OLD | NEW |
(Empty) | |
| 1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. |
| 4 |
| 5 using System; |
| 6 using System.Collections.Generic; |
| 7 using System.Linq; |
| 8 using System.Runtime.InteropServices; |
| 9 using System.Text; |
| 10 using System.Threading.Tasks; |
| 11 |
| 12 namespace ChromeDebug.LowLevel { |
| 13 // Defines structures, enumerations, and types used by Win32 API calls. In so
me cases, the API |
| 14 // calls support (and even document) many more values than what are listed her
e. Should |
| 15 // additional values be required, they can be added to the respective types. |
| 16 public static class LowLevelTypes { |
| 17 |
| 18 #region Constants and Enums |
| 19 // Represents the image format of a DLL or executable. |
| 20 public enum ImageFormat { |
| 21 NATIVE, |
| 22 MANAGED, |
| 23 UNKNOWN |
| 24 } |
| 25 |
| 26 // Flags used for opening a file handle (e.g. in a call to CreateFile), that
determine the |
| 27 // requested permission level. |
| 28 [Flags] |
| 29 public enum FileAccessFlags : uint { |
| 30 GENERIC_WRITE = 0x40000000, |
| 31 GENERIC_READ = 0x80000000 |
| 32 } |
| 33 |
| 34 // Value used for CreateFile to determine how to behave in the presence (or
absence) of a |
| 35 // file with the requested name. Used only for CreateFile. |
| 36 public enum FileCreationDisposition : uint { |
| 37 CREATE_NEW = 1, |
| 38 CREATE_ALWAYS = 2, |
| 39 OPEN_EXISTING = 3, |
| 40 OPEN_ALWAYS = 4, |
| 41 TRUNCATE_EXISTING = 5 |
| 42 } |
| 43 |
| 44 // Flags that determine what level of sharing this application requests on t
he target file. |
| 45 // Used only for CreateFile. |
| 46 [Flags] |
| 47 public enum FileShareFlags : uint { |
| 48 EXCLUSIVE_ACCESS = 0x0, |
| 49 SHARE_READ = 0x1, |
| 50 SHARE_WRITE = 0x2, |
| 51 SHARE_DELETE = 0x4 |
| 52 } |
| 53 |
| 54 // Flags that control caching and other behavior of the underlying file obje
ct. Used only for |
| 55 // CreateFile. |
| 56 [Flags] |
| 57 public enum FileFlagsAndAttributes : uint { |
| 58 NORMAL = 0x80, |
| 59 OPEN_REPARSE_POINT = 0x200000, |
| 60 SEQUENTIAL_SCAN = 0x8000000, |
| 61 RANDOM_ACCESS = 0x10000000, |
| 62 NO_BUFFERING = 0x20000000, |
| 63 OVERLAPPED = 0x40000000 |
| 64 } |
| 65 |
| 66 // The target architecture of a given executable image. The various values
correspond to the |
| 67 // magic numbers defined by the PE Executable Image File Format. |
| 68 // http://www.microsoft.com/whdc/system/platform/firmware/PECOFF.mspx |
| 69 public enum MachineType : ushort { |
| 70 UNKNOWN = 0x0, |
| 71 X64 = 0x8664, |
| 72 X86 = 0x14c, |
| 73 IA64 = 0x200 |
| 74 } |
| 75 |
| 76 // A flag indicating the format of the path string that Windows returns from
a call to |
| 77 // QueryFullProcessImageName(). |
| 78 public enum ProcessQueryImageNameMode : uint { |
| 79 WIN32_FORMAT = 0, |
| 80 NATIVE_SYSTEM_FORMAT = 1 |
| 81 } |
| 82 |
| 83 // Flags indicating the level of permission requested when opening a handle
to an external |
| 84 // process. Used by OpenProcess(). |
| 85 [Flags] |
| 86 public enum ProcessAccessFlags : uint { |
| 87 NONE = 0x0, |
| 88 ALL = 0x001F0FFF, |
| 89 VM_OPERATION = 0x00000008, |
| 90 VM_READ = 0x00000010, |
| 91 QUERY_INFORMATION = 0x00000400, |
| 92 QUERY_LIMITED_INFORMATION = 0x00001000 |
| 93 } |
| 94 |
| 95 // Defines return value codes used by various Win32 System APIs. |
| 96 public enum NTSTATUS : int { |
| 97 SUCCESS = 0, |
| 98 } |
| 99 |
| 100 // Determines the amount of information requested (and hence the type of str
