Data Structures
struct	_MEMORY_WORKING_SET_BLOCK

struct	_MEMORY_WORKING_SET_INFORMATION

struct	_MEMORY_REGION_INFORMATION

struct	_MEMORY_WORKING_SET_EX_BLOCK

struct	_MEMORY_WORKING_SET_EX_INFORMATION

struct	_MEMORY_SHARED_COMMIT_INFORMATION

struct	_MEMORY_FRAME_INFORMATION

struct	_FILEOFFSET_INFORMATION

struct	_PAGEDIR_INFORMATION

struct	_MMPFN_IDENTITY

struct	_MMPFN_MEMSNAP_INFORMATION

struct	_SECTION_BASIC_INFORMATION

struct	_SECTION_IMAGE_INFORMATION

struct	_MEMORY_RANGE_ENTRY

Macros
#define	MMPFNLIST_ZERO 0

#define	MMPFNLIST_FREE 1

#define	MMPFNLIST_STANDBY 2

#define	MMPFNLIST_MODIFIED 3

#define	MMPFNLIST_MODIFIEDNOWRITE 4

#define	MMPFNLIST_BAD 5

#define	MMPFNLIST_ACTIVE 6

#define	MMPFNLIST_TRANSITION 7

#define	MMPFNUSE_PROCESSPRIVATE 0

#define	MMPFNUSE_FILE 1

#define	MMPFNUSE_PAGEFILEMAPPED 2

#define	MMPFNUSE_PAGETABLE 3

#define	MMPFNUSE_PAGEDPOOL 4

#define	MMPFNUSE_NONPAGEDPOOL 5

#define	MMPFNUSE_SYSTEMPTE 6

#define	MMPFNUSE_SESSIONPRIVATE 7

#define	MMPFNUSE_METAFILE 8

#define	MMPFNUSE_AWEPAGE 9

#define	MMPFNUSE_DRIVERLOCKPAGE 10

#define	SEC_BASED 0x200000

#define	SEC_NO_CHANGE 0x400000

#define	SEC_GLOBAL 0x20000000

#define	MEM_EXECUTE_OPTION_DISABLE 0x1

#define	MEM_EXECUTE_OPTION_ENABLE 0x2

#define	MEM_EXECUTE_OPTION_DISABLE_THUNK_EMULATION 0x4

#define	MEM_EXECUTE_OPTION_PERMANENT 0x8

#define	MEM_EXECUTE_OPTION_EXECUTE_DISPATCH_ENABLE 0x10

#define	MEM_EXECUTE_OPTION_IMAGE_DISPATCH_ENABLE 0x20

#define	MEM_EXECUTE_OPTION_VALID_FLAGS 0x3f

Typedefs
typedef enum _MEMORY_INFORMATION_CLASS	MEMORY_INFORMATION_CLASS

typedef struct _MEMORY_WORKING_SET_BLOCK	MEMORY_WORKING_SET_BLOCK

typedef struct _MEMORY_WORKING_SET_BLOCK *	PMEMORY_WORKING_SET_BLOCK

typedef struct _MEMORY_WORKING_SET_INFORMATION	MEMORY_WORKING_SET_INFORMATION

typedef struct _MEMORY_WORKING_SET_INFORMATION *	PMEMORY_WORKING_SET_INFORMATION

typedef struct _MEMORY_REGION_INFORMATION	MEMORY_REGION_INFORMATION

typedef struct _MEMORY_REGION_INFORMATION *	PMEMORY_REGION_INFORMATION

typedef struct _MEMORY_WORKING_SET_EX_BLOCK	MEMORY_WORKING_SET_EX_BLOCK

typedef struct _MEMORY_WORKING_SET_EX_BLOCK *	PMEMORY_WORKING_SET_EX_BLOCK

typedef struct _MEMORY_WORKING_SET_EX_INFORMATION	MEMORY_WORKING_SET_EX_INFORMATION

typedef struct _MEMORY_WORKING_SET_EX_INFORMATION *	PMEMORY_WORKING_SET_EX_INFORMATION

typedef struct _MEMORY_SHARED_COMMIT_INFORMATION	MEMORY_SHARED_COMMIT_INFORMATION

typedef struct _MEMORY_SHARED_COMMIT_INFORMATION *	PMEMORY_SHARED_COMMIT_INFORMATION

