Process Hacker
ntmmapi.h File Reference

Go to the source code of this file.

Data Structures

struct  _MEMORY_WORKING_SET_BLOCK
 
struct  _MEMORY_WORKING_SET_INFORMATION
 
struct  _MEMORY_REGION_INFORMATION
 
struct  _MEMORY_WORKING_SET_EX_BLOCK
 
struct  _MEMORY_WORKING_SET_EX_INFORMATION
 
struct  _MEMORY_SHARED_COMMIT_INFORMATION
 
struct  _MEMORY_FRAME_INFORMATION
 
struct  _FILEOFFSET_INFORMATION
 
struct  _PAGEDIR_INFORMATION
 
struct  _MMPFN_IDENTITY
 
struct  _MMPFN_MEMSNAP_INFORMATION
 
struct  _SECTION_BASIC_INFORMATION
 
struct  _SECTION_IMAGE_INFORMATION
 
struct  _MEMORY_RANGE_ENTRY
 

Macros

#define MMPFNLIST_ZERO   0
 
#define MMPFNLIST_FREE   1
 
#define MMPFNLIST_STANDBY   2
 
#define MMPFNLIST_MODIFIED   3
 
#define MMPFNLIST_MODIFIEDNOWRITE   4
 
#define MMPFNLIST_BAD   5
 
#define MMPFNLIST_ACTIVE   6
 
#define MMPFNLIST_TRANSITION   7
 
#define MMPFNUSE_PROCESSPRIVATE   0
 
#define MMPFNUSE_FILE   1
 
#define MMPFNUSE_PAGEFILEMAPPED   2
 
#define MMPFNUSE_PAGETABLE   3
 
#define MMPFNUSE_PAGEDPOOL   4
 
#define MMPFNUSE_NONPAGEDPOOL   5
 
#define MMPFNUSE_SYSTEMPTE   6
 
#define MMPFNUSE_SESSIONPRIVATE   7
 
#define MMPFNUSE_METAFILE   8
 
#define MMPFNUSE_AWEPAGE   9
 
#define MMPFNUSE_DRIVERLOCKPAGE   10
 
#define SEC_BASED   0x200000
 
#define SEC_NO_CHANGE   0x400000
 
#define SEC_GLOBAL   0x20000000
 
#define MEM_EXECUTE_OPTION_DISABLE   0x1
 
#define MEM_EXECUTE_OPTION_ENABLE   0x2
 
#define MEM_EXECUTE_OPTION_DISABLE_THUNK_EMULATION   0x4
 
#define MEM_EXECUTE_OPTION_PERMANENT   0x8
 
#define MEM_EXECUTE_OPTION_EXECUTE_DISPATCH_ENABLE   0x10
 
#define MEM_EXECUTE_OPTION_IMAGE_DISPATCH_ENABLE   0x20
 
#define MEM_EXECUTE_OPTION_VALID_FLAGS   0x3f
 

Typedefs

typedef enum
_MEMORY_INFORMATION_CLASS 
MEMORY_INFORMATION_CLASS
 
typedef struct
_MEMORY_WORKING_SET_BLOCK 
MEMORY_WORKING_SET_BLOCK
 
typedef struct
_MEMORY_WORKING_SET_BLOCK
PMEMORY_WORKING_SET_BLOCK
 
typedef struct
_MEMORY_WORKING_SET_INFORMATION 
MEMORY_WORKING_SET_INFORMATION
 
typedef struct
_MEMORY_WORKING_SET_INFORMATION
PMEMORY_WORKING_SET_INFORMATION
 
typedef struct
_MEMORY_REGION_INFORMATION 
MEMORY_REGION_INFORMATION
 
typedef struct
_MEMORY_REGION_INFORMATION
PMEMORY_REGION_INFORMATION
 
typedef struct
_MEMORY_WORKING_SET_EX_BLOCK 
MEMORY_WORKING_SET_EX_BLOCK
 
typedef struct
_MEMORY_WORKING_SET_EX_BLOCK
PMEMORY_WORKING_SET_EX_BLOCK
 
typedef struct
_MEMORY_WORKING_SET_EX_INFORMATION 
MEMORY_WORKING_SET_EX_INFORMATION
 
