Imports System.Diagnostics.CodeAnalysis
Imports System.Runtime.ConstrainedExecution
Imports System.Runtime.InteropServices
Imports System.Security
Imports System.Text
Imports System.Threading
Imports Microsoft.Win32.SafeHandles
<Flags>
Friend Enum LoadLibraryFlags As UInteger
DontResolveDllReferences = &H1
IgnoreCodeAuthzLevel = &H10
LoadLibraryAsDataFile = &H2
LoadLibraryAsDataFileExclusive = &H40
LoadLibraryAsImageResource = &H20
LoadLibrarySearchApplicationDir = &H200
LoadLibrarySearchDefaultDirs = &H1000
LoadLibrarySearchDllLoadDir = &H100
LoadLibrarySearchSystem32 = &H800
LoadLibrarySearchUserDirs = &H400
LoadWithAlteredSearchPath = &H8
End Enum
<Flags>
Friend Enum MemoryAllocationType As UInteger
Commit = &H1000
Reserve = &H2000
Reset = &H80000
ResetUndo = &H1000000
Physical = &H400000
TopDown = &H100000
LargePages = &H20000000
End Enum
<Flags>
Friend Enum MemoryProtectionOptions As UInteger
Execute = &H10
ExecuteRead = &H20
ExecuteReadWrite = &H40
ExecuteWriteCopy = &H80
NoAccess = &H1
[ReadOnly] = &H2
ReadWrite = &H4
WriteCopy = &H8
Guard = &H100
NoCache = &H200
WriteCombine = &H400
End Enum
<Flags>
Friend Enum ProcessAccessRights As Integer
AllAccess = (ProcessAccessRights.StandardRightsRequired Or ProcessAccessRights.Synchronize Or &HFFFF)
CreateThread = &H2
SetSessionId = &H4
VirtualMemoryOperation = &H8
VirtualMemoryRead = &H10
VirtualMemoryWrite = &H20
DuplicateHandle = &H40
CreateProcess = &H80
SetQuota = &H100
SetInformation = &H200
QueryInformation = &H400
SuspendResume = &H800
QueryLimitedInformation = &H1000
Synchronize = StandardAccessRights.Synchronize
Delete = StandardAccessRights.Delete
ReadControl = StandardAccessRights.ReadControl
WriteDac = StandardAccessRights.WriteDac
WriteOwner = StandardAccessRights.WriteOwner
StandardRightsRequired = StandardAccessRights.StandardRightsRequired
End Enum
<Flags>
Friend Enum StandardAccessRights As Integer
Delete = &H10000
ReadControl = &H20000
WriteDac = &H40000
WriteOwner = &H80000
Synchronize = &H100000
StandardRightsRequired = &HF0000
StandardRightsRead = StandardAccessRights.ReadControl
StandardRightsWrite = StandardAccessRights.ReadControl
StandardRightsExecute = StandardAccessRights.ReadControl
StandardRightsAll = &H1F0000
End Enum
<Flags>
Friend Enum ThreadCreationFlags As UInteger
CreateSuspended = &H4
StackSizeParamIsAReservation = &H10000
End Enum
''' <summary>
''' Represents a handle to a module returned by <see cref="NativeMethods.LoadLibrary"/>
''' or <see cref="NativeMethods.LoadLibraryEx"/> functions.