typedef struct _MEMORY_FRAME_INFORMATION	MEMORY_FRAME_INFORMATION

typedef struct _FILEOFFSET_INFORMATION	FILEOFFSET_INFORMATION

typedef struct _PAGEDIR_INFORMATION	PAGEDIR_INFORMATION

typedef struct _MMPFN_IDENTITY	MMPFN_IDENTITY

typedef struct _MMPFN_IDENTITY *	PMMPFN_IDENTITY

typedef struct _MMPFN_MEMSNAP_INFORMATION	MMPFN_MEMSNAP_INFORMATION

typedef struct _MMPFN_MEMSNAP_INFORMATION *	PMMPFN_MEMSNAP_INFORMATION

typedef enum _SECTION_INFORMATION_CLASS	SECTION_INFORMATION_CLASS

typedef struct _SECTION_BASIC_INFORMATION	SECTION_BASIC_INFORMATION

typedef struct _SECTION_BASIC_INFORMATION *	PSECTION_BASIC_INFORMATION

typedef struct _SECTION_IMAGE_INFORMATION	SECTION_IMAGE_INFORMATION

typedef struct _SECTION_IMAGE_INFORMATION *	PSECTION_IMAGE_INFORMATION

typedef enum _SECTION_INHERIT	SECTION_INHERIT

typedef enum _VIRTUAL_MEMORY_INFORMATION_CLASS	VIRTUAL_MEMORY_INFORMATION_CLASS

typedef struct _MEMORY_RANGE_ENTRY	MEMORY_RANGE_ENTRY

typedef struct _MEMORY_RANGE_ENTRY *	PMEMORY_RANGE_ENTRY

typedef enum _MEMORY_PARTITION_INFORMATION_CLASS	MEMORY_PARTITION_INFORMATION_CLASS

Functions
NTSYSCALLAPI NTSTATUS NTAPI	NtAllocateVirtualMemory (_In_ HANDLE ProcessHandle, _Inout_ _At_(BaseAddress, _Readable_bytes_(RegionSize) _Writable_bytes_(RegionSize) _Post_readable_byte_size_(RegionSize)) PVOID *BaseAddress, _In_ ULONG_PTR ZeroBits, _Inout_ PSIZE_T RegionSize, _In_ ULONG AllocationType, _In_ ULONG Protect)

NTSYSCALLAPI NTSTATUS NTAPI	NtFreeVirtualMemory (_In_ HANDLE ProcessHandle, _Inout_ PVOID *BaseAddress, _Inout_ PSIZE_T RegionSize, _In_ ULONG FreeType)

NTSYSCALLAPI NTSTATUS NTAPI	NtReadVirtualMemory (_In_ HANDLE ProcessHandle, _In_opt_ PVOID BaseAddress, _Out_writes_bytes_(BufferSize) PVOID Buffer, _In_ SIZE_T BufferSize, _Out_opt_ PSIZE_T NumberOfBytesRead)

NTSYSCALLAPI NTSTATUS NTAPI	NtWriteVirtualMemory (_In_ HANDLE ProcessHandle, _In_opt_ PVOID BaseAddress, _In_reads_bytes_(BufferSize) PVOID Buffer, _In_ SIZE_T BufferSize, _Out_opt_ PSIZE_T NumberOfBytesWritten)

NTSYSCALLAPI NTSTATUS NTAPI	NtProtectVirtualMemory (_In_ HANDLE ProcessHandle, _Inout_ PVOID *BaseAddress, _Inout_ PSIZE_T RegionSize, _In_ ULONG NewProtect, _Out_ PULONG OldProtect)

NTSYSCALLAPI NTSTATUS NTAPI	NtQueryVirtualMemory (_In_ HANDLE ProcessHandle, _In_ PVOID BaseAddress, _In_ MEMORY_INFORMATION_CLASS MemoryInformationClass, _Out_writes_bytes_(MemoryInformationLength) PVOID MemoryInformation, _In_ SIZE_T MemoryInformationLength, _Out_opt_ PSIZE_T ReturnLength)