typedef struct
_MEMORY_WORKING_SET_EX_INFORMATION
PMEMORY_WORKING_SET_EX_INFORMATION
 
typedef struct
_MEMORY_SHARED_COMMIT_INFORMATION 
MEMORY_SHARED_COMMIT_INFORMATION
 
typedef struct
_MEMORY_SHARED_COMMIT_INFORMATION
PMEMORY_SHARED_COMMIT_INFORMATION
 
typedef struct
_MEMORY_FRAME_INFORMATION 
MEMORY_FRAME_INFORMATION
 
typedef struct
_FILEOFFSET_INFORMATION 
FILEOFFSET_INFORMATION
 
typedef struct _PAGEDIR_INFORMATION PAGEDIR_INFORMATION
 
typedef struct _MMPFN_IDENTITY MMPFN_IDENTITY
 
typedef struct _MMPFN_IDENTITYPMMPFN_IDENTITY
 
typedef struct
_MMPFN_MEMSNAP_INFORMATION 
MMPFN_MEMSNAP_INFORMATION
 
typedef struct
_MMPFN_MEMSNAP_INFORMATION
PMMPFN_MEMSNAP_INFORMATION
 
typedef enum
_SECTION_INFORMATION_CLASS 
SECTION_INFORMATION_CLASS
 
typedef struct
_SECTION_BASIC_INFORMATION 
SECTION_BASIC_INFORMATION
 
typedef struct
_SECTION_BASIC_INFORMATION
PSECTION_BASIC_INFORMATION
 
typedef struct
_SECTION_IMAGE_INFORMATION 
SECTION_IMAGE_INFORMATION
 
typedef struct
_SECTION_IMAGE_INFORMATION
PSECTION_IMAGE_INFORMATION
 
typedef enum _SECTION_INHERIT SECTION_INHERIT
 
typedef enum
_VIRTUAL_MEMORY_INFORMATION_CLASS 
VIRTUAL_MEMORY_INFORMATION_CLASS
 
typedef struct _MEMORY_RANGE_ENTRY MEMORY_RANGE_ENTRY
 
typedef struct
_MEMORY_RANGE_ENTRY
PMEMORY_RANGE_ENTRY
 
typedef enum
_MEMORY_PARTITION_INFORMATION_CLASS 
MEMORY_PARTITION_INFORMATION_CLASS
 

Enumerations

enum  _MEMORY_INFORMATION_CLASS {
  MemoryBasicInformation, MemoryWorkingSetInformation, MemoryMappedFilenameInformation, MemoryRegionInformation,
  MemoryWorkingSetExInformation, MemorySharedCommitInformation
}
 
enum  _SECTION_INFORMATION_CLASS { SectionBasicInformation, SectionImageInformation, SectionRelocationInformation, MaxSectionInfoClass }
 
enum  _SECTION_INHERIT { ViewShare = 1, ViewUnmap = 2 }
 
enum  _VIRTUAL_MEMORY_INFORMATION_CLASS { VmPrefetchInformation, VmPagePriorityInformation, VmCfgCallTargetInformation }
 
enum  _MEMORY_PARTITION_INFORMATION_CLASS { SystemMemoryPartitionInformation, SystemMemoryPartitionMoveMemory, SystemMemoryPartitionAddPagefile, SystemMemoryPartitionCombineMemory }
 

Functions

NTSYSCALLAPI NTSTATUS NTAPI NtAllocateVirtualMemory (_In_ HANDLE ProcessHandle, _Inout_ _At_(*BaseAddress, _Readable_bytes_(*RegionSize) _Writable_bytes_(*RegionSize) _Post_readable_byte_size_(*RegionSize)) PVOID *BaseAddress, _In_ ULONG_PTR ZeroBits, _Inout_ PSIZE_T RegionSize, _In_ ULONG AllocationType, _In_ ULONG Protect)
 
