struct MEMORY_REGION_INFORMATION { |
| AllocationBase: PVOID, |
| AllocationProtect: ULONG, |
| RegionType: ULONG, |
| RegionSize: SIZE_T, |
| CommitSize: SIZE_T, |
| }} |
| BITFIELD!{MEMORY_REGION_INFORMATION RegionType: ULONG [ |
| Private set_Private[0..1], |
| MappedDataFile set_MappedDataFile[1..2], |
| MappedImage set_MappedImage[2..3], |
| MappedPageFile set_MappedPageFile[3..4], |
| MappedPhysical set_MappedPhysical[4..5], |
| DirectMapped set_DirectMapped[5..6], |
| SoftwareEnclave set_SoftwareEnclave[6..7], |
| PageSize64K set_PageSize64K[7..8], |
| PlaceholderReservation set_PlaceholderReservation[8..9], |
| Reserved set_Reserved[9..32], |
| ]} |
| pub type PMEMORY_REGION_INFORMATION = *mut MEMORY_REGION_INFORMATION; |
| ENUM!{enum MEMORY_WORKING_SET_EX_LOCATION { |
| MemoryLocationInvalid = 0, |
| MemoryLocationResident = 1, |
| MemoryLocationPagefile = 2, |
| MemoryLocationReserved = 3, |
| }} |
| UNION!{union MEMORY_WORKING_SET_EX_BLOCK_u { |
| Bitfields: ULONG_PTR, |
| Invalid: ULONG_PTR, |
| }} |
| STRUCT!{struct MEMORY_WORKING_SET_EX_BLOCK { |
| u: MEMORY_WORKING_SET_EX_BLOCK_u, |
| }} |
| #[cfg(any(target_arch = "x86_64", target_arch = "aarch64"))] |
| BITFIELD!{unsafe MEMORY_WORKING_SET_EX_BLOCK_u Bitfields: ULONG_PTR [ |
| Valid set_Valid[0..1], |
| ShareCount set_ShareCount[1..4], |
| Win32Protection set_Win32Protection[4..15], |
| Shared set_Shared[15..16], |
| Node set_Node[16..22], |
| Locked set_Locked[22..23], |
| LargePage set_LargePage[23..24], |
| Priority set_Priority[24..27], |
| Reserved set_Reserved[27..30], |
| SharedOriginal set_SharedOriginal[30..31], |
| Bad set_Bad[31..32], |
| ReservedUlong set_ReservedUlong[32..64], |
| ]} |
| #[cfg(any(target_arch = "x86_64", target_arch = "aarch64"))] |
| BITFIELD!{unsafe MEMORY_WORKING_SET_EX_BLOCK_u Invalid: ULONG_PTR [ |
| Invalid_Valid set_Invalid_Valid[0..1], |
| Invalid_Reserved0 set_Invalid_Reserved0[1..15], |
| Invalid_Shared set_Invalid_Shared[15..16], |
| Invalid_Reserved1 set_Invalid_Reserved1[16..21], |
| Invalid_PageTable set_Invalid_PageTable[21..22], |
| Invalid_Location set_Invalid_Location[22..24], |
| Invalid_Priority set_Invalid_Priority[24..27], |
| Invalid_ModifiedList set_Invalid_ModifiedList[27..28], |
| Invalid_Reserved2 set_Invalid_Reserved2[28..30], |
| Invalid_SharedOriginal set_Invalid_SharedOriginal[30..31], |
| Invalid_Bad set_Invalid_Bad[31..32], |
| Invalid_ReservedUlong set_Invalid_ReservedUlong[32..64], |
| ]} |
| #[cfg(target_arch = "x86")] |
