using System; using System.Runtime.InteropServices; namespace Syringe.Win32 { /// /// Static class containing all Win32 Import functions /// public static class Imports { #region Process /// /// Open process and retrieve handle for manipulation /// /// for external process. /// Indicate whether to inherit a handle. /// Unique process ID of process to open /// Returns a handle to opened process if successful or if unsuccessful. /// Use to get Win32 Error on failure [DllImport("kernel32.dll", EntryPoint = "OpenProcess", SetLastError = true)] public static extern IntPtr OpenProcess( ProcessAccessFlags dwDesiredAccess, [MarshalAs(UnmanagedType.Bool)] bool bInheritHandle, int dwProcessId); /// /// Creates a new process and its primary thread. The new process runs in the security context of the calling process. /// /// The name of the module to be executed. The string can specify the full path and file name of hte module to execute /// or it can specify a partial name. /// The command line to be executed. /// A pointer to a SECURITY_ATTRIBUTES structure that determines whether the returned handle to the new process object can be inherited by child processes. If lpProcessAttributes is , the handle cannot be inherited. /// A pointer to a SECURITY_ATTRIBUTES structure that determines whether the returned handle to the new thread object can be inherited by child processes. If lpThreadAttributes is , the handle cannot be inherited. /// If this parameter is true, each inheritable handle in the calling process is inherited by the new process. If the parameter is FALSE, the handles are not inherited. Note that inherited handles have the same value and access rights as the original handles. /// The flags that control the priority class and the creation of the process. See /// A pointer to the environment block for the new process. If this parameter is , the new process uses the environment of the calling process. /// The full path to the current directory for the process. The string can also specify a UNC path. /// A pointer to a structure. /// A pointer to a structure that receives identification information about the new process. /// If the function succeeds, the return value is true. If the function fails, the return value is false. Call to get the Win32 Error. [DllImport("kernel32.dll", EntryPoint = "CreateProcessW", SetLastError = true)] [return: MarshalAs(UnmanagedType.Bool)] public static extern bool CreateProcess( [MarshalAs(UnmanagedType.LPWStr)] string lpApplicationName, [MarshalAs(UnmanagedType.LPWStr)] string lpCommandLine, IntPtr lpProcessAttributes, IntPtr lpThreadAttributes, bool bInheritHandles, ProcessCreationFlags dwCreationFlags, IntPtr lpEnvironment, [MarshalAs(UnmanagedType.LPWStr)] string lpCurrentDirectory, ref STARTUPINFO lpStartupInfo, out PROCESS_INFORMATION lpProcessInformation); #endregion #region Module /// /// Loads the specified module into the address space of the calling process. The specified module may cause other modules to be loaded. /// /// /// The name of the module. This can be either a library module (.dll) or an executable module (.exe). /// If the string specifies a full path, the function searches only that path for the module. /// Relative paths or files without a path will be searched for using standard strategies. /// /// If the function succeeds, a handle to the module is returned. /// Otherwise, is returned. Call on failure to get Win32 error. [DllImport("kernel32.dll", EntryPoint = "LoadLibraryW", SetLastError = true)] public static extern IntPtr LoadLibrary(string lpFileName); /// /// Loads the specified module into the address space of the calling process. The specified module may cause other modules to be loaded. /// /// The name of the module. This can be either a library module (.dll) or an executable module (.exe). /// If the string specifies a full path, the function searches only that path for the module. /// Relative paths or files without a path will be searched for using standard strategies. /// This parameter is reserved for future use. It must be NULL () /// The action to be taken when loading the module. If no flags are specified, the behaviour is identical to . /// The parameter can be one of the values defined in /// [DllImport("kernel32.dll", EntryPoint = "LoadLibraryExW", SetLastError = true)] public static extern IntPtr LoadLibraryEx( [MarshalAs(UnmanagedType.LPWStr)] string lpFileName, IntPtr hFile, LoadLibraryExFlags dwFlags); /// /// Frees the loaded Dll module. /// /// Handle to the loaded library to free /// True if the function succeeds, otherwise false. Call on failure to get Win32 error. [DllImport("kernel32.dll", SetLastError = true)] [return: MarshalAs(UnmanagedType.Bool)] public static extern bool FreeLibrary(IntPtr hModule); /// /// Retrieve a module handle for the specified module. The module must have been loaded by the calling process. /// /// The name of the loaded module. /// If the function succeeds, a handle to the module is returned. Otherwise, is returned. Call on failure to get last