NTSYSCALLAPI NTSTATUS NTAPI NtFreeVirtualMemory (_In_ HANDLE ProcessHandle, _Inout_ PVOID *BaseAddress, _Inout_ PSIZE_T RegionSize, _In_ ULONG FreeType)
 
NTSYSCALLAPI NTSTATUS NTAPI NtReadVirtualMemory (_In_ HANDLE ProcessHandle, _In_opt_ PVOID BaseAddress, _Out_writes_bytes_(BufferSize) PVOID Buffer, _In_ SIZE_T BufferSize, _Out_opt_ PSIZE_T NumberOfBytesRead)
 
NTSYSCALLAPI NTSTATUS NTAPI NtWriteVirtualMemory (_In_ HANDLE ProcessHandle, _In_opt_ PVOID BaseAddress, _In_reads_bytes_(BufferSize) PVOID Buffer, _In_ SIZE_T BufferSize, _Out_opt_ PSIZE_T NumberOfBytesWritten)
 
NTSYSCALLAPI NTSTATUS NTAPI NtProtectVirtualMemory (_In_ HANDLE ProcessHandle, _Inout_ PVOID *BaseAddress, _Inout_ PSIZE_T RegionSize, _In_ ULONG NewProtect, _Out_ PULONG OldProtect)
 
NTSYSCALLAPI NTSTATUS NTAPI NtQueryVirtualMemory (_In_ HANDLE ProcessHandle, _In_ PVOID BaseAddress, _In_ MEMORY_INFORMATION_CLASS MemoryInformationClass, _Out_writes_bytes_(MemoryInformationLength) PVOID MemoryInformation, _In_ SIZE_T MemoryInformationLength, _Out_opt_ PSIZE_T ReturnLength)
 
NTSYSCALLAPI NTSTATUS NTAPI NtSetInformationVirtualMemory (_In_ HANDLE ProcessHandle, _In_ VIRTUAL_MEMORY_INFORMATION_CLASS VmInformationClass, _In_ ULONG_PTR NumberOfEntries, _In_reads_(NumberOfEntries) PMEMORY_RANGE_ENTRY VirtualAddresses, _In_reads_bytes_(VmInformationLength) PVOID VmInformation, _In_ ULONG VmInformationLength)
 
NTSYSCALLAPI NTSTATUS NTAPI NtLockVirtualMemory (_In_ HANDLE ProcessHandle, _Inout_ PVOID *BaseAddress, _Inout_ PSIZE_T RegionSize, _In_ ULONG MapType)
 
NTSYSCALLAPI NTSTATUS NTAPI NtUnlockVirtualMemory (_In_ HANDLE ProcessHandle, _Inout_ PVOID *BaseAddress, _Inout_ PSIZE_T RegionSize, _In_ ULONG MapType)
 
NTSYSCALLAPI NTSTATUS NTAPI NtCreateSection (_Out_ PHANDLE SectionHandle, _In_ ACCESS_MASK DesiredAccess, _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes, _In_opt_ PLARGE_INTEGER MaximumSize, _In_ ULONG SectionPageProtection, _In_ ULONG AllocationAttributes, _In_opt_ HANDLE FileHandle)
 
NTSYSCALLAPI NTSTATUS NTAPI NtOpenSection (_Out_ PHANDLE SectionHandle, _In_ ACCESS_MASK DesiredAccess, _In_ POBJECT_ATTRIBUTES ObjectAttributes)
 
NTSYSCALLAPI NTSTATUS NTAPI NtMapViewOfSection (_In_ HANDLE SectionHandle, _In_ HANDLE ProcessHandle, _Inout_ _At_(*BaseAddress, _Readable_bytes_(*ViewSize) _Writable_bytes_(*ViewSize) _Post_readable_byte_size_(*ViewSize)) PVOID *BaseAddress, _In_ ULONG_PTR ZeroBits, _In_ SIZE_T CommitSize, _Inout_opt_ PLARGE_INTEGER SectionOffset, _Inout_ PSIZE_T ViewSize, _In_ SECTION_INHERIT InheritDisposition, _In_ ULONG AllocationType, _In_ ULONG Win32Protect)
 
