Repository navigation
Expand file tree
/
Copy pathNativeEnums.cs
More file actions
3060 lines (2632 loc) · 123 KB
/
Copy pathNativeEnums.cs
File metadata and controls
3060 lines (2632 loc) · 123 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
using System;
using System.Diagnostics.CodeAnalysis;
using System.Runtime.InteropServices;
namespace Process.NET.Native.Types
{
/// <summary>
/// A list of calling conventions.
/// </summary>
public enum CallingConventions
{
/// <summary>
/// Name : C Declaration Calling Convention
/// Clean-up : Caller
/// Parameters : Passed on the stack in reverse order
/// Ret. value : Returned in the EAX register
/// Notes : Widely used by the compiler GCC
/// </summary>
Cdecl,
/// <summary>
/// Name : Standard Calling Convention
/// Clean-up : Callee
/// Parameters : Passed on the stack in reverse order
/// Ret. value : Returned in the EAX register
/// Notes : Convention created by Microsoft, used in the Win32 API
/// </summary>
Stdcall,
/// <summary>
/// Name : Fast Calling Convention (aka __msfastcall)
/// Clean-up : Callee
/// Parameters : The first two parameters are placed in the ECX and EDX registers respectively.
/// Any remaining parameters are placed on the stack in reverse order.
/// Ret. Value : Returned in the EAX register
/// Notes : A variation of the stdcall convention
/// </summary>
Fastcall,
/// <summary>
/// Name : This Calling Convention
/// Clean-up : Callee
/// Parameters : The 'this' pointer is placed in the ECX register.
/// Parameters are placed on the stack in reverse order.
/// Ret. Value : Returned in the EAX register
/// Notes : Used for object-oriented programming by Microsoft Visual C++
/// </summary>
Thiscall
}
public enum MouseMessages
{
WmMouseMove = 0x200,
WmLButtonDown = 0x201,
WmLButtonUp = 0x202,
WmRButtonDown = 0x204,
WmRButtonUp = 0x205,
WmMButtonDown = 0x207,
WmMButtonUp = 0x208,
WmMouseWheel = 0x20A
}
public enum MouseEventNames
{
MouseMove,
LeftButtonDown,
LeftButtonUp,
RightButtonDown,
RightButtonUp,
MiddleButtonDown,
MiddleButtonUp,
MouseWheel
}
public enum MouseScrollDirection
{
None = -1,
Up = 0,
Down = 1
}
/// <summary>
/// A list of type of clean-up available in calling conventions.
/// </summary>
public enum CleanupTypes
{
/// <summary>
/// The clean-up task is performed by the called function.
/// </summary>
Callee,
/// <summary>
/// The clean-up task is performed by the caller function.
/// </summary>
Caller
}
public enum ProcessorArchitecture
{
X86 = 0,
X64 = 9,
@Arm = -1,
Itanium = 6,
Unknown = 0xFFFF
}
[SuppressMessage("ReSharper", "InconsistentNaming")]
public enum PrivilegeAttributes
{
SE_PRIVILEGE_ENABLED = 0x00000002
}
[SuppressMessage("ReSharper", "InconsistentNaming")]
public enum TokenObject
{
TOKEN_QUERY = 0x0008,
TOKEN_QUERY_SOURCE = 0x0010,
TOKEN_ADJUST_PRIVILEGES = 0x0020
}
public enum ModiferVirtualKeyStates
{
VK_LWIN = 0x5B,
VK_RWIN = 0x5C,
VK_LSHIFT = 0xA0,
VK_RSHIFT = 0xA1,
VK_LCONTROL = 0xA2,
VK_RCONTROL = 0xA3,
VK_LALT = 0xA4, //aka VK_LMENU
VK_RALT = 0xA5 //aka VK_RMENU
}
/// <summary>
/// Flash window flags list.
/// </summary>
[Flags]
public enum FlashWindowFlags
{
/// <summary>
/// Flash both the window caption and taskbar button. This is equivalent to setting the <see cref="Caption" /> |
/// <see cref="Tray" /> flags.