| BITFIELD!{unsafe MEMORY_WORKING_SET_EX_BLOCK_u Bitfields: ULONG_PTR [ |
| Valid set_Valid[0..1], |
| ShareCount set_ShareCount[1..4], |
| Win32Protection set_Win32Protection[4..15], |
| Shared set_Shared[15..16], |
| Node set_Node[16..22], |
| Locked set_Locked[22..23], |
| LargePage set_LargePage[23..24], |
| Priority set_Priority[24..27], |
| Reserved set_Reserved[27..30], |
| SharedOriginal set_SharedOriginal[30..31], |
| Bad set_Bad[31..32], |
| ]} |
| #[cfg(target_arch = "x86")] |
| BITFIELD!{unsafe MEMORY_WORKING_SET_EX_BLOCK_u Invalid: ULONG_PTR [ |
| Invalid_Valid set_Invalid_Valid[0..1], |
| Invalid_Reserved0 set_Invalid_Reserved0[1..15], |
| Invalid_Shared set_Invalid_Shared[15..16], |
| Invalid_Reserved1 set_Invalid_Reserved1[16..21], |
| Invalid_PageTable set_Invalid_PageTable[21..22], |
| Invalid_Location set_Invalid_Location[22..24], |
| Invalid_Priority set_Invalid_Priority[24..27], |
| Invalid_ModifiedList set_Invalid_ModifiedList[27..28], |
| Invalid_Reserved2 set_Invalid_Reserved2[28..30], |
| Invalid_SharedOriginal set_Invalid_SharedOriginal[30..31], |
| Invalid_Bad set_Invalid_Bad[31..32], |
| ]} |
| pub type PMEMORY_WORKING_SET_EX_BLOCK = *mut MEMORY_WORKING_SET_EX_BLOCK; |
| STRUCT!{struct MEMORY_WORKING_SET_EX_INFORMATION { |
| VirtualAddress: PVOID, |
| VirtualAttributes: MEMORY_WORKING_SET_EX_BLOCK, |
| }} |
| pub type PMEMORY_WORKING_SET_EX_INFORMATION = *mut MEMORY_WORKING_SET_EX_INFORMATION; |
| STRUCT!{struct MEMORY_SHARED_COMMIT_INFORMATION { |
| CommitSize: SIZE_T, |
| }} |
| pub type PMEMORY_SHARED_COMMIT_INFORMATION = *mut MEMORY_SHARED_COMMIT_INFORMATION; |
| STRUCT!{struct MEMORY_IMAGE_INFORMATION { |
| ImageBase: PVOID, |
| SizeOfImage: SIZE_T, |
| ImageFlags: ULONG, |
| }} |
| BITFIELD!{MEMORY_IMAGE_INFORMATION ImageFlags: ULONG [ |
| ImagePartialMap set_ImagePartialMap[0..1], |
| ImageNotExecutable set_ImageNotExecutable[1..2], |
| ImageSigningLevel set_ImageSigningLevel[2..6], |
| Reserved set_Reserved[6..32], |
| ]} |
| pub type PMEMORY_IMAGE_INFORMATION = *mut MEMORY_IMAGE_INFORMATION; |
| STRUCT!{struct MEMORY_ENCLAVE_IMAGE_INFORMATION { |
| ImageInfo: MEMORY_IMAGE_INFORMATION, |
| UniqueID: [UCHAR; 32], |
| AuthorID: [UCHAR; 32], |
| }} |
| pub type PMEMORY_ENCLAVE_IMAGE_INFORMATION = *mut MEMORY_ENCLAVE_IMAGE_INFORMATION; |
| pub const MMPFNLIST_ZERO: u32 = 0; |
| pub const MMPFNLIST_FREE: u32 = 1; |
| pub const MMPFNLIST_STANDBY: u32 = 2; |
| pub const MMPFNLIST_MODIFIED: u32 = 3; |
| pub const MMPFNLIST_MODIFIEDNOWRITE: u32 = 4; |