NTSYSCALLAPI NTSTATUS NTAPI	NtSetInformationVirtualMemory (_In_ HANDLE ProcessHandle, _In_ VIRTUAL_MEMORY_INFORMATION_CLASS VmInformationClass, _In_ ULONG_PTR NumberOfEntries, _In_reads_(NumberOfEntries) PMEMORY_RANGE_ENTRY VirtualAddresses, _In_reads_bytes_(VmInformationLength) PVOID VmInformation, _In_ ULONG VmInformationLength)

NTSYSCALLAPI NTSTATUS NTAPI	NtLockVirtualMemory (_In_ HANDLE ProcessHandle, _Inout_ PVOID *BaseAddress, _Inout_ PSIZE_T RegionSize, _In_ ULONG MapType)

NTSYSCALLAPI NTSTATUS NTAPI	NtUnlockVirtualMemory (_In_ HANDLE ProcessHandle, _Inout_ PVOID *BaseAddress, _Inout_ PSIZE_T RegionSize, _In_ ULONG MapType)

NTSYSCALLAPI NTSTATUS NTAPI	NtCreateSection (_Out_ PHANDLE SectionHandle, _In_ ACCESS_MASK DesiredAccess, _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes, _In_opt_ PLARGE_INTEGER MaximumSize, _In_ ULONG SectionPageProtection, _In_ ULONG AllocationAttributes, _In_opt_ HANDLE FileHandle)

NTSYSCALLAPI NTSTATUS NTAPI	NtOpenSection (_Out_ PHANDLE SectionHandle, _In_ ACCESS_MASK DesiredAccess, _In_ POBJECT_ATTRIBUTES ObjectAttributes)

NTSYSCALLAPI NTSTATUS NTAPI	NtMapViewOfSection (_In_ HANDLE SectionHandle, _In_ HANDLE ProcessHandle, _Inout_ _At_(BaseAddress, _Readable_bytes_(ViewSize) _Writable_bytes_(ViewSize) _Post_readable_byte_size_(ViewSize)) PVOID *BaseAddress, _In_ ULONG_PTR ZeroBits, _In_ SIZE_T CommitSize, _Inout_opt_ PLARGE_INTEGER SectionOffset, _Inout_ PSIZE_T ViewSize, _In_ SECTION_INHERIT InheritDisposition, _In_ ULONG AllocationType, _In_ ULONG Win32Protect)

NTSYSCALLAPI NTSTATUS NTAPI	NtUnmapViewOfSection (_In_ HANDLE ProcessHandle, _In_opt_ PVOID BaseAddress)

NTSYSCALLAPI NTSTATUS NTAPI	NtUnmapViewOfSectionEx (_In_ HANDLE ProcessHandle, _In_opt_ PVOID BaseAddress, _In_ ULONG Flags)

NTSYSCALLAPI NTSTATUS NTAPI	NtExtendSection (_In_ HANDLE SectionHandle, _Inout_ PLARGE_INTEGER NewSectionSize)

NTSYSCALLAPI NTSTATUS NTAPI	NtQuerySection (_In_ HANDLE SectionHandle, _In_ SECTION_INFORMATION_CLASS SectionInformationClass, _Out_writes_bytes_(SectionInformationLength) PVOID SectionInformation, _In_ SIZE_T SectionInformationLength, _Out_opt_ PSIZE_T ReturnLength)

NTSYSCALLAPI NTSTATUS NTAPI	NtAreMappedFilesTheSame (_In_ PVOID File1MappedAsAnImage, _In_ PVOID File2MappedAsFile)

NTSYSCALLAPI NTSTATUS NTAPI	NtCreatePartition (_Out_ PHANDLE PartitionHandle, _In_ ACCESS_MASK DesiredAccess, _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes, _In_ ULONG PreferredNode)

NTSYSCALLAPI NTSTATUS NTAPI	NtOpenPartition (_Out_ PHANDLE PartitionHandle, _In_ ACCESS_MASK DesiredAccess, _In_ POBJECT_ATTRIBUTES ObjectAttributes)

NTSYSCALLAPI NTSTATUS NTAPI	NtManagePartition (_In_ MEMORY_PARTITION_INFORMATION_CLASS PartitionInformationClass, _In_ PVOID PartitionInformation, _In_ ULONG PartitionInformationLength)