NTSYSCALLAPI NTSTATUS NTAPI NtUnmapViewOfSection (_In_ HANDLE ProcessHandle, _In_opt_ PVOID BaseAddress)
 
NTSYSCALLAPI NTSTATUS NTAPI NtUnmapViewOfSectionEx (_In_ HANDLE ProcessHandle, _In_opt_ PVOID BaseAddress, _In_ ULONG Flags)
 
NTSYSCALLAPI NTSTATUS NTAPI NtExtendSection (_In_ HANDLE SectionHandle, _Inout_ PLARGE_INTEGER NewSectionSize)
 
NTSYSCALLAPI NTSTATUS NTAPI NtQuerySection (_In_ HANDLE SectionHandle, _In_ SECTION_INFORMATION_CLASS SectionInformationClass, _Out_writes_bytes_(SectionInformationLength) PVOID SectionInformation, _In_ SIZE_T SectionInformationLength, _Out_opt_ PSIZE_T ReturnLength)
 
NTSYSCALLAPI NTSTATUS NTAPI NtAreMappedFilesTheSame (_In_ PVOID File1MappedAsAnImage, _In_ PVOID File2MappedAsFile)
 
NTSYSCALLAPI NTSTATUS NTAPI NtCreatePartition (_Out_ PHANDLE PartitionHandle, _In_ ACCESS_MASK DesiredAccess, _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes, _In_ ULONG PreferredNode)
 
NTSYSCALLAPI NTSTATUS NTAPI NtOpenPartition (_Out_ PHANDLE PartitionHandle, _In_ ACCESS_MASK DesiredAccess, _In_ POBJECT_ATTRIBUTES ObjectAttributes)
 
NTSYSCALLAPI NTSTATUS NTAPI NtManagePartition (_In_ MEMORY_PARTITION_INFORMATION_CLASS PartitionInformationClass, _In_ PVOID PartitionInformation, _In_ ULONG PartitionInformationLength)
 
NTSYSCALLAPI NTSTATUS NTAPI NtMapUserPhysicalPages (_In_ PVOID VirtualAddress, _In_ ULONG_PTR NumberOfPages, _In_reads_opt_(NumberOfPages) PULONG_PTR UserPfnArray)
 
NTSYSCALLAPI NTSTATUS NTAPI NtMapUserPhysicalPagesScatter (_In_reads_(NumberOfPages) PVOID *VirtualAddresses, _In_ ULONG_PTR NumberOfPages, _In_reads_opt_(NumberOfPages) PULONG_PTR UserPfnArray)
 
NTSYSCALLAPI NTSTATUS NTAPI NtAllocateUserPhysicalPages (_In_ HANDLE ProcessHandle, _Inout_ PULONG_PTR NumberOfPages, _Out_writes_(*NumberOfPages) PULONG_PTR UserPfnArray)
 
NTSYSCALLAPI NTSTATUS NTAPI NtFreeUserPhysicalPages (_In_ HANDLE ProcessHandle, _Inout_ PULONG_PTR NumberOfPages, _In_reads_(*NumberOfPages) PULONG_PTR UserPfnArray)
 
NTSYSCALLAPI NTSTATUS NTAPI NtOpenSession (_Out_ PHANDLE SessionHandle, _In_ ACCESS_MASK DesiredAccess, _In_ POBJECT_ATTRIBUTES ObjectAttributes)
 
NTSYSCALLAPI NTSTATUS NTAPI NtGetWriteWatch (_In_ HANDLE ProcessHandle, _In_ ULONG Flags, _In_ PVOID BaseAddress, _In_ SIZE_T RegionSize, _Out_writes_(*EntriesInUserAddressArray) PVOID *UserAddressArray, _Inout_ PULONG_PTR EntriesInUserAddressArray, _Out_ PULONG Granularity)
 