| pub const MMPFNLIST_BAD: u32 = 5; |
| pub const MMPFNLIST_ACTIVE: u32 = 6; |
| pub const MMPFNLIST_TRANSITION: u32 = 7; |
| pub const MMPFNUSE_PROCESSPRIVATE: u32 = 0; |
| pub const MMPFNUSE_FILE: u32 = 1; |
| pub const MMPFNUSE_PAGEFILEMAPPED: u32 = 2; |
| pub const MMPFNUSE_PAGETABLE: u32 = 3; |
| pub const MMPFNUSE_PAGEDPOOL: u32 = 4; |
| pub const MMPFNUSE_NONPAGEDPOOL: u32 = 5; |
| pub const MMPFNUSE_SYSTEMPTE: u32 = 6; |
| pub const MMPFNUSE_SESSIONPRIVATE: u32 = 7; |
| pub const MMPFNUSE_METAFILE: u32 = 8; |
| pub const MMPFNUSE_AWEPAGE: u32 = 9; |
| pub const MMPFNUSE_DRIVERLOCKPAGE: u32 = 10; |
| pub const MMPFNUSE_KERNELSTACK: u32 = 11; |
| STRUCT!{struct MEMORY_FRAME_INFORMATION { |
| Bitfields: ULONGLONG, |
| }} |
| BITFIELD!{MEMORY_FRAME_INFORMATION Bitfields: ULONGLONG [ |
| UseDescription set_UseDescription[0..4], |
| ListDescription set_ListDescription[4..7], |
| Reserved0 set_Reserved0[7..8], |
| Pinned set_Pinned[8..9], |
| DontUse set_DontUse[9..57], |
| Priority set_Priority[57..60], |
| Reserved set_Reserved[60..64], |
| ]} |
| STRUCT!{struct FILEOFFSET_INFORMATION { |
| Bitfields: ULONGLONG, |
| }} |
| BITFIELD!{FILEOFFSET_INFORMATION Bitfields: ULONGLONG [ |
| DontUse set_DontUse[0..9], |
| Offset set_Offset[9..57], |
| Reserved set_Reserved[57..64], |
| ]} |
| STRUCT!{struct PAGEDIR_INFORMATION { |
| Bitfields: ULONGLONG, |
| }} |
| BITFIELD!{PAGEDIR_INFORMATION Bitfields: ULONGLONG [ |
| DontUse set_DontUse[0..9], |
| PageDirectoryBase set_PageDirectoryBase[9..57], |
| Reserved set_Reserved[57..64], |
| ]} |
| STRUCT!{struct UNIQUE_PROCESS_INFORMATION { |
| Bitfields: ULONGLONG, |
| }} |
| BITFIELD!{UNIQUE_PROCESS_INFORMATION Bitfields: ULONGLONG [ |
| DontUse set_DontUse[0..9], |
| UniqueProcessKey set_UniqueProcessKey[9..57], |
| Reserved set_Reserved[57..64], |
| ]} |
| pub type PUNIQUE_PROCESS_INFORMATION = *mut UNIQUE_PROCESS_INFORMATION; |
| UNION!{union MMPFN_IDENTITY_u1 { |
| e1: MEMORY_FRAME_INFORMATION, |
| e2: FILEOFFSET_INFORMATION, |
| e3: PAGEDIR_INFORMATION, |
| e4: UNIQUE_PROCESS_INFORMATION, |
| }} |
| UNION!{union MMPFN_IDENTITY_u2 { |
| e1: ULONG_PTR, |
| e2_CombinedPage: ULONG_PTR, |
| FileObject: ULONG_PTR, |
| UniqueFileObjectKey: ULONG_PTR, |
| ProtoPteAddress: ULONG_PTR, |
| VirtualAddress: ULONG_PTR, |
| }} |
| STRUCT!{struct MMPFN_IDENTITY { |
| u1: MMPFN_IDENTITY_u1, |
| PageFrameIndex: ULONG_PTR, |
| u2: MMPFN_IDENTITY_u2, |
| }} |
| BITFIELD!{unsafe MMPFN_IDENTITY_u2 e1: ULONG_PTR [ |
| Image set_Image[0..1], |
| Mismatch set_Mismatch[1..2], |