NTSYSCALLAPI NTSTATUS NTAPI	NtMapUserPhysicalPages (_In_ PVOID VirtualAddress, _In_ ULONG_PTR NumberOfPages, _In_reads_opt_(NumberOfPages) PULONG_PTR UserPfnArray)

NTSYSCALLAPI NTSTATUS NTAPI	NtMapUserPhysicalPagesScatter (_In_reads_(NumberOfPages) PVOID *VirtualAddresses, _In_ ULONG_PTR NumberOfPages, _In_reads_opt_(NumberOfPages) PULONG_PTR UserPfnArray)

NTSYSCALLAPI NTSTATUS NTAPI	NtAllocateUserPhysicalPages (_In_ HANDLE ProcessHandle, _Inout_ PULONG_PTR NumberOfPages, _Out_writes_(*NumberOfPages) PULONG_PTR UserPfnArray)

NTSYSCALLAPI NTSTATUS NTAPI	NtFreeUserPhysicalPages (_In_ HANDLE ProcessHandle, _Inout_ PULONG_PTR NumberOfPages, _In_reads_(*NumberOfPages) PULONG_PTR UserPfnArray)

NTSYSCALLAPI NTSTATUS NTAPI	NtOpenSession (_Out_ PHANDLE SessionHandle, _In_ ACCESS_MASK DesiredAccess, _In_ POBJECT_ATTRIBUTES ObjectAttributes)

NTSYSCALLAPI NTSTATUS NTAPI	NtGetWriteWatch (_In_ HANDLE ProcessHandle, _In_ ULONG Flags, _In_ PVOID BaseAddress, _In_ SIZE_T RegionSize, _Out_writes_(EntriesInUserAddressArray) PVOID UserAddressArray, _Inout_ PULONG_PTR EntriesInUserAddressArray, _Out_ PULONG Granularity)

NTSYSCALLAPI NTSTATUS NTAPI	NtResetWriteWatch (_In_ HANDLE ProcessHandle, _In_ PVOID BaseAddress, _In_ SIZE_T RegionSize)

NTSYSCALLAPI NTSTATUS NTAPI	NtCreatePagingFile (_In_ PUNICODE_STRING PageFileName, _In_ PLARGE_INTEGER MinimumSize, _In_ PLARGE_INTEGER MaximumSize, _In_ ULONG Priority)

NTSYSCALLAPI NTSTATUS NTAPI	NtFlushInstructionCache (_In_ HANDLE ProcessHandle, _In_opt_ PVOID BaseAddress, _In_ SIZE_T Length)

NTSYSCALLAPI NTSTATUS NTAPI	NtFlushWriteBuffer (VOID)

Macro Definition Documentation

#define MEM_EXECUTE_OPTION_DISABLE 0x1

Definition at line 235 of file ntmmapi.h.

#define MEM_EXECUTE_OPTION_DISABLE_THUNK_EMULATION 0x4

Definition at line 237 of file ntmmapi.h.

#define MEM_EXECUTE_OPTION_ENABLE 0x2

Definition at line 236 of file ntmmapi.h.

#define MEM_EXECUTE_OPTION_EXECUTE_DISPATCH_ENABLE 0x10

Definition at line 239 of file ntmmapi.h.

#define MEM_EXECUTE_OPTION_IMAGE_DISPATCH_ENABLE 0x20

Definition at line 240 of file ntmmapi.h.

#define MEM_EXECUTE_OPTION_PERMANENT 0x8

Definition at line 238 of file ntmmapi.h.

#define MEM_EXECUTE_OPTION_VALID_FLAGS 0x3f

Definition at line 241 of file ntmmapi.h.

#define MMPFNLIST_ACTIVE 6

Definition at line 108 of file ntmmapi.h.

#define MMPFNLIST_BAD 5

Definition at line 107 of file ntmmapi.h.

#define MMPFNLIST_FREE 1

Definition at line 103 of file ntmmapi.h.

#define MMPFNLIST_MODIFIED 3

Definition at line 105 of file ntmmapi.h.

#define MMPFNLIST_MODIFIEDNOWRITE 4

Definition at line 106 of file ntmmapi.h.

#define MMPFNLIST_STANDBY 2

Definition at line 104 of file ntmmapi.h.