NTSYSCALLAPI NTSTATUS NTAPI NtResetWriteWatch (_In_ HANDLE ProcessHandle, _In_ PVOID BaseAddress, _In_ SIZE_T RegionSize)
 
NTSYSCALLAPI NTSTATUS NTAPI NtCreatePagingFile (_In_ PUNICODE_STRING PageFileName, _In_ PLARGE_INTEGER MinimumSize, _In_ PLARGE_INTEGER MaximumSize, _In_ ULONG Priority)
 
NTSYSCALLAPI NTSTATUS NTAPI NtFlushInstructionCache (_In_ HANDLE ProcessHandle, _In_opt_ PVOID BaseAddress, _In_ SIZE_T Length)
 
NTSYSCALLAPI NTSTATUS NTAPI NtFlushWriteBuffer (VOID)
 

Macro Definition Documentation

#define MEM_EXECUTE_OPTION_DISABLE   0x1

Definition at line 235 of file ntmmapi.h.

#define MEM_EXECUTE_OPTION_DISABLE_THUNK_EMULATION   0x4

Definition at line 237 of file ntmmapi.h.

#define MEM_EXECUTE_OPTION_ENABLE   0x2

Definition at line 236 of file ntmmapi.h.

#define MEM_EXECUTE_OPTION_EXECUTE_DISPATCH_ENABLE   0x10

Definition at line 239 of file ntmmapi.h.

#define MEM_EXECUTE_OPTION_IMAGE_DISPATCH_ENABLE   0x20

Definition at line 240 of file ntmmapi.h.

#define MEM_EXECUTE_OPTION_PERMANENT   0x8

Definition at line 238 of file ntmmapi.h.

#define MEM_EXECUTE_OPTION_VALID_FLAGS   0x3f

Definition at line 241 of file ntmmapi.h.

#define MMPFNLIST_ACTIVE   6

Definition at line 108 of file ntmmapi.h.

#define MMPFNLIST_BAD   5

Definition at line 107 of file ntmmapi.h.

#define MMPFNLIST_FREE   1

Definition at line 103 of file ntmmapi.h.

#define MMPFNLIST_MODIFIED   3

Definition at line 105 of file ntmmapi.h.

#define MMPFNLIST_MODIFIEDNOWRITE   4

Definition at line 106 of file ntmmapi.h.

#define MMPFNLIST_STANDBY   2

Definition at line 104 of file ntmmapi.h.

#define MMPFNLIST_TRANSITION   7

Definition at line 109 of file ntmmapi.h.

#define MMPFNLIST_ZERO   0

Definition at line 102 of file ntmmapi.h.

#define MMPFNUSE_AWEPAGE   9

Definition at line 120 of file ntmmapi.h.

#define MMPFNUSE_DRIVERLOCKPAGE   10

Definition at line 121 of file ntmmapi.h.

#define MMPFNUSE_FILE   1

Definition at line 112 of file ntmmapi.h.

#define MMPFNUSE_METAFILE   8

Definition at line 119 of file ntmmapi.h.

#define MMPFNUSE_NONPAGEDPOOL   5

Definition at line 116 of file ntmmapi.h.

#define MMPFNUSE_PAGEDPOOL   4

Definition at line 115 of file ntmmapi.h.

#define MMPFNUSE_PAGEFILEMAPPED   2

Definition at line 113 of file ntmmapi.h.

#define MMPFNUSE_PAGETABLE   3

Definition at line 114 of file ntmmapi.h.

#define MMPFNUSE_PROCESSPRIVATE   0

Definition at line 111 of file ntmmapi.h.

#define MMPFNUSE_SESSIONPRIVATE   7

Definition at line 118 of file ntmmapi.h.

#define MMPFNUSE_SYSTEMPTE   6

Definition at line 117 of file ntmmapi.h.

#define SEC_BASED   0x200000

Definition at line 231 of file ntmmapi.h.

#define SEC_GLOBAL   0x20000000

Definition at line 233 of file ntmmapi.h.

#define SEC_NO_CHANGE   0x400000

Definition at line 232 of file ntmmapi.h.