| ]} |
| pub type PMMPFN_IDENTITY = *mut MMPFN_IDENTITY; |
| STRUCT!{struct MMPFN_MEMSNAP_INFORMATION { |
| InitialPageFrameIndex: ULONG_PTR, |
| Count: ULONG_PTR, |
| }} |
| pub type PMMPFN_MEMSNAP_INFORMATION = *mut MMPFN_MEMSNAP_INFORMATION; |
| ENUM!{enum SECTION_INFORMATION_CLASS { |
| SectionBasicInformation = 0, |
| SectionImageInformation = 1, |
| SectionRelocationInformation = 2, |
| SectionOriginalBaseInformation = 3, |
| SectionInternalImageInformation = 4, |
| MaxSectionInfoClass = 5, |
| }} |
| STRUCT!{struct SECTION_BASIC_INFORMATION { |
| BaseAddress: PVOID, |
| AllocationAttributes: ULONG, |
| MaximumSize: LARGE_INTEGER, |
| }} |
| pub type PSECTION_BASIC_INFORMATION = *mut SECTION_BASIC_INFORMATION; |
| STRUCT!{struct SECTION_IMAGE_INFORMATION_u1_s { |
| SubSystemMinorVersion: USHORT, |
| SubSystemMajorVersion: USHORT, |
| }} |
| UNION!{union SECTION_IMAGE_INFORMATION_u1 { |
| s: SECTION_IMAGE_INFORMATION_u1_s, |
| SubSystemVersion: ULONG, |
| }} |
| STRUCT!{struct SECTION_IMAGE_INFORMATION_u2_s { |
| MajorOperatingSystemVersion: USHORT, |
| MinorOperatingSystemVersion: USHORT, |
| }} |
| UNION!{union SECTION_IMAGE_INFORMATION_u2 { |
| s: SECTION_IMAGE_INFORMATION_u2_s, |
| OperatingSystemVersion: ULONG, |
| }} |
| STRUCT!{struct SECTION_IMAGE_INFORMATION { |
| TransferAddress: PVOID, |
| ZeroBits: ULONG, |
| MaximumStackSize: SIZE_T, |
| CommittedStackSize: SIZE_T, |
| SubSystemType: ULONG, |
| u1: SECTION_IMAGE_INFORMATION_u1, |
| u2: SECTION_IMAGE_INFORMATION_u2, |
| ImageCharacteristics: USHORT, |
| DllCharacteristics: USHORT, |
| Machine: USHORT, |
| ImageContainsCode: BOOLEAN, |
| ImageFlags: UCHAR, |
| LoaderFlags: ULONG, |
| ImageFileSize: ULONG, |
| CheckSum: ULONG, |
| }} |
| BITFIELD!{SECTION_IMAGE_INFORMATION ImageFlags: UCHAR [ |
| ComPlusNativeReady set_ComPlusNativeReady[0..1], |
| ComPlusILOnly set_ComPlusILOnly[1..2], |
| ImageDynamicallyRelocated set_ImageDynamicallyRelocated[2..3], |
| ImageMappedFlat set_ImageMappedFlat[3..4], |
| BaseBelow4gb set_BaseBelow4gb[4..5], |
| ComPlusPrefer32bit set_ComPlusPrefer32bit[5..6], |
| Reserved set_Reserved[6..8], |
| ]} |
| pub type PSECTION_IMAGE_INFORMATION = *mut SECTION_IMAGE_INFORMATION; |
| STRUCT!{struct SECTION_INTERNAL_IMAGE_INFORMATION { |
| SectionInformation: SECTION_IMAGE_INFORMATION, |
| ExtendedFlags: ULONG, |
| }} |
| BITFIELD!{SECTION_INTERNAL_IMAGE_INFORMATION ExtendedFlags: ULONG [ |
| ImageExportSuppressionEnabled set_ImageExportSuppressionEnabled[0..1], |