/// </summary>
All = 0x3,
/// <summary>
/// Flash the window caption.
/// </summary>
Caption = 0x1,
/// <summary>
/// Stop flashing. The system restores the window to its original state.
/// </summary>
Stop = 0x0,
/// <summary>
/// Flash continuously, until the <see cref="Stop" /> flag is set.
/// </summary>
Timer = 0x4,
/// <summary>
/// Flash continuously until the window comes to the foreground.
/// </summary>
TimerNoForeground = 0x0C,
/// <summary>
/// Flash the taskbar button.
/// </summary>
Tray = 0x2
}
[SuppressMessage("ReSharper", "InconsistentNaming")]
public enum HookType
{
WH_JOURNALRECORD = 0,
WH_JOURNALPLAYBACK = 1,
WH_KEYBOARD = 2,
WH_GETMESSAGE = 3,
WH_CALLWNDPROC = 4,
WH_CBT = 5,
WH_SYSMSGFILTER = 6,
WH_MOUSE = 7,
WH_HARDWARE = 8,
WH_DEBUG = 9,
WH_SHELL = 10,
WH_FOREGROUNDIDLE = 11,
WH_CALLWNDPROCRET = 12,
WH_KEYBOARD_LL = 13,
WH_MOUSE_LL = 14
}
/// <summary>
/// The types used in the function <see cref="NativeMethods.SendInput" /> for input events.
/// </summary>
public enum InputTypes
{
Mouse = 0,
Keyboard = 1,
Hardware = 2
}
/// <summary>
/// The keyboard flags list.
/// </summary>
[Flags]
public enum KeyboardFlags
{
/// <summary>
/// If specified, the scan code was preceded by a prefix byte that has the value 0xE0 (224).
/// </summary>
ExtendedKey = 1,
/// <summary>
/// If specified, the key is being released. If not specified, the key is being pressed.
/// </summary>
KeyUp = 2,
/// <summary>
/// If specified, <see cref="KeyboardInput.ScanCode" /> identifies the key and <see cref="KeyboardInput.VirtualKey" />
/// is ignored.
/// </summary>
ScanCode = 8,
/// <summary>
/// If specified, the system synthesizes a VK_PACKET keystroke. The <see cref="KeyboardInput.VirtualKey" /> parameter
/// must be zero.
/// This flag can only be combined with the KEYEVENTF_KEYUP flag.
/// </summary>
Unicode = 4
}
/// <summary>
/// The key codes and modifiers list.
/// </summary>
[Flags]
public enum Keys
{
A = 0x41,
Add = 0x6b,
Alt = 0x40000,
Apps = 0x5d,
Attn = 0xf6,
B = 0x42,
Back = 8,
BrowserBack = 0xa6,
BrowserFavorites = 0xab,
BrowserForward = 0xa7,
BrowserHome = 0xac,
BrowserRefresh = 0xa8,
BrowserSearch = 170,
BrowserStop = 0xa9,
C = 0x43,
Cancel = 3,
Capital = 20,
CapsLock = 20,
Clear = 12,
Control = 0x20000,
ControlKey = 0x11,
Crsel = 0xf7,
D = 0x44,
D0 = 0x30,
D1 = 0x31,
D2 = 50,
D3 = 0x33,
D4 = 0x34,
D5 = 0x35,
D6 = 0x36,
D7 = 0x37,
D8 = 0x38,
D9 = 0x39,