#define MMPFNLIST_TRANSITION 7

Definition at line 109 of file ntmmapi.h.

#define MMPFNLIST_ZERO 0

Definition at line 102 of file ntmmapi.h.

#define MMPFNUSE_AWEPAGE 9

Definition at line 120 of file ntmmapi.h.

#define MMPFNUSE_DRIVERLOCKPAGE 10

Definition at line 121 of file ntmmapi.h.

#define MMPFNUSE_FILE 1

Definition at line 112 of file ntmmapi.h.

#define MMPFNUSE_METAFILE 8

Definition at line 119 of file ntmmapi.h.

#define MMPFNUSE_NONPAGEDPOOL 5

Definition at line 116 of file ntmmapi.h.

#define MMPFNUSE_PAGEDPOOL 4

Definition at line 115 of file ntmmapi.h.

#define MMPFNUSE_PAGEFILEMAPPED 2

Definition at line 113 of file ntmmapi.h.

#define MMPFNUSE_PAGETABLE 3

Definition at line 114 of file ntmmapi.h.

#define MMPFNUSE_PROCESSPRIVATE 0

Definition at line 111 of file ntmmapi.h.

#define MMPFNUSE_SESSIONPRIVATE 7

Definition at line 118 of file ntmmapi.h.

#define MMPFNUSE_SYSTEMPTE 6

Definition at line 117 of file ntmmapi.h.

#define SEC_BASED 0x200000

Definition at line 231 of file ntmmapi.h.

#define SEC_GLOBAL 0x20000000

Definition at line 233 of file ntmmapi.h.

#define SEC_NO_CHANGE 0x400000

Definition at line 232 of file ntmmapi.h.