| Reserved set_Reserved[1..32], |
| ]} |
| pub type PSECTION_INTERNAL_IMAGE_INFORMATION = *mut SECTION_INTERNAL_IMAGE_INFORMATION; |
| ENUM!{enum SECTION_INHERIT { |
| ViewShare = 1, |
| ViewUnmap = 2, |
| }} |
| pub const SEC_BASED: u32 = 0x200000; |
| pub const SEC_NO_CHANGE: u32 = 0x400000; |
| pub const SEC_GLOBAL: u32 = 0x20000000; |
| pub const MEM_EXECUTE_OPTION_DISABLE: u32 = 0x1; |
| pub const MEM_EXECUTE_OPTION_ENABLE: u32 = 0x2; |
| pub const MEM_EXECUTE_OPTION_DISABLE_THUNK_EMULATION: u32 = 0x4; |
| pub const MEM_EXECUTE_OPTION_PERMANENT: u32 = 0x8; |
| pub const MEM_EXECUTE_OPTION_EXECUTE_DISPATCH_ENABLE: u32 = 0x10; |
| pub const MEM_EXECUTE_OPTION_IMAGE_DISPATCH_ENABLE: u32 = 0x20; |
| pub const MEM_EXECUTE_OPTION_VALID_FLAGS: u32 = 0x3f; |
| EXTERN!{extern "system" { |
| fn NtAllocateVirtualMemory( |
| ProcessHandle: HANDLE, |
| BaseAddress: *mut PVOID, |
| ZeroBits: ULONG_PTR, |
| RegionSize: PSIZE_T, |
| AllocationType: ULONG, |
| Protect: ULONG, |
| ) -> NTSTATUS; |
| fn NtFreeVirtualMemory( |
| ProcessHandle: HANDLE, |
| BaseAddress: *mut PVOID, |
| RegionSize: PSIZE_T, |
| FreeType: ULONG, |
| ) -> NTSTATUS; |
| fn NtReadVirtualMemory( |
| ProcessHandle: HANDLE, |
| BaseAddress: PVOID, |
| Buffer: PVOID, |
| BufferSize: SIZE_T, |
| NumberOfBytesRead: PSIZE_T, |
| ) -> NTSTATUS; |
| fn NtWriteVirtualMemory( |
| ProcessHandle: HANDLE, |
| BaseAddress: PVOID, |
| Buffer: PVOID, |
| BufferSize: SIZE_T, |
| NumberOfBytesWritten: PSIZE_T, |
| ) -> NTSTATUS; |
| fn NtProtectVirtualMemory( |
| ProcessHandle: HANDLE, |
| BaseAddress: *mut PVOID, |
| RegionSize: PSIZE_T, |
| NewProtect: ULONG, |
| OldProtect: PULONG, |
| ) -> NTSTATUS; |
| fn NtQueryVirtualMemory( |
| ProcessHandle: HANDLE, |
| BaseAddress: PVOID, |
| MemoryInformationClass: MEMORY_INFORMATION_CLASS, |
| MemoryInformation: PVOID, |
| MemoryInformationLength: SIZE_T, |
| ReturnLength: PSIZE_T, |
| ) -> NTSTATUS; |
| }} |
| ENUM!{enum VIRTUAL_MEMORY_INFORMATION_CLASS { |
| VmPrefetchInformation = 0, |
| VmPagePriorityInformation = 1, |
| VmCfgCallTargetInformation = 2, |
| VmPageDirtyStateInformation = 3, |
| }} |
| STRUCT!{struct MEMORY_RANGE_ENTRY { |
| VirtualAddress: PVOID, |
| NumberOfBytes: SIZE_T, |
| }} |
| pub type PMEMORY_RANGE_ENTRY = *mut MEMORY_RANGE_ENTRY; |
| STRUCT!{struct CFG_CALL_TARGET_LIST_INFORMATION { |
| NumberOfEntries: ULONG, |
| Reserved: ULONG, |
| NumberOfEntriesProcessed: PULONG, |
| CallTargetInfo: PCFG_CALL_TARGET_INFO, |
| Section: PVOID, |
| FileOffset: ULONGLONG, |
| }} |