''' </summary>
Public NotInheritable Class SafeModuleHandle : Inherits SafeHandleZeroOrMinusOneIsInvalid
<SuppressMessage("Microsoft.Security", "CA2122:DoNotIndirectlyExposeMethodsWithLinkDemands")>
Public Sub New()
MyBase.New(ownsHandle:=True)
End Sub
<ReliabilityContract(Consistency.WillNotCorruptState, Cer.Success)>
Protected Overrides Function ReleaseHandle() As Boolean
Return NativeMethods.FreeLibrary(Me)
End Function
End Class
<DebuggerStepThrough>
<StructLayout(LayoutKind.Sequential)>
Friend Structure SecurityAttributes
Friend Length As Integer
Friend SecurityDescriptor As IntPtr
Friend InheritHandle As Integer
End Structure
<SuppressUnmanagedCodeSecurity>
Friend NotInheritable Class NativeMethods
Private Sub New()
End Sub
<DllImport("Kernel32.dll", SetLastError:=True)>
Friend Shared Function CloseHandle(ByVal hObject As IntPtr
) As <MarshalAs(UnmanagedType.Bool)> Boolean
End Function
<DllImport("kernel32.dll", SetLastError:=True)>
Friend Shared Function CreateRemoteThread(ByVal hProcess As IntPtr,
ByVal threadAttributes As IntPtr,
ByVal stackSize As IntPtr,
ByVal startAddress As IntPtr,
ByVal threadParameter As IntPtr,
<MarshalAs(UnmanagedType.U4)> ByVal creationFlags As ThreadCreationFlags,
ByRef refThreadId As UInteger
) As IntPtr
End Function
<DllImport("kernel32.dll", SetLastError:=True)>
Friend Shared Function CreateRemoteThread(ByVal hProcess As IntPtr,
ByVal threadAttributes As IntPtr,
ByVal stackSize As IntPtr,
ByVal startAddress As UIntPtr,
ByVal threadParameter As IntPtr,
<MarshalAs(UnmanagedType.U4)> ByVal creationFlags As ThreadCreationFlags,
ByRef refThreadId As UInteger
) As IntPtr
End Function
<DllImport("kernel32.dll", SetLastError:=True)>
Friend Shared Function CreateRemoteThread(ByVal hProcess As IntPtr,
ByVal threadAttributes As IntPtr,
ByVal stackSize As IntPtr,
ByVal startAddress As ThreadStart,
ByVal threadParameter As IntPtr,
<MarshalAs(UnmanagedType.U4)> ByVal creationFlags As ThreadCreationFlags,
ByRef refThreadId As UInteger
) As IntPtr
End Function
<DllImport("kernel32.dll", SetLastError:=True)>
Friend Shared Function CreateRemoteThread(ByVal hProcess As IntPtr,
<[In]> ByRef refThreadAttributes As SecurityAttributes,
ByVal stackSize As IntPtr,
ByVal startAddress As IntPtr,
ByVal threadParameter As IntPtr,
<MarshalAs(UnmanagedType.U4)> ByVal creationFlags As ThreadCreationFlags,
ByRef refThreadId As UInteger
) As IntPtr
End Function
<DllImport("kernel32.dll", SetLastError:=True)>
Friend Shared Function CreateRemoteThread(ByVal hProcess As IntPtr,
<[In]> ByRef refThreadAttributes As SecurityAttributes,
ByVal stackSize As IntPtr,
ByVal startAddress As UIntPtr,
ByVal threadParameter As IntPtr,
<MarshalAs(UnmanagedType.U4)> ByVal creationFlags As ThreadCreationFlags,
ByRef refThreadId As UInteger
) As IntPtr
End Function
<DllImport("kernel32.dll", SetLastError:=True)>
Friend Shared Function CreateRemoteThread(ByVal hProcess As IntPtr,
<[In]> ByRef refThreadAttributes As SecurityAttributes,
ByVal stackSize As IntPtr,
ByVal startAddress As ThreadStart,
ByVal threadParameter As IntPtr,
<MarshalAs(UnmanagedType.U4)> ByVal creationFlags As ThreadCreationFlags,
ByRef refThreadId As UInteger
) As IntPtr
End Function
<DllImport("User32.dll", SetLastError:=True, CharSet:=CharSet.Ansi, BestFitMapping:=False, ThrowOnUnmappableChar:=True)>
Friend Shared Function FindWindow(ByVal className As String,
ByVal windowName As String
) As IntPtr
End Function
<DllImport("User32.dll", SetLastError:=True, CharSet:=CharSet.Ansi, BestFitMapping:=False, ThrowOnUnmappableChar:=True)>
Friend Shared Function FindWindowEx(ByVal hwndParent As IntPtr,