Win32 error [DllImport("kernel32.dll", EntryPoint = "GetModuleHandleW", SetLastError = true)] public static extern IntPtr GetModuleHandle( [MarshalAs(UnmanagedType.LPWStr)] string lpModuleName); /// /// Retrieves the address of an exported function from the specified Dll. /// /// Handle to the Dll module that contains the exported function /// The function name. /// [DllImport("kernel32.dll", SetLastError = true)] public static extern IntPtr GetProcAddress(IntPtr hModule, string procName); #endregion #region Thread /// /// Create a thread that runs in the virtual address space of another process /// /// A handle to the process in which the thread is to be created /// A pointer to a SECURITY_ATTRIBUTES structure that specifies a security descriptor for the new thread and determines whether child processes can inherit the returned handle. /// The initial size of the stack, in bytes. The system rounds this value to the nearest page. If this parameter is 0 (zero), the new thread uses the default size for the executable. /// A pointer to the application-defined function of type LPTHREAD_START_ROUTINE to be executed by the thread and represents the starting address of the thread in the remote process. The function must exist in the remote process. /// A pointer to a variable to be passed to the thread function /// The flags that control the creation of the thread /// A pointer to a variable that receives the thread identifier. If this parameter is , the thread identifier is not returned. /// If the function succeeds, the return value is a handle to the new thread. If the function fails, the return value is . Call to get Win32 Error. [DllImport("kernel32.dll", EntryPoint = "CreateRemoteThread", SetLastError = true)] public static extern IntPtr CreateRemoteThread( IntPtr hProcess, IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, [Out] IntPtr lpThreadId); /// /// Waits until the specified object is in the signaled state or the time-out interval elapses. /// /// A handle to the object. For a list of the object types whose handles can be specified, see the following Remarks section. /// The time-out interval, in milliseconds. The function returns if the interval elapses, even if the object's state is nonsignaled. If dwMilliseconds is zero, the function tests the object's state and returns immediately. If dwMilliseconds is INFINITE, the function's time-out interval never elapses. /// If the function succeeds, the return value indicates the event that caused the function to return. If the function fails, the return value is WAIT_FAILED ((DWORD)0xFFFFFFFF). [DllImport("kernel32", EntryPoint = "WaitForSingleObject")] public static extern uint WaitForSingleObject(IntPtr hObject, uint dwMilliseconds); /// /// Retrieves the termination status of the specified thread. /// /// Handle to the thread /// A pointer to a variable to receive the thread termination status. If this works properly, this should be the return value from the thread function of /// [DllImport("kernel32.dll")] [return: MarshalAs(UnmanagedType.Bool)] public static extern bool GetExitCodeThread(IntPtr hThread, out IntPtr lpExitCode); /// /// Retrieves the termination status of the specified thread. /// /// Handle to the thread /// A pointer to a variable to receive the thread termination status. If this works properly, this should be the return value from the thread function of /// [DllImport("kernel32.dll")] [return: MarshalAs(UnmanagedType.Bool)] public static extern bool GetExitCodeThread(IntPtr hThread, out uint lpExitCode); /// /// Opens an existing thread object. /// /// The access to the thread object /// If this value is TRUE, processes created by this process will inherit the handle. Otherwise, the processes do not inherit this handle. /// The identifier of the thread to be opened. /// If the function succeeds, the return value is an open handle to the specified thread. If the function fails, the return value is NULL. To get extended error information, call . [DllImport("kernel32.dll", SetLastError = true)] public static extern IntPtr OpenThread(ThreadAccessFlags dwDesiredAccess, bool bInheritHandle, uint dwThreadId); /// /// Decrements a thread's suspend count. When the suspend count is decremented to zero, the execution of the thread is resumed. /// /// A handle to the thread to be restarted. /// If the function succeeds, the return value is the thread's previous suspend count. If the function fails, the return value is (DWORD) -1. To get extended error information, call . [DllImport("kernel32.dll", SetLastError = true)] public static extern uint ResumeThread(IntPtr hThread); #endregion #region Handle /// /// Close an open handle /// /// Object handle to close /// True if success, false if failure. Use on failure to get Win32 error. [DllImport("kernel32.dll", EntryPoint = "CloseHandle")] [return: MarshalAs(UnmanagedType.Bool)] public static extern bool CloseHandle(IntPtr hObject); #endregion #region Memory /// /// Reserves or commits a region of memory within the virtual address space of a