Typedef Documentation

typedef struct _FILEOFFSET_INFORMATION FILEOFFSET_INFORMATION

typedef struct _MEMORY_FRAME_INFORMATION MEMORY_FRAME_INFORMATION

typedef enum _MEMORY_INFORMATION_CLASS MEMORY_INFORMATION_CLASS

typedef enum _MEMORY_PARTITION_INFORMATION_CLASS MEMORY_PARTITION_INFORMATION_CLASS

typedef struct _MEMORY_RANGE_ENTRY MEMORY_RANGE_ENTRY

typedef struct _MEMORY_REGION_INFORMATION MEMORY_REGION_INFORMATION

typedef struct _MEMORY_SHARED_COMMIT_INFORMATION MEMORY_SHARED_COMMIT_INFORMATION

typedef struct _MEMORY_WORKING_SET_BLOCK MEMORY_WORKING_SET_BLOCK

typedef struct _MEMORY_WORKING_SET_EX_BLOCK MEMORY_WORKING_SET_EX_BLOCK

typedef struct _MEMORY_WORKING_SET_EX_INFORMATION MEMORY_WORKING_SET_EX_INFORMATION

typedef struct _MEMORY_WORKING_SET_INFORMATION MEMORY_WORKING_SET_INFORMATION

typedef struct _MMPFN_IDENTITY MMPFN_IDENTITY

typedef struct _MMPFN_MEMSNAP_INFORMATION MMPFN_MEMSNAP_INFORMATION

typedef struct _PAGEDIR_INFORMATION PAGEDIR_INFORMATION

typedef struct _MEMORY_RANGE_ENTRY * PMEMORY_RANGE_ENTRY

typedef struct _MEMORY_REGION_INFORMATION * PMEMORY_REGION_INFORMATION

typedef struct _MEMORY_SHARED_COMMIT_INFORMATION * PMEMORY_SHARED_COMMIT_INFORMATION

typedef struct _MEMORY_WORKING_SET_BLOCK * PMEMORY_WORKING_SET_BLOCK

typedef struct _MEMORY_WORKING_SET_EX_BLOCK * PMEMORY_WORKING_SET_EX_BLOCK

typedef struct _MEMORY_WORKING_SET_EX_INFORMATION * PMEMORY_WORKING_SET_EX_INFORMATION

typedef struct _MEMORY_WORKING_SET_INFORMATION * PMEMORY_WORKING_SET_INFORMATION

typedef struct _MMPFN_IDENTITY * PMMPFN_IDENTITY

typedef struct _MMPFN_MEMSNAP_INFORMATION * PMMPFN_MEMSNAP_INFORMATION

typedef struct _SECTION_BASIC_INFORMATION * PSECTION_BASIC_INFORMATION

typedef struct _SECTION_IMAGE_INFORMATION * PSECTION_IMAGE_INFORMATION

typedef struct _SECTION_BASIC_INFORMATION SECTION_BASIC_INFORMATION

typedef struct _SECTION_IMAGE_INFORMATION SECTION_IMAGE_INFORMATION

typedef enum _SECTION_INFORMATION_CLASS SECTION_INFORMATION_CLASS

typedef enum _SECTION_INHERIT SECTION_INHERIT

typedef enum _VIRTUAL_MEMORY_INFORMATION_CLASS VIRTUAL_MEMORY_INFORMATION_CLASS

Enumeration Type Documentation

enum _MEMORY_INFORMATION_CLASS

Enumerator:

MemoryBasicInformation
MemoryWorkingSetInformation
MemoryMappedFilenameInformation
MemoryRegionInformation
MemoryWorkingSetExInformation
MemorySharedCommitInformation

Definition at line 5 of file ntmmapi.h.

enum _MEMORY_PARTITION_INFORMATION_CLASS

Enumerator:

SystemMemoryPartitionInformation
SystemMemoryPartitionMoveMemory
SystemMemoryPartitionAddPagefile
SystemMemoryPartitionCombineMemory

Definition at line 454 of file ntmmapi.h.

enum _SECTION_INFORMATION_CLASS

Enumerator:

SectionBasicInformation
SectionImageInformation
SectionRelocationInformation
MaxSectionInfoClass

Definition at line 170 of file ntmmapi.h.

enum _SECTION_INHERIT

Enumerator:

ViewShare
ViewUnmap

Definition at line 225 of file ntmmapi.h.

enum _VIRTUAL_MEMORY_INFORMATION_CLASS

Enumerator:

VmPrefetchInformation
VmPagePriorityInformation
VmCfgCallTargetInformation

Definition at line 314 of file ntmmapi.h.

Function Documentation

NTSYSCALLAPI NTSTATUS NTAPI NtAllocateUserPhysicalPages	(	_In_ HANDLE	ProcessHandle,
		_Inout_ PULONG_PTR	NumberOfPages,
		_Out_writes_ *NumberOfPages PULONG_PTR	UserPfnArray
	)

NTSYSCALLAPI NTSTATUS NTAPI NtAllocateVirtualMemory	(	_In_ HANDLE	ProcessHandle,
		_Inout_ _At_(,RegionSize _Writable_bytes_ RegionSize _Post_readable_byte_size_	RegionSize
	)

NTSYSCALLAPI NTSTATUS NTAPI NtAreMappedFilesTheSame	(	_In_ PVOID	File1MappedAsAnImage,
		_In_ PVOID	File2MappedAsFile
	)

NTSYSCALLAPI NTSTATUS NTAPI NtCreatePagingFile	(	_In_ PUNICODE_STRING	PageFileName,
		_In_ PLARGE_INTEGER	MinimumSize,
		_In_ PLARGE_INTEGER	MaximumSize,
		_In_ ULONG	Priority
	)

NTSYSCALLAPI NTSTATUS NTAPI NtCreatePartition	(	_Out_ PHANDLE	PartitionHandle,
		_In_ ACCESS_MASK	DesiredAccess,
		_In_opt_ POBJECT_ATTRIBUTES	ObjectAttributes,
		_In_ ULONG	PreferredNode
	)

NTSYSCALLAPI NTSTATUS NTAPI NtCreateSection	(	_Out_ PHANDLE	SectionHandle,
		_In_ ACCESS_MASK	DesiredAccess,
		_In_opt_ POBJECT_ATTRIBUTES	ObjectAttributes,
		_In_opt_ PLARGE_INTEGER	MaximumSize,
		_In_ ULONG	SectionPageProtection,
		_In_ ULONG	AllocationAttributes,
		_In_opt_ HANDLE	FileHandle
	)

NTSYSCALLAPI NTSTATUS NTAPI NtExtendSection	(	_In_ HANDLE	SectionHandle,
		_Inout_ PLARGE_INTEGER	NewSectionSize
	)