Typedef Documentation

typedef struct _MMPFN_IDENTITY * PMMPFN_IDENTITY

Enumeration Type Documentation

Enumerator:
MemoryBasicInformation 
MemoryWorkingSetInformation 
MemoryMappedFilenameInformation 
MemoryRegionInformation 
MemoryWorkingSetExInformation 
MemorySharedCommitInformation 

Definition at line 5 of file ntmmapi.h.

Enumerator:
SystemMemoryPartitionInformation 
SystemMemoryPartitionMoveMemory 
SystemMemoryPartitionAddPagefile 
SystemMemoryPartitionCombineMemory 

Definition at line 454 of file ntmmapi.h.

Enumerator:
SectionBasicInformation 
SectionImageInformation 
SectionRelocationInformation 
MaxSectionInfoClass 

Definition at line 170 of file ntmmapi.h.

Enumerator:
ViewShare 
ViewUnmap 

Definition at line 225 of file ntmmapi.h.

Enumerator:
VmPrefetchInformation 
VmPagePriorityInformation 
VmCfgCallTargetInformation 

Definition at line 314 of file ntmmapi.h.

Function Documentation

NTSYSCALLAPI NTSTATUS NTAPI NtAllocateUserPhysicalPages ( _In_ HANDLE  ProcessHandle,
_Inout_ PULONG_PTR  NumberOfPages,
_Out_writes_ *NumberOfPages PULONG_PTR  UserPfnArray 
)
NTSYSCALLAPI NTSTATUS NTAPI NtAllocateVirtualMemory ( _In_ HANDLE  ProcessHandle,
_Inout_ _At_(*,*RegionSize _Writable_bytes_ *RegionSize _Post_readable_byte_size_ *  RegionSize 
)
NTSYSCALLAPI NTSTATUS NTAPI NtAreMappedFilesTheSame ( _In_ PVOID  File1MappedAsAnImage,
_In_ PVOID  File2MappedAsFile 
)
NTSYSCALLAPI NTSTATUS NTAPI NtCreatePagingFile ( _In_ PUNICODE_STRING  PageFileName,
_In_ PLARGE_INTEGER  MinimumSize,
_In_ PLARGE_INTEGER  MaximumSize,
_In_ ULONG  Priority 
)
NTSYSCALLAPI NTSTATUS NTAPI NtCreatePartition ( _Out_ PHANDLE  PartitionHandle,
_In_ ACCESS_MASK  DesiredAccess,
_In_opt_ POBJECT_ATTRIBUTES  ObjectAttributes,
_In_ ULONG  PreferredNode 
)
NTSYSCALLAPI NTSTATUS NTAPI NtCreateSection ( _Out_ PHANDLE  SectionHandle,
_In_ ACCESS_MASK  DesiredAccess,
_In_opt_ POBJECT_ATTRIBUTES  ObjectAttributes,
_In_opt_ PLARGE_INTEGER  MaximumSize,
_In_ ULONG  SectionPageProtection,
_In_ ULONG  AllocationAttributes,
_In_opt_ HANDLE  FileHandle 
)
NTSYSCALLAPI NTSTATUS NTAPI NtExtendSection ( _In_ HANDLE  SectionHandle,
_Inout_ PLARGE_INTEGER  NewSectionSize 
)
NTSYSCALLAPI NTSTATUS NTAPI NtFlushInstructionCache ( _In_ HANDLE  ProcessHandle,
_In_opt_ PVOID  BaseAddress,
_In_ SIZE_T  Length 
)
NTSYSCALLAPI NTSTATUS NTAPI NtFlushWriteBuffer ( VOID  )
NTSYSCALLAPI NTSTATUS NTAPI NtFreeUserPhysicalPages ( _In_ HANDLE  ProcessHandle,
_Inout_ PULONG_PTR  NumberOfPages,