specified process. /// The function initializes the memory it allocates to zero, unless is used. /// /// The handle to a process. The function allocated memory within the virtual address space of this process. /// The process must have the access right. /// Optional desired address to begin allocation from. Use to let the function determine the address /// The size of the region of memory to allocate, in bytes /// /// type of allocation. Must contain one of , or . /// Can also specify , , . /// /// One of constants. /// If the function succeeds, the return value is the base address of the allocated region of pages. /// If the function fails, the return value is . Call to get Win32 error. [DllImport("kernel32.dll", SetLastError = true, ExactSpelling = true)] public static extern IntPtr VirtualAllocEx( IntPtr hProcess, IntPtr lpAddress, uint dwSize, AllocationType flAllocationType, MemoryProtection flProtect); /// /// Releases, decommits, or releases and decommits a region of memory within the virtual address space of a specified process /// /// A handle to a process. The function frees memory within the virtual address space of this process. /// The handle must have the access right /// A pointer to the starting address of the region of memory to be freed. /// If the parameter is , this address must be the base address /// returned by . /// The size of the region of memory to free, in bytes. /// If the parameter is , this parameter must be 0. The function /// frees the entire region that is reserved in the initial allocation call to /// The type of free operation. This parameter can be one of the following values: /// or /// If the function is successful, it returns true. If the function fails, it returns false. Call to get Win32 error. [DllImport("kernel32.dll", SetLastError = true, ExactSpelling = true)] [return: MarshalAs(UnmanagedType.Bool)] public static extern bool VirtualFreeEx( IntPtr hProcess, IntPtr lpAddress, uint dwSize, AllocationType dwFreeType); /// /// Reads data from an area of memory in the specified process. /// /// Handle to the process from which the memory is being read. /// The handle must have access to the process. /// A pointer to the base address in the specified process to begin reading from /// A pointer to a buffer that receives the contents from the address space of the process /// The number of bytes to be read /// The number of bytes read into the specified buffer /// If the function succeeds, it returns true. Otherwise, false is returned and calling will retrieve the error. [DllImport("kernel32.dll", SetLastError = true)] [return: MarshalAs(UnmanagedType.Bool)] public static extern bool ReadProcessMemory( IntPtr hProcess, IntPtr lpBaseAddress, out byte[] lpBuffer, uint dwSize, out int lpNumberOfBytesRead); /// /// Reads data from an area of memory in the specified process. /// /// Handle to the process from which the memory is being read. /// The handle must have access to the process. /// A pointer to the base address in the specified process to begin reading from /// A pointer to a buffer that receives the contents from the address space of the process /// The number of bytes to be read /// The number of bytes read into the specified buffer /// If the function succeeds, it returns true. Otherwise, false is returned and calling will retrieve the error. [DllImport("kernel32.dll", SetLastError = true)] [return: MarshalAs(UnmanagedType.Bool)] public static extern bool ReadProcessMemory( IntPtr hProcess, IntPtr lpBaseAddress, out IntPtr lpBuffer, uint dwSize, out int lpNumberOfBytesRead); /// /// Writes data to an area of memory in a specified process. /// /// Handle to the process to write memory to. /// The handle must have and access to the process /// A pointer to the base address to write to in the specified process /// A pointer to a buffer that contains the data to be written /// The number of bytes to write /// The number of bytes written. /// If the function succeeds, it returns true. Otherwise false is returned and calling will retrieve the error. [DllImport("kernel32.dll", SetLastError = true)] [return: MarshalAs(UnmanagedType.Bool)] public static extern bool WriteProcessMemory( IntPtr hProcess, IntPtr lpBaseAddress, byte[] lpBuffer, uint nSize, out int lpNumberOfBytesWritten); /// /// Writes data to an area of memory in a specified process. /// /// Handle to the process to write memory to. /// The handle must have and access to the process /// A pointer to the base address to write to in the specified process /// A pointer to a buffer that contains the data to be written /// The number of bytes to write /// The number of bytes written. /// If the function succeeds, it returns true. Otherwise false is returned and calling will retrieve the error. [DllImport("kernel32.dll", SetLastError = true)] [return: MarshalAs(UnmanagedType.Bool)] public static extern bool WriteProcessMemory( IntPtr hProcess, IntPtr lpBaseAddress, IntPtr lpBuffer, uint nSize, out int lpNumberOfBytesWritten); #endregion #region Window #endregion } }