ByVal hwndChildAfter As IntPtr,
ByVal strClassName As String,
ByVal strWindowName As String
) As IntPtr
End Function
<DllImport("User32.dll", SetLastError:=True, CharSet:=CharSet.Ansi, BestFitMapping:=False, ThrowOnUnmappableChar:=True)>
Friend Shared Function FindWindowEx(ByVal hwndParent As HandleRef,
ByVal hwndChildAfter As HandleRef,
ByVal strClassName As String,
ByVal strWindowName As String
) As IntPtr
End Function
<DllImport("Kernel32.dll", SetLastError:=True)>
Friend Shared Function FreeLibrary(ByVal handle As IntPtr
) As <MarshalAs(UnmanagedType.Bool)> Boolean
End Function
<DllImport("Kernel32.dll", SetLastError:=True)>
Friend Shared Function FreeLibrary(ByVal handle As SafeModuleHandle
) As <MarshalAs(UnmanagedType.Bool)> Boolean
End Function
<DllImport("Kernel32.dll", SetLastError:=True, CharSet:=CharSet.Ansi, BestFitMapping:=False, ThrowOnUnmappableChar:=True)>
Friend Shared Function GetModuleHandle(ByVal moduleName As String
) As IntPtr
End Function
<DllImport("Kernel32.dll", SetLastError:=True, CharSet:=CharSet.Ansi, BestFitMapping:=False, ThrowOnUnmappableChar:=True)>
Friend Shared Function GetProcAddress(ByVal hModule As IntPtr,
ByVal procName As String
) As IntPtr
End Function
<DllImport("Kernel32.dll", SetLastError:=True, CharSet:=CharSet.Ansi, BestFitMapping:=False, ThrowOnUnmappableChar:=True)>
Friend Shared Function GetProcAddress(ByVal hModule As SafeModuleHandle,
ByVal procName As String
) As IntPtr
End Function
<DllImport("Kernel32.dll", SetLastError:=True, CharSet:=CharSet.Ansi, BestFitMapping:=False, ThrowOnUnmappableChar:=True)>
Friend Shared Function LoadLibrary(ByVal fileName As String
) As SafeModuleHandle
End Function
<DllImport("Kernel32.dll", SetLastError:=True, CharSet:=CharSet.Ansi, BestFitMapping:=False, ThrowOnUnmappableChar:=True)>
Friend Shared Function LoadLibraryEx(ByVal fileName As String,
ByVal hFile As IntPtr,
<MarshalAs(UnmanagedType.U4)> ByVal flags As LoadLibraryFlags
) As SafeModuleHandle
End Function
<DllImport("Kernel32.dll", SetLastError:=True)>
Friend Shared Function OpenProcess(
<MarshalAs(UnmanagedType.U4)> ByVal processAccess As ProcessAccessRights,
ByVal inheritHandle As Boolean,
ByVal pid As Integer
) As IntPtr
End Function
<DllImport("Kernel32.dll", SetLastError:=True)>
Friend Shared Function ReadProcessMemory(ByVal hProcess As IntPtr,
ByVal baseAddress As IntPtr,
ByVal buffer As IntPtr,
ByVal size As IntPtr,
ByRef refNumberOfBytesRead As Integer
) As <MarshalAs(UnmanagedType.Bool)> Boolean
End Function
<DllImport("Kernel32.dll", SetLastError:=True)>
Friend Shared Function ReadProcessMemory(ByVal hProcess As IntPtr,
ByVal baseAddress As IntPtr,
ByVal buffer As IntPtr,
ByVal size As UInteger,
ByRef refNumberOfBytesRead As Integer
) As <MarshalAs(UnmanagedType.Bool)> Boolean
End Function
<DllImport("Kernel32.dll", SetLastError:=True)>
Friend Shared Function ReadProcessMemory(ByVal hProcess As IntPtr,
ByVal baseAddress As IntPtr,
<Out> ByVal buffer As Byte(),
ByVal size As UInteger,
ByRef refNumberOfBytesRead As Integer
) As <MarshalAs(UnmanagedType.Bool)> Boolean
End Function
<DllImport("Kernel32.dll", SetLastError:=True, CharSet:=CharSet.Ansi, BestFitMapping:=False, ThrowOnUnmappableChar:=True)>
Friend Shared Function ReadProcessMemory(ByVal hProcess As IntPtr,
ByVal baseAddress As IntPtr,
<Out> ByVal buffer As StringBuilder,
ByVal size As Integer,
ByRef refNumberOfBytesRead As Integer
) As <MarshalAs(UnmanagedType.Bool)> Boolean
End Function
<DllImport("Kernel32.dll", SetLastError:=True)>
Friend Shared Function ReadProcessMemory(ByVal hProcess As IntPtr,
ByVal baseAddress As UIntPtr,