| pub type PCFG_CALL_TARGET_LIST_INFORMATION = *mut CFG_CALL_TARGET_LIST_INFORMATION; |
| EXTERN!{extern "system" { |
| fn NtSetInformationVirtualMemory( |
| ProcessHandle: HANDLE, |
| VmInformationClass: VIRTUAL_MEMORY_INFORMATION_CLASS, |
| NumberOfEntries: ULONG_PTR, |
| VirtualAddresses: PMEMORY_RANGE_ENTRY, |
| VmInformation: PVOID, |
| VmInformationLength: ULONG, |
| ) -> NTSTATUS; |
| fn NtLockVirtualMemory( |
| ProcessHandle: HANDLE, |
| BaseAddress: *mut PVOID, |
| RegionSize: PSIZE_T, |
| MapType: ULONG, |
| ) -> NTSTATUS; |
| fn NtUnlockVirtualMemory( |
| ProcessHandle: HANDLE, |
| BaseAddress: *mut PVOID, |
| RegionSize: PSIZE_T, |
| MapType: ULONG, |
| ) -> NTSTATUS; |
| fn NtCreateSection( |
| SectionHandle: PHANDLE, |
| DesiredAccess: ACCESS_MASK, |
| ObjectAttributes: POBJECT_ATTRIBUTES, |
| MaximumSize: PLARGE_INTEGER, |
| SectionPageProtection: ULONG, |
| AllocationAttributes: ULONG, |
| FileHandle: HANDLE, |
| ) -> NTSTATUS; |
| fn NtCreateSectionEx( |
| SectionHandle: PHANDLE, |
| DesiredAccess: ACCESS_MASK, |
| ObjectAttributes: POBJECT_ATTRIBUTES, |
| MaximumSize: PLARGE_INTEGER, |
| SectionPageProtection: ULONG, |
| AllocationAttributes: ULONG, |
| FileHandle: HANDLE, |
| ExtendedParameters: PMEM_EXTENDED_PARAMETER, |
| ExtendedParameterCount: ULONG, |
| ) -> NTSTATUS; |
| fn NtOpenSection( |
| SectionHandle: PHANDLE, |
| DesiredAccess: ACCESS_MASK, |
| ObjectAttributes: POBJECT_ATTRIBUTES, |
| ) -> NTSTATUS; |
| fn NtMapViewOfSection( |
| SectionHandle: HANDLE, |
| ProcessHandle: HANDLE, |
| BaseAddress: *mut PVOID, |
| ZeroBits: ULONG_PTR, |
| CommitSize: SIZE_T, |
| SectionOffset: PLARGE_INTEGER, |
| ViewSize: PSIZE_T, |
| InheritDisposition: SECTION_INHERIT, |
| AllocationType: ULONG, |
| Win32Protect: ULONG, |
| ) -> NTSTATUS; |
| fn NtUnmapViewOfSection( |
| ProcessHandle: HANDLE, |
| BaseAddress: PVOID, |
| ) -> NTSTATUS; |
| fn NtUnmapViewOfSectionEx( |
| ProcessHandle: HANDLE, |
| BaseAddress: PVOID, |
| Flags: ULONG, |
| ) -> NTSTATUS; |
| fn NtExtendSection( |
| SectionHandle: HANDLE, |
| NewSectionSize: PLARGE_INTEGER, |
| ) -> NTSTATUS; |
| fn NtQuerySection( |
| SectionHandle: HANDLE, |
| SectionInformationClass: SECTION_INFORMATION_CLASS, |
| SectionInformation: PVOID, |
| SectionInformationLength: SIZE_T, |
| ReturnLength: PSIZE_T, |
| ) -> NTSTATUS; |
| fn NtAreMappedFilesTheSame( |
| File1MappedAsAnImage: PVOID, |
| File2MappedAsFile: PVOID, |
| ) -> NTSTATUS; |
| }} |
| pub const MEMORY_PARTITION_QUERY_ACCESS: u32 = 0x0001; |