Decimal = 110,
Delete = 0x2e,
Divide = 0x6f,
Down = 40,
E = 0x45,
End = 0x23,
Enter = 13,
EraseEof = 0xf9,
Escape = 0x1b,
Execute = 0x2b,
Exsel = 0xf8,
F = 70,
F1 = 0x70,
F10 = 0x79,
F11 = 0x7a,
F12 = 0x7b,
F13 = 0x7c,
F14 = 0x7d,
F15 = 0x7e,
F16 = 0x7f,
F17 = 0x80,
F18 = 0x81,
F19 = 130,
F2 = 0x71,
F20 = 0x83,
F21 = 0x84,
F22 = 0x85,
F23 = 0x86,
F24 = 0x87,
F3 = 0x72,
F4 = 0x73,
F5 = 0x74,
F6 = 0x75,
F7 = 0x76,
F8 = 0x77,
F9 = 120,
FinalMode = 0x18,
G = 0x47,
H = 0x48,
HanguelMode = 0x15,
HangulMode = 0x15,
HanjaMode = 0x19,
Help = 0x2f,
Home = 0x24,
I = 0x49,
ImeAccept = 30,
ImeAceept = 30,
ImeConvert = 0x1c,
ImeModeChange = 0x1f,
ImeNonconvert = 0x1d,
Insert = 0x2d,
J = 0x4a,
JunjaMode = 0x17,
K = 0x4b,
KanaMode = 0x15,
KanjiMode = 0x19,
KeyCode = 0xffff,
L = 0x4c,
LaunchApplication1 = 0xb6,
LaunchApplication2 = 0xb7,
LaunchMail = 180,
LButton = 1,
LControlKey = 0xa2,
Left = 0x25,
LineFeed = 10,
LMenu = 0xa4,
LShiftKey = 160,
LWin = 0x5b,
M = 0x4d,
MButton = 4,
MediaNextTrack = 0xb0,
MediaPlayPause = 0xb3,
MediaPreviousTrack = 0xb1,
MediaStop = 0xb2,
Menu = 0x12,
Modifiers = -65536,
Multiply = 0x6a,
N = 0x4e,
Next = 0x22,
NoName = 0xfc,
None = 0,
NumLock = 0x90,
NumPad0 = 0x60,
NumPad1 = 0x61,
NumPad2 = 0x62,
NumPad3 = 0x63,
NumPad4 = 100,
NumPad5 = 0x65,
NumPad6 = 0x66,
NumPad7 = 0x67,
NumPad8 = 0x68,
NumPad9 = 0x69,
O = 0x4f,
Oem1 = 0xba,
Oem102 = 0xe2,
Oem2 = 0xbf,
Oem3 = 0xc0,
Oem4 = 0xdb,
Oem5 = 220,
Oem6 = 0xdd,
Oem7 = 0xde,
Oem8 = 0xdf,
OemBackslash = 0xe2,
OemClear = 0xfe,
OemCloseBrackets = 0xdd,
Oemcomma = 0xbc,
OemMinus = 0xbd,
OemOpenBrackets = 0xdb,
OemPeriod = 190,
OemPipe = 220,
Oemplus = 0xbb,
OemQuestion = 0xbf,
OemQuotes = 0xde,
OemSemicolon = 0xba,
Oemtilde = 0xc0,
P = 80,
Pa1 = 0xfd,
Packet = 0xe7,
PageDown = 0x22,
PageUp = 0x21,
Pause = 0x13,
Play = 250,
Print = 0x2a,
PrintScreen = 0x2c,
Prior = 0x21,
ProcessKey = 0xe5,
Q = 0x51,
R = 0x52,
RButton = 2,
RControlKey = 0xa3,
Return = 13,
Right = 0x27,
RMenu = 0xa5,
RShiftKey = 0xa1,
RWin = 0x5c,
S = 0x53,
Scroll = 0x91,
Select = 0x29,
SelectMedia = 0xb5,
Separator = 0x6c,
Shift = 0x10000,
ShiftKey = 0x10,
Sleep = 0x5f,
Snapshot = 0x2c,
Space = 0x20,
Subtract = 0x6d,
T = 0x54,
Tab = 9,
U = 0x55,
Up = 0x26,
V = 0x56,
VolumeDown = 0xae,
VolumeMute = 0xad,
VolumeUp = 0xaf,
W = 0x57,
X = 0x58,
XButton1 = 5,
XButton2 = 6,
Y = 0x59,
Z = 90,
Zoom = 0xfb
}
/// <summary>
/// Memory-allocation options list.