ByVal buffer As IntPtr,
ByVal size As IntPtr,
ByRef refNumberOfBytesRead As Integer
) As <MarshalAs(UnmanagedType.Bool)> Boolean
End Function
<DllImport("Kernel32.dll", SetLastError:=True)>
Friend Shared Function ReadProcessMemory(ByVal hProcess As IntPtr,
ByVal baseAddress As UIntPtr,
ByVal buffer As IntPtr,
ByVal size As Integer,
ByRef refNumberOfBytesRead As Integer
) As <MarshalAs(UnmanagedType.Bool)> Boolean
End Function
<DllImport("Kernel32.dll", SetLastError:=True)>
Friend Shared Function ReadProcessMemory(ByVal hProcess As IntPtr,
ByVal baseAddress As UIntPtr,
<Out> ByVal buffer As Byte(),
ByVal size As Integer,
ByRef refNumberOfBytesRead As Integer
) As <MarshalAs(UnmanagedType.Bool)> Boolean
End Function
<DllImport("Kernel32.dll", SetLastError:=True, CharSet:=CharSet.Ansi, BestFitMapping:=False, ThrowOnUnmappableChar:=True)>
Friend Shared Function ReadProcessMemory(ByVal hProcess As IntPtr,
ByVal baseAddress As UIntPtr,
<Out> ByVal buffer As StringBuilder,
ByVal size As Integer,
ByRef refNumberOfBytesRead As Integer
) As <MarshalAs(UnmanagedType.Bool)> Boolean
End Function
<DllImport("Kernel32.dll", SetLastError:=True)>
Friend Shared Function VirtualAlloc(ByVal address As IntPtr,
ByVal size As UInteger,
<MarshalAs(UnmanagedType.U4)> ByVal allocationType As MemoryAllocationType,
<MarshalAs(UnmanagedType.U4)> ByVal protection As MemoryProtectionOptions
) As IntPtr
End Function
<DllImport("Kernel32.dll", SetLastError:=True)>
Friend Shared Function VirtualAlloc(ByVal address As UIntPtr,
ByVal size As UInteger,
<MarshalAs(UnmanagedType.U4)> ByVal allocationType As MemoryAllocationType,
<MarshalAs(UnmanagedType.U4)> ByVal protection As MemoryProtectionOptions
) As UIntPtr
End Function
<DllImport("Kernel32.dll", ExactSpelling:=True, SetLastError:=True)>
Friend Shared Function VirtualAllocEx(ByVal hProcess As IntPtr,
ByVal address As IntPtr,
ByVal size As UInteger,
<MarshalAs(UnmanagedType.U4)> ByVal allocationType As MemoryAllocationType,
<MarshalAs(UnmanagedType.U4)> ByVal protection As MemoryProtectionOptions
) As IntPtr
End Function
<DllImport("Kernel32.dll", ExactSpelling:=True, SetLastError:=True)>
Friend Shared Function VirtualAllocEx(ByVal hProcess As IntPtr,
ByVal address As UIntPtr,
ByVal size As UInteger,
<MarshalAs(UnmanagedType.U4)> ByVal allocationType As MemoryAllocationType,
<MarshalAs(UnmanagedType.U4)> ByVal protection As MemoryProtectionOptions
) As UIntPtr
End Function
<DllImport("Kernel32.dll", SetLastError:=True)>
Friend Shared Function WriteProcessMemory(ByVal hProcess As IntPtr,
ByVal baseAddress As IntPtr,
ByVal buffer As Byte(),
ByVal size As IntPtr,
<Out> ByRef refNumberOfBytesWritten As IntPtr
) As <MarshalAs(UnmanagedType.Bool)> Boolean
End Function
<DllImport("Kernel32.dll", SetLastError:=True)>
Friend Shared Function WriteProcessMemory(ByVal hProcess As IntPtr,
ByVal baseAddress As UIntPtr,
ByVal buffer As Byte(),
ByVal size As IntPtr,
<Out> ByRef refNumberOfBytesWritten As IntPtr
) As <MarshalAs(UnmanagedType.Bool)> Boolean
End Function
<DllImport("Kernel32.dll", SetLastError:=True)>
Friend Shared Function WriteProcessMemory(ByVal hProcess As IntPtr,
ByVal baseAddress As IntPtr,
ByVal buffer As IntPtr,
ByVal size As IntPtr,
<Out> ByRef refNumberOfBytesWritten As IntPtr
) As <MarshalAs(UnmanagedType.Bool)> Boolean
End Function
<DllImport("Kernel32.dll", SetLastError:=True)>
Friend Shared Function WriteProcessMemory(ByVal hProcess As IntPtr,
ByVal baseAddress As UIntPtr,
ByVal buffer As IntPtr,
ByVal size As IntPtr,
<Out> ByRef refNumberOfBytesWritten As IntPtr
) As <MarshalAs(UnmanagedType.Bool)> Boolean
End Function
End Class