NTSYSCALLAPI NTSTATUS NTAPI NtFlushInstructionCache	(	_In_ HANDLE	ProcessHandle,
		_In_opt_ PVOID	BaseAddress,
		_In_ SIZE_T	Length
	)

NTSYSCALLAPI NTSTATUS NTAPI NtFlushWriteBuffer ( VOID )

NTSYSCALLAPI NTSTATUS NTAPI NtFreeUserPhysicalPages	(	_In_ HANDLE	ProcessHandle,
		_Inout_ PULONG_PTR	NumberOfPages,
		_In_reads_ *NumberOfPages PULONG_PTR	UserPfnArray
	)

NTSYSCALLAPI NTSTATUS NTAPI NtFreeVirtualMemory	(	_In_ HANDLE	ProcessHandle,
		_Inout_ PVOID *	BaseAddress,
		_Inout_ PSIZE_T	RegionSize,
		_In_ ULONG	FreeType
	)

NTSYSCALLAPI NTSTATUS NTAPI NtGetWriteWatch	(	_In_ HANDLE	ProcessHandle,
		_In_ ULONG	Flags,
		_In_ PVOID	BaseAddress,
		_In_ SIZE_T	RegionSize,
		_Out_writes_ EntriesInUserAddressArray PVOID	UserAddressArray,
		_Inout_ PULONG_PTR	EntriesInUserAddressArray,
		_Out_ PULONG	Granularity
	)

NTSYSCALLAPI NTSTATUS NTAPI NtLockVirtualMemory	(	_In_ HANDLE	ProcessHandle,
		_Inout_ PVOID *	BaseAddress,
		_Inout_ PSIZE_T	RegionSize,
		_In_ ULONG	MapType
	)

NTSYSCALLAPI NTSTATUS NTAPI NtManagePartition	(	_In_ MEMORY_PARTITION_INFORMATION_CLASS	PartitionInformationClass,
		_In_ PVOID	PartitionInformation,
		_In_ ULONG	PartitionInformationLength
	)

NTSYSCALLAPI NTSTATUS NTAPI NtMapUserPhysicalPages	(	_In_ PVOID	VirtualAddress,
		_In_ ULONG_PTR	NumberOfPages,
		_In_reads_opt_(NumberOfPages) PULONG_PTR	UserPfnArray
	)

NTSYSCALLAPI NTSTATUS NTAPI NtMapUserPhysicalPagesScatter	(	_In_reads_(NumberOfPages) PVOID *	VirtualAddresses,
		_In_ ULONG_PTR	NumberOfPages,
		_In_reads_opt_(NumberOfPages) PULONG_PTR	UserPfnArray
	)

NTSYSCALLAPI NTSTATUS NTAPI NtMapViewOfSection	(	_In_ HANDLE	SectionHandle,
		_In_ HANDLE	ProcessHandle,
		_Inout_ _At_(,ViewSize _Writable_bytes_ ViewSize _Post_readable_byte_size_	ViewSize
	)

NTSYSCALLAPI NTSTATUS NTAPI NtOpenPartition	(	_Out_ PHANDLE	PartitionHandle,
		_In_ ACCESS_MASK	DesiredAccess,
		_In_ POBJECT_ATTRIBUTES	ObjectAttributes
	)

NTSYSCALLAPI NTSTATUS NTAPI NtOpenSection	(	_Out_ PHANDLE	SectionHandle,
		_In_ ACCESS_MASK	DesiredAccess,
		_In_ POBJECT_ATTRIBUTES	ObjectAttributes
	)

NTSYSCALLAPI NTSTATUS NTAPI NtOpenSession	(	_Out_ PHANDLE	SessionHandle,
		_In_ ACCESS_MASK	DesiredAccess,
		_In_ POBJECT_ATTRIBUTES	ObjectAttributes
	)

NTSYSCALLAPI NTSTATUS NTAPI NtProtectVirtualMemory	(	_In_ HANDLE	ProcessHandle,
		_Inout_ PVOID *	BaseAddress,
		_Inout_ PSIZE_T	RegionSize,
		_In_ ULONG	NewProtect,
		_Out_ PULONG	OldProtect
	)