| pub const MEMORY_PARTITION_MODIFY_ACCESS: u32 = 0x0002; |
| pub const MEMORY_PARTITION_ALL_ACCESS: u32 = STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE |
| | MEMORY_PARTITION_QUERY_ACCESS | MEMORY_PARTITION_MODIFY_ACCESS; |
| ENUM!{enum MEMORY_PARTITION_INFORMATION_CLASS { |
| SystemMemoryPartitionInformation = 0, |
| SystemMemoryPartitionMoveMemory = 1, |
| SystemMemoryPartitionAddPagefile = 2, |
| SystemMemoryPartitionCombineMemory = 3, |
| SystemMemoryPartitionInitialAddMemory = 4, |
| SystemMemoryPartitionGetMemoryEvents = 5, |
| SystemMemoryPartitionMax = 6, |
| }} |
| STRUCT!{struct MEMORY_PARTITION_CONFIGURATION_INFORMATION { |
| Flags: ULONG, |
| NumaNode: ULONG, |
| Channel: ULONG, |
| NumberOfNumaNodes: ULONG, |
| ResidentAvailablePages: ULONG_PTR, |
| CommittedPages: ULONG_PTR, |
| CommitLimit: ULONG_PTR, |
| PeakCommitment: ULONG_PTR, |
| TotalNumberOfPages: ULONG_PTR, |
| AvailablePages: ULONG_PTR, |
| ZeroPages: ULONG_PTR, |
| FreePages: ULONG_PTR, |
| StandbyPages: ULONG_PTR, |
| StandbyPageCountByPriority: [ULONG_PTR; 8], |
| RepurposedPagesByPriority: [ULONG_PTR; 8], |
| MaximumCommitLimit: ULONG_PTR, |
| DonatedPagesToPartitions: ULONG_PTR, |
| PartitionId: ULONG, |
| }} |
| pub type PMEMORY_PARTITION_CONFIGURATION_INFORMATION = |
| *mut MEMORY_PARTITION_CONFIGURATION_INFORMATION; |
| STRUCT!{struct MEMORY_PARTITION_TRANSFER_INFORMATION { |
| NumberOfPages: ULONG_PTR, |
| NumaNode: ULONG, |
| Flags: ULONG, |
| }} |
| pub type PMEMORY_PARTITION_TRANSFER_INFORMATION = *mut MEMORY_PARTITION_TRANSFER_INFORMATION; |
| STRUCT!{struct MEMORY_PARTITION_PAGEFILE_INFORMATION { |
| PageFileName: UNICODE_STRING, |
| MinimumSize: LARGE_INTEGER, |
| MaximumSize: LARGE_INTEGER, |
| Flags: ULONG, |
| }} |
| pub type PMEMORY_PARTITION_PAGEFILE_INFORMATION = *mut MEMORY_PARTITION_PAGEFILE_INFORMATION; |
| STRUCT!{struct MEMORY_PARTITION_PAGE_COMBINE_INFORMATION { |
| StopHandle: HANDLE, |
| Flags: ULONG, |
| TotalNumberOfPages: ULONG_PTR, |
| }} |
| pub type PMEMORY_PARTITION_PAGE_COMBINE_INFORMATION = |
| *mut MEMORY_PARTITION_PAGE_COMBINE_INFORMATION; |
| STRUCT!{struct MEMORY_PARTITION_PAGE_RANGE { |
| StartPage: ULONG_PTR, |
| NumberOfPages: ULONG_PTR, |
| }} |
| pub type PMEMORY_PARTITION_PAGE_RANGE = *mut MEMORY_PARTITION_PAGE_RANGE; |
| STRUCT!{struct MEMORY_PARTITION_INITIAL_ADD_INFORMATION { |
| Flags: ULONG, |
| NumberOfRanges: ULONG, |
| NumberOfPagesAdded: ULONG_PTR, |
| PartitionRanges: [MEMORY_PARTITION_PAGE_RANGE; 1], |
| }} |