/// </summary>
[Flags]
public enum MemoryAllocationFlags
{
/// <summary>
/// Allocates memory charges (from the overall size of memory and the paging files on disk) for the specified reserved
/// memory pages.
/// The function also guarantees that when the caller later initially accesses the memory, the contents will be zero.
/// Actual physical pages are not allocated unless/until the virtual addresses are actually accessed.
/// To reserve and commit pages in one step, call <see cref="NativeMethods.VirtualAllocEx" /> with MEM_COMMIT |
/// MEM_RESERVE.
/// The function fails if you attempt to commit a page that has not been reserved. The resulting error code is
/// ERROR_INVALID_ADDRESS.
/// An attempt to commit a page that is already committed does not cause the function to fail.
/// This means that you can commit pages without first determining the current commitment state of each page.
/// </summary>
Commit = 0x00001000,
/// <summary>
/// Reserves a range of the process's virtual address space without allocating any actual physical storage in memory or
/// in the paging file on disk.
/// You commit reserved pages by calling <see cref="NativeMethods.VirtualAllocEx" /> again with MEM_COMMIT.
/// To reserve and commit pages in one step, call VirtualAllocEx with MEM_COMMIT | MEM_RESERVE.
/// Other memory allocation functions, such as malloc and LocalAlloc, cannot use reserved memory until it has been
/// released.
/// </summary>
Reserve = 0x00002000,
/// <summary>
/// Indicates that data in the memory range specified by lpAddress and dwSize is no longer of interest.
/// The pages should not be read from or written to the paging file.
/// However, the memory block will be used again later, so it should not be decommitted. This value cannot be used with
/// any other value.
/// Using this value does not guarantee that the range operated on with MEM_RESET will contain zeros. If you want the
/// range to contain zeros, decommit the memory and then recommit it.
/// When you use MEM_RESET, the VirtualAllocEx function ignores the value of fProtect. However, you must still set
/// fProtect to a valid protection value, such as PAGE_NOACCESS.
/// <see cref="NativeMethods.VirtualAllocEx" /> returns an error if you use MEM_RESET and the range of memory is mapped
/// to a file.
/// A shared view is only acceptable if it is mapped to a paging file.
/// </summary>
Reset = 0x00080000,
/// <summary>
/// MEM_RESET_UNDO should only be called on an address range to which MEM_RESET was successfully applied earlier.
/// It indicates that the data in the specified memory range specified by lpAddress and dwSize is of interest to the
/// caller and attempts to reverse the effects of MEM_RESET.
/// If the function succeeds, that means all data in the specified address range is intact.
/// If the function fails, at least some of the data in the address range has been replaced with zeroes.
/// This value cannot be used with any other value.
/// If MEM_RESET_UNDO is called on an address range which was not MEM_RESET earlier, the behavior is undefined.
/// When you specify MEM_RESET, the <see cref="NativeMethods.VirtualAllocEx" /> function ignores the value of
/// flProtect.
/// However, you must still set flProtect to a valid protection value, such as PAGE_NOACCESS.
/// </summary>
ResetUndo = 0x1000000,
/// <summary>
/// Allocates memory using large page support.
/// The size and alignment must be a multiple of the large-page minimum. To obtain this value, use the
/// GetLargePageMinimum function.
/// </summary>
LargePages = 0x20000000,
/// <summary>
/// Reserves an address range that can be used to map Address Windowing Extensions (AWE) pages.
/// This value must be used with MEM_RESERVE and no other values.
/// </summary>
Physical = 0x00400000,
/// <summary>
/// Allocates memory at the highest possible address. This can be slower than regular allocations, especially when
/// there are many allocations.
/// </summary>
TopDown = 0x00100000
}
/// <summary>
/// Memory-protection options list.
/// </summary>
[Flags]
public enum MemoryProtectionFlags
{
/// <summary>
/// Disables all access to the committed region of pages. An attempt to read from, write to, or execute the committed
/// region results in an access violation.
/// This value is not officially present in the Microsoft's enumeration but can occur according to the
/// MEMORY_BASIC_INFORMATION structure documentation.
/// </summary>
ZeroAccess = 0x0,
/// <summary>
/// Enables execute access to the committed region of pages. An attempt to read from or write to the committed region
/// results in an access violation.
/// This flag is not supported by the CreateFileMapping function.
/// </summary>
Execute = 0x10,
/// <summary>
/// Enables execute or read-only access to the committed region of pages. An attempt to write to the committed region
/// results in an access violation.
/// </summary>
ExecuteRead = 0x20,
/// <summary>
/// Enables execute, read-only, or read/write access to the committed region of pages.
/// </summary>
ExecuteReadWrite = 0x40,
/// <summary>
/// Enables execute, read-only, or copy-on-write access to a mapped view of a file mapping object.
/// An attempt to write to a committed copy-on-write page results in a private copy of the page being made for the
/// process.
/// The private page is marked as PAGE_EXECUTE_READWRITE, and the change is written to the new page.
/// This flag is not supported by the VirtualAlloc or <see cref="NativeMethods.VirtualAllocEx" /> functions.
/// </summary>
ExecuteWriteCopy = 0x80,
/// <summary>
/// Disables all access to the committed region of pages. An attempt to read from, write to, or execute the committed
/// region results in an access violation.
/// This flag is not supported by the CreateFileMapping function.
/// </summary>
NoAccess = 0x01,
/// <summary>
/// Enables read-only access to the committed region of pages. An attempt to write to the committed region results in
/// an access violation.
/// If Data Execution Prevention is enabled, an attempt to execute code in the committed region results in an access
/// violation.
/// </summary>
ReadOnly = 0x02,
/// <summary>
/// Enables read-only or read/write access to the committed region of pages.
/// If Data Execution Prevention is enabled, attempting to execute code in the committed region results in an access
/// violation.
/// </summary>
ReadWrite = 0x04,
/// <summary>
/// Enables read-only or copy-on-write access to a mapped view of a file mapping object.
/// An attempt to write to a committed copy-on-write page results in a private copy of the page being made for the
/// process.
/// The private page is marked as PAGE_READWRITE, and the change is written to the new page.
/// If Data Execution Prevention is enabled, attempting to execute code in the committed region results in an access
/// violation.
/// This flag is not supported by the VirtualAlloc or <see cref="NativeMethods.VirtualAllocEx" /> functions.
/// </summary>
WriteCopy = 0x08,
/// <summary>
/// Pages in the region become guard pages.
/// Any attempt to access a guard page causes the system to raise a STATUS_GUARD_PAGE_VIOLATION exception and turn off
/// the guard page status.
/// Guard pages thus act as a one-time access alarm. For more information, see Creating Guard Pages.
/// When an access attempt leads the system to turn off guard page status, the underlying page protection takes over.
/// If a guard page exception occurs during a system service, the service typically returns a failure status indicator.
/// This value cannot be used with PAGE_NOACCESS.
/// This flag is not supported by the CreateFileMapping function.
/// </summary>
Guard = 0x100,
/// <summary>
/// Sets all pages to be non-cachable. Applications should not use this attribute except when explicitly required for a
/// device.
/// Using the interlocked functions with memory that is mapped with SEC_NOCACHE can result in an
/// EXCEPTION_ILLEGAL_INSTRUCTION exception.
/// The PAGE_NOCACHE flag cannot be used with the PAGE_GUARD, PAGE_NOACCESS, or PAGE_WRITECOMBINE flags.
/// The PAGE_NOCACHE flag can be used only when allocating private memory with the VirtualAlloc,
/// <see cref="NativeMethods.VirtualAllocEx" />, or VirtualAllocExNuma functions.
/// To enable non-cached memory access for shared memory, specify the SEC_NOCACHE flag when calling the
/// CreateFileMapping function.
/// </summary>
NoCache = 0x200,
/// <summary>
/// Sets all pages to be write-combined.
/// Applications should not use this attribute except when explicitly required for a device.
/// Using the interlocked functions with memory that is mapped as write-combined can result in an
/// EXCEPTION_ILLEGAL_INSTRUCTION exception.
/// The PAGE_WRITECOMBINE flag cannot be specified with the PAGE_NOACCESS, PAGE_GUARD, and PAGE_NOCACHE flags.
/// The PAGE_WRITECOMBINE flag can be used only when allocating private memory with the VirtualAlloc,
/// <see cref="NativeMethods.VirtualAllocEx" />, or VirtualAllocExNuma functions.
/// To enable write-combined memory access for shared memory, specify the SEC_WRITECOMBINE flag when calling the
/// CreateFileMapping function.
/// </summary>
WriteCombine = 0x400
}
/// <summary>
/// Memory-release options list.
/// </summary>
[Flags]
public enum MemoryReleaseFlags
{
/// <summary>
/// Decommits the specified region of committed pages. After the operation, the pages are in the reserved state.
/// The function does not fail if you attempt to decommit an uncommitted page.
/// This means that you can decommit a range of pages without first determining their current commitment state.
/// Do not use this value with MEM_RELEASE.
/// </summary>
Decommit = 0x4000,
/// <summary>
/// Releases the specified region of pages. After the operation, the pages are in the free state.
/// If you specify this value, dwSize must be 0 (zero), and lpAddress must point to the base address returned by the
/// VirtualAllocEx function when the region is reserved.
/// The function fails if either of these conditions is not met.
/// If any pages in the region are committed currently, the function first decommits, and then releases them.
/// The function does not fail if you attempt to release pages that are in different states, some reserved and some
/// committed.
/// This means that you can release a range of pages without first determining the current commitment state.
/// Do not use this value with MEM_DECOMMIT.
/// </summary>
Release = 0x8000
}
/// <summary>
/// Memory-state options list.
/// </summary>
[Flags]
public enum MemoryStateFlags
{
/// <summary>
/// Indicates committed pages for which physical storage has been allocated, either in memory or in the paging file on
/// disk.
/// </summary>
Commit = 0x1000,
/// <summary>
/// Indicates free pages not accessible to the calling process and available to be allocated.
/// For free pages, the information in the AllocationBase, AllocationProtect, Protect, and Type members is undefined.
/// </summary>
Free = 0x10000,
/// <summary>
/// Indicates reserved pages where a range of the process's virtual address space is reserved without any physical
/// storage being allocated.
/// For reserved pages, the information in the Protect member is undefined.
/// </summary>
Reserve = 0x2000
}
/// <summary>
/// Memory-type options list.
/// </summary>
[Flags]
public enum MemoryTypeFlags
{
/// <summary>
/// This value is not officially present in the Microsoft's enumeration but can occur after testing.
/// </summary>
None = 0x0,
/// <summary>
/// Indicates that the memory pages within the region are mapped into the view of an image section.
/// </summary>
Image = 0x1000000,
/// <summary>
/// Indicates that the memory pages within the region are mapped into the view of a section.
/// </summary>
Mapped = 0x40000,
/// <summary>
/// Indicates that the memory pages within the region are private (that is, not shared by other processes).
/// </summary>
Private = 0x20000
}
/// <summary>
/// The mouse flags list.
/// </summary>
[Flags]
public enum MouseFlags
{
/// <summary>
/// The DeltaX and DeltaY members contain normalized absolute coordinates. If the flag is not set, DeltaX and DeltaY
/// contain relative data
/// (the change in position since the last reported position). This flag can be set, or not set, regardless of what
/// kind of mouse or other
/// pointing device, if any, is connected to the system.
/// </summary>
Absolute = 0x8000,
/// <summary>
/// The wheel was moved horizontally, if the mouse has a wheel. The amount of movement is specified in MouseData.
/// Windows XP/2000: This value is not supported.
/// </summary>
HWheel = 0x1000,
/// <summary>
/// Movement occurred.
/// </summary>
Move = 1,
/// <summary>
/// The WM_MOUSEMOVE messages will not be coalesced. The default behavior is to coalesce WM_MOUSEMOVE messages.
/// Windows XP/2000: This value is not supported.
/// </summary>
MoveNoCoalesce = 0x2000,
/// <summary>
/// The left button was pressed.
/// </summary>
LeftDown = 2,
/// <summary>
/// The left button was released.
/// </summary>
LeftUp = 4,
/// <summary>
/// The right button was pressed.
/// </summary>
RightDown = 8,
/// <summary>
/// The right button was released.
/// </summary>
RightUp = 0x10,
/// <summary>
/// The middle button was pressed.
/// </summary>
MiddleDown = 0x20,
/// <summary>
/// The middle button was released.
/// </summary>
MiddleUp = 0x40,
/// <summary>
/// Maps coordinates to the entire desktop. Must be used with <see cref="Absolute" />.
/// </summary>
VirtualDesk = 0x4000,
/// <summary>
/// The wheel was moved, if the mouse has a wheel. The amount of movement is specified in MouseData.
/// </summary>
Wheel = 0x800,
/// <summary>
/// An X button was pressed.
/// </summary>
XDown = 0x80,
/// <summary>
/// An X button was released.
/// </summary>
XUp = 0x100
}
/// <summary>
/// The structure of the Process Environment Block.
/// </summary>
/// <remarks>
/// Tested on Windows 7 x64, 2013-03-10
/// Source: http://blog.rewolf.pl/blog/?p=573#.UTyBo1fJL6p
/// </remarks>
public enum PebStructure
{
InheritedAddressSpace = 0x0,
ReadImageFileExecOptions = 0x1,
/// <summary>
/// Gets if the process is being debugged.
/// </summary>
BeingDebugged = 0x2,
SpareBool = 0x3,
Mutant = 0x4,
ImageBaseAddress = 0x8,
Ldr = 0xC,
ProcessParameters = 0x10,
SubSystemData = 0x14,
ProcessHeap = 0x18,
FastPebLock = 0x1C,
FastPebLockRoutine = 0x20,
FastPebUnlockRoutine = 0x24,
EnvironmentUpdateCount = 0x28,
KernelCallbackTable = 0x2C,
SystemReserved = 0x30,
AtlThunkSListPtr32 = 0x34,
FreeList = 0x38,
TlsExpansionCounter = 0x3C,
TlsBitmap = 0x40,
/// <summary>
/// Length: 8 bytes.
/// </summary>
TlsBitmapBits = 0x44,
ReadOnlySharedMemoryBase = 0x4C,
ReadOnlySharedMemoryHeap = 0x50,
ReadOnlyStaticServerData = 0x54,
AnsiCodePageData = 0x58,
OemCodePageData = 0x5C,
UnicodeCaseTableData = 0x60,
NumberOfProcessors = 0x64,
/// <summary>
/// Length: 8 bytes.
/// </summary>
NtGlobalFlag = 0x68,
/// <summary>
/// Length: 8 bytes (LARGE_INTEGER type).
/// </summary>
CriticalSectionTimeout = 0x70,
HeapSegmentReserve = 0x78,
HeapSegmentCommit = 0x7C,
HeapDeCommitTotalFreeThreshold = 0x80,
HeapDeCommitFreeBlockThreshold = 0x84,
NumberOfHeaps = 0x88,
MaximumNumberOfHeaps = 0x8C,
ProcessHeaps = 0x90,
GdiSharedHandleTable = 0x94,
ProcessStarterHelper = 0x98,
GdiDcAttributeList = 0x9C,
LoaderLock = 0xA0,
OsMajorVersion = 0xA4,
OsMinorVersion = 0xA8,
/// <summary>
/// Length: 2 bytes.
/// </summary>
OsBuildNumber = 0xAC,
/// <summary>
/// Length: 2 bytes.
/// </summary>
OsCsdVersion = 0xAE,
OsPlatformId = 0xB0,
ImageSubsystem = 0xB4,
ImageSubsystemMajorVersion = 0xB8,
ImageSubsystemMinorVersion = 0xBC,
ImageProcessAffinityMask = 0xC0,
/// <summary>
/// Length: 0x88 bytes (0x22 * sizeof(IntPtr)).
/// </summary>
GdiHandleBuffer = 0xC4,
PostProcessInitRoutine = 0x14C,
TlsExpansionBitmap = 0x150,
/// <summary>
/// Length: 0x80 bytes (0x20 * sizeof(IntPtr))
/// </summary>
TlsExpansionBitmapBits = 0x154,
SessionId = 0x1D4,
/// <summary>
/// Length: 8 bytes (LARGE_INTEGER type).
/// </summary>
AppCompatFlags = 0x1D8,
/// <summary>
/// Length: 8 bytes (LARGE_INTEGER type).
/// </summary>
AppCompatFlagsUser = 0x1E0,
ShimData = 0x1E8,
AppCompatInfo = 0x1EC,
/// <summary>
/// Length: 8 bytes (UNICODE_STRING type).
/// </summary>
CsdVersion = 0x1F0,
ActivationContextData = 0x1F8,
ProcessAssemblyStorageMap = 0x1FC,
SystemDefaultActivationContextData = 0x200,
SystemAssemblyStorageMap = 0x204,
MinimumStackCommit = 0x208
}
/// <summary>
/// Process access rights list.
/// </summary>
[Flags]
public enum ProcessAccessFlags
{
/// <summary>
/// All possible access rights for a process object.
/// </summary>
AllAccess = 0x001F0FFF,
/// <summary>
/// Required to create a process.
/// </summary>
CreateProcess = 0x0080,
/// <summary>
/// Required to create a thread.
/// </summary>
CreateThread = 0x0002,
/// <summary>
/// Required to duplicate a handle using DuplicateHandle.
/// </summary>
DupHandle = 0x0040,
/// <summary>
/// Required to retrieve certain information about a process, such as its token, exit code, and priority class (see
/// OpenProcessToken).
/// </summary>
QueryInformation = 0x0400,
/// <summary>
/// Required to retrieve certain information about a process (see GetExitCodeProcess, GetPriorityClass, IsProcessInJob,
/// QueryFullProcessImageName).
/// A handle that has the PROCESS_QUERY_INFORMATION access right is automatically granted
/// PROCESS_QUERY_LIMITED_INFORMATION.
/// </summary>
QueryLimitedInformation = 0x1000,
/// <summary>
/// Required to set certain information about a process, such as its priority class (see SetPriorityClass).
/// </summary>
SetInformation = 0x0200,
/// <summary>
/// Required to set memory limits using SetProcessWorkingSetSize.
/// </summary>
SetQuota = 0x0100,
/// <summary>
/// Required to suspend or resume a process.
/// </summary>
SuspendResume = 0x0800,
/// <summary>
/// Required to terminate a process using TerminateProcess.
/// </summary>
Terminate = 0x0001,
/// <summary>
/// Required to perform an operation on the address space of a process (see VirtualProtectEx and WriteProcessMemory).
/// </summary>
VmOperation = 0x0008,
/// <summary>
/// Required to read memory in a process using <see cref="NativeMethods.ReadProcessMemory" />.
/// </summary>
VmRead = 0x0010,
/// <summary>
/// Required to write to memory in a process using WriteProcessMemory.
/// </summary>
VmWrite = 0x0020,
/// <summary>
/// Required to wait for the process to terminate using the wait functions.
/// </summary>
Synchronize = 0x00100000
}
/// <summary>
/// The type of process information to be retrieved.
/// </summary>
public enum ProcessInformationClass
{
/// <summary>
/// Retrieves a pointer to a PEB structure that can be used to determine whether the specified process is being
/// debugged,
/// and a unique value used by the system to identify the specified process.
/// </summary>
ProcessBasicInformation = 0x0,