NTSYSCALLAPI NTSTATUS NTAPI NtQuerySection	(	_In_ HANDLE	SectionHandle,
		_In_ SECTION_INFORMATION_CLASS	SectionInformationClass,
		_Out_writes_bytes_(SectionInformationLength) PVOID	SectionInformation,
		_In_ SIZE_T	SectionInformationLength,
		_Out_opt_ PSIZE_T	ReturnLength
	)

NTSYSCALLAPI NTSTATUS NTAPI NtQueryVirtualMemory	(	_In_ HANDLE	ProcessHandle,
		_In_ PVOID	BaseAddress,
		_In_ MEMORY_INFORMATION_CLASS	MemoryInformationClass,
		_Out_writes_bytes_(MemoryInformationLength) PVOID	MemoryInformation,
		_In_ SIZE_T	MemoryInformationLength,
		_Out_opt_ PSIZE_T	ReturnLength
	)

NTSYSCALLAPI NTSTATUS NTAPI NtReadVirtualMemory	(	_In_ HANDLE	ProcessHandle,
		_In_opt_ PVOID	BaseAddress,
		_Out_writes_bytes_(BufferSize) PVOID	Buffer,
		_In_ SIZE_T	BufferSize,
		_Out_opt_ PSIZE_T	NumberOfBytesRead
	)

NTSYSCALLAPI NTSTATUS NTAPI NtResetWriteWatch	(	_In_ HANDLE	ProcessHandle,
		_In_ PVOID	BaseAddress,
		_In_ SIZE_T	RegionSize
	)

NTSYSCALLAPI NTSTATUS NTAPI NtSetInformationVirtualMemory	(	_In_ HANDLE	ProcessHandle,
		_In_ VIRTUAL_MEMORY_INFORMATION_CLASS	VmInformationClass,
		_In_ ULONG_PTR	NumberOfEntries,
		_In_reads_(NumberOfEntries) PMEMORY_RANGE_ENTRY	VirtualAddresses,
		_In_reads_bytes_(VmInformationLength) PVOID	VmInformation,
		_In_ ULONG	VmInformationLength
	)

NTSYSCALLAPI NTSTATUS NTAPI NtUnlockVirtualMemory	(	_In_ HANDLE	ProcessHandle,
		_Inout_ PVOID *	BaseAddress,
		_Inout_ PSIZE_T	RegionSize,
		_In_ ULONG	MapType
	)

NTSYSCALLAPI NTSTATUS NTAPI NtUnmapViewOfSection	(	_In_ HANDLE	ProcessHandle,
		_In_opt_ PVOID	BaseAddress
	)

NTSYSCALLAPI NTSTATUS NTAPI NtUnmapViewOfSectionEx	(	_In_ HANDLE	ProcessHandle,
		_In_opt_ PVOID	BaseAddress,
		_In_ ULONG	Flags
	)

NTSYSCALLAPI NTSTATUS NTAPI NtWriteVirtualMemory	(	_In_ HANDLE	ProcessHandle,
		_In_opt_ PVOID	BaseAddress,
		_In_reads_bytes_(BufferSize) PVOID	Buffer,
		_In_ SIZE_T	BufferSize,
		_Out_opt_ PSIZE_T	NumberOfBytesWritten
	)

Enumerations
enum	_MEMORY_INFORMATION_CLASS { MemoryBasicInformation, MemoryWorkingSetInformation, MemoryMappedFilenameInformation, MemoryRegionInformation, MemoryWorkingSetExInformation, MemorySharedCommitInformation }

enum	_SECTION_INFORMATION_CLASS { SectionBasicInformation, SectionImageInformation, SectionRelocationInformation, MaxSectionInfoClass }

enum	_SECTION_INHERIT { ViewShare = 1, ViewUnmap = 2 }

enum	_VIRTUAL_MEMORY_INFORMATION_CLASS { VmPrefetchInformation, VmPagePriorityInformation, VmCfgCallTargetInformation }

enum	_MEMORY_PARTITION_INFORMATION_CLASS { SystemMemoryPartitionInformation, SystemMemoryPartitionMoveMemory, SystemMemoryPartitionAddPagefile, SystemMemoryPartitionCombineMemory }

Data Structures

Macros

Typedefs

Enumerations

Functions

Macro Definition Documentation

Typedef Documentation

Enumeration Type Documentation

Function Documentation