_In_reads_ *NumberOfPages PULONG_PTR  UserPfnArray 
)
NTSYSCALLAPI NTSTATUS NTAPI NtFreeVirtualMemory ( _In_ HANDLE  ProcessHandle,
_Inout_ PVOID *  BaseAddress,
_Inout_ PSIZE_T  RegionSize,
_In_ ULONG  FreeType 
)
NTSYSCALLAPI NTSTATUS NTAPI NtGetWriteWatch ( _In_ HANDLE  ProcessHandle,
_In_ ULONG  Flags,
_In_ PVOID  BaseAddress,
_In_ SIZE_T  RegionSize,
_Out_writes_ *EntriesInUserAddressArray PVOID *  UserAddressArray,
_Inout_ PULONG_PTR  EntriesInUserAddressArray,
_Out_ PULONG  Granularity 
)
NTSYSCALLAPI NTSTATUS NTAPI NtLockVirtualMemory ( _In_ HANDLE  ProcessHandle,
_Inout_ PVOID *  BaseAddress,
_Inout_ PSIZE_T  RegionSize,
_In_ ULONG  MapType 
)
NTSYSCALLAPI NTSTATUS NTAPI NtManagePartition ( _In_ MEMORY_PARTITION_INFORMATION_CLASS  PartitionInformationClass,
_In_ PVOID  PartitionInformation,
_In_ ULONG  PartitionInformationLength 
)
NTSYSCALLAPI NTSTATUS NTAPI NtMapUserPhysicalPages ( _In_ PVOID  VirtualAddress,
_In_ ULONG_PTR  NumberOfPages,
_In_reads_opt_(NumberOfPages) PULONG_PTR  UserPfnArray 
)
NTSYSCALLAPI NTSTATUS NTAPI NtMapUserPhysicalPagesScatter ( _In_reads_(NumberOfPages) PVOID *  VirtualAddresses,
_In_ ULONG_PTR  NumberOfPages,
_In_reads_opt_(NumberOfPages) PULONG_PTR  UserPfnArray 
)
NTSYSCALLAPI NTSTATUS NTAPI NtMapViewOfSection ( _In_ HANDLE  SectionHandle,
_In_ HANDLE  ProcessHandle,
_Inout_ _At_(*,*ViewSize _Writable_bytes_ *ViewSize _Post_readable_byte_size_ *  ViewSize 
)
NTSYSCALLAPI NTSTATUS NTAPI NtOpenPartition ( _Out_ PHANDLE  PartitionHandle,
_In_ ACCESS_MASK  DesiredAccess,
_In_ POBJECT_ATTRIBUTES  ObjectAttributes 
)
NTSYSCALLAPI NTSTATUS NTAPI NtOpenSection ( _Out_ PHANDLE  SectionHandle,
_In_ ACCESS_MASK  DesiredAccess,
_In_ POBJECT_ATTRIBUTES  ObjectAttributes 
)
NTSYSCALLAPI NTSTATUS NTAPI NtOpenSession ( _Out_ PHANDLE  SessionHandle,
_In_ ACCESS_MASK  DesiredAccess,
_In_ POBJECT_ATTRIBUTES  ObjectAttributes 
)
NTSYSCALLAPI NTSTATUS NTAPI NtProtectVirtualMemory ( _In_ HANDLE  ProcessHandle,
_Inout_ PVOID *  BaseAddress,
_Inout_ PSIZE_T  RegionSize,
_In_ ULONG  NewProtect,
_Out_ PULONG  OldProtect 
)
NTSYSCALLAPI NTSTATUS NTAPI NtQuerySection ( _In_ HANDLE  SectionHandle,
_In_ SECTION_INFORMATION_CLASS  SectionInformationClass,
_Out_writes_bytes_(SectionInformationLength) PVOID  SectionInformation,
_In_ SIZE_T  SectionInformationLength,
_Out_opt_ PSIZE_T  ReturnLength 
)
NTSYSCALLAPI NTSTATUS NTAPI NtQueryVirtualMemory ( _In_ HANDLE  ProcessHandle,
_In_ PVOID  BaseAddress,
_In_ MEMORY_INFORMATION_CLASS  MemoryInformationClass,
_Out_