| pub type PMEMORY_PARTITION_INITIAL_ADD_INFORMATION = *mut MEMORY_PARTITION_INITIAL_ADD_INFORMATION; |
| STRUCT!{struct MEMORY_PARTITION_MEMORY_EVENTS_INFORMATION { |
| Flags: ULONG, |
| HandleAttributes: ULONG, |
| DesiredAccess: ULONG, |
| LowCommitCondition: HANDLE, |
| HighCommitCondition: HANDLE, |
| MaximumCommitCondition: HANDLE, |
| }} |
| BITFIELD!{MEMORY_PARTITION_MEMORY_EVENTS_INFORMATION Flags: ULONG [ |
| CommitEvents set_CommitEvents[0..1], |
| Spare set_Spare[1..32], |
| ]} |
| pub type PMEMORY_PARTITION_MEMORY_EVENTS_INFORMATION = |
| *mut MEMORY_PARTITION_MEMORY_EVENTS_INFORMATION; |
| EXTERN!{extern "system" { |
| fn NtCreatePartition( |
| PartitionHandle: PHANDLE, |
| DesiredAccess: ACCESS_MASK, |
| ObjectAttributes: POBJECT_ATTRIBUTES, |
| PreferredNode: ULONG, |
| ) -> NTSTATUS; |
| fn NtOpenPartition( |
| PartitionHandle: PHANDLE, |
| DesiredAccess: ACCESS_MASK, |
| ObjectAttributes: POBJECT_ATTRIBUTES, |
| ) -> NTSTATUS; |
| fn NtManagePartition( |
| PartitionInformationClass: MEMORY_PARTITION_INFORMATION_CLASS, |
| PartitionInformation: PVOID, |
| PartitionInformationLength: ULONG, |
| ) -> NTSTATUS; |
| fn NtMapUserPhysicalPages( |
| VirtualAddress: PVOID, |
| NumberOfPages: ULONG_PTR, |
| UserPfnArray: PULONG_PTR, |
| ) -> NTSTATUS; |
| fn NtMapUserPhysicalPagesScatter( |
| VirtualAddresses: *mut PVOID, |
| NumberOfPages: ULONG_PTR, |
| UserPfnArray: PULONG_PTR, |
| ) -> NTSTATUS; |
| fn NtAllocateUserPhysicalPages( |
| ProcessHandle: HANDLE, |
| NumberOfPages: PULONG_PTR, |
| UserPfnArray: PULONG_PTR, |
| ) -> NTSTATUS; |
| fn NtFreeUserPhysicalPages( |
| ProcessHandle: HANDLE, |
| NumberOfPages: PULONG_PTR, |
| UserPfnArray: PULONG_PTR, |
| ) -> NTSTATUS; |
| fn NtOpenSession( |
| SessionHandle: PHANDLE, |
| DesiredAccess: ACCESS_MASK, |
| ObjectAttributes: POBJECT_ATTRIBUTES, |
| ) -> NTSTATUS; |
| fn NtGetWriteWatch( |
| ProcessHandle: HANDLE, |
| Flags: ULONG, |
| BaseAddress: PVOID, |
| RegionSize: SIZE_T, |
| UserAddressArray: *mut PVOID, |
| EntriesInUserAddressArray: PULONG_PTR, |
| Granularity: PULONG, |
| ) -> NTSTATUS; |
| fn NtResetWriteWatch( |
| ProcessHandle: HANDLE, |
| BaseAddress: PVOID, |
| RegionSize: SIZE_T, |
| ) -> NTSTATUS; |
| fn NtCreatePagingFile( |
| PageFileName: PUNICODE_STRING, |
| MinimumSize: PLARGE_INTEGER, |
| MaximumSize: PLARGE_INTEGER, |
| Priority: ULONG, |
| ) -> NTSTATUS; |
| fn NtFlushInstructionCache( |
| ProcessHandle: HANDLE, |
| BaseAddress: PVOID, |
| Length: SIZE_T, |
| ) -> NTSTATUS; |
| fn NtFlushWriteBuffer() -> NTSTATUS; |
| }} |