ucture returned) |
| 101 // by a call to NtQueryInformationProcess. |
| 102 public enum PROCESSINFOCLASS : int { |
| 103 PROCESS_BASIC_INFORMATION = 0 |
| 104 }; |
| 105 #endregion |
| 106 |
| 107 #region Structures |
| 108 // In general, for all structures below which contains a pointer (represente
d here by IntPtr), |
| 109 // the pointers refer to memory in the address space of the process from whi
ch the original |
| 110 // structure was read. While this seems obvious, it means we cannot provide
an elegant |
| 111 // interface to the various fields in the structure due to the de-reference
requiring a |
| 112 // handle to the target process. Instead, that functionality needs to be pr
ovided at a |
| 113 // higher level. |
| 114 // |
| 115 // Additionally, since we usually explicitly define the fields that we're in
terested in along |
| 116 // with their respective offsets, we frequently specify the exact size of th
e native structure. |
| 117 |
| 118 // Win32 UNICODE_STRING structure. |
| 119 [StructLayout(LayoutKind.Sequential)] |
| 120 public struct UNICODE_STRING { |
| 121 // The length in bytes of the string pointed to by buffer, not including t
he null-terminator. |
| 122 private ushort length; |
| 123 // The total allocated size in memory pointed to by buffer. |
| 124 private ushort maximumLength; |
| 125 // A pointer to the buffer containing the string data. |
| 126 private IntPtr buffer; |
| 127 |
| 128 public ushort Length { get { return length; } } |
| 129 public ushort MaximumLength { get { return maximumLength; } } |
| 130 public IntPtr Buffer { get { return buffer; } } |
| 131 } |
| 132 |
| 133 // Win32 RTL_USER_PROCESS_PARAMETERS structure. |
| 134 [StructLayout(LayoutKind.Explicit, Size = 72)] |
| 135 public struct RTL_USER_PROCESS_PARAMETERS { |
| 136 [FieldOffset(56)] |
| 137 private UNICODE_STRING imagePathName; |
| 138 [FieldOffset(64)] |
| 139 private UNICODE_STRING commandLine; |
| 140 |
| 141 public UNICODE_STRING ImagePathName { get { return imagePathName; } } |
| 142 public UNICODE_STRING CommandLine { get { return commandLine; } } |
| 143 }; |
| 144 |
| 145 // Win32 PEB structure. Represents the process environment block of a proce
ss. |
| 146 [StructLayout(LayoutKind.Explicit, Size = 472)] |
| 147 public struct PEB { |
| 148 [FieldOffset(2), MarshalAs(UnmanagedType.U1)] |
| 149 private bool isBeingDebugged; |
| 150 [FieldOffset(12)] |
| 151 private IntPtr ldr; |
| 152 [FieldOffset(16)] |
| 153 private IntPtr processParameters; |
| 154 [FieldOffset(468)] |
| 155 private uint sessionId; |
| 156 |
| 157 public bool IsBeingDebugged { get { return isBeingDebugged; } } |
| 158 public IntPtr Ldr { get { return ldr; } } |
| 159 public IntPtr ProcessParameters { get { return processParameters; } } |
| 160 public uint SessionId { get { return sessionId; } } |
| 161 }; |
| 162 |
| 163 // Win32 PROCESS_BASIC_INFORMATION. Contains a pointer to the PEB, and vari
ous other |
| 164 // information about a process. |
| 165 [StructLayout(LayoutKind.Explicit, Size = 24)] |
| 166 public struct PROCESS_BASIC_INFORMATION { |
| 167 [FieldOffset(4)] |
| 168 private IntPtr pebBaseAddress; |
| 169 [FieldOffset(16)] |
| 170 private UIntPtr uniqueProcessId; |
| 171 |
| 172 public IntPtr PebBaseAddress { get { return pebBaseAddress; } } |
| 173 public UIntPtr UniqueProcessId { get { return uniqueProcessId; } } |
| 174 } |
| 175 #endregion |
| 176 } |
| 177 } |
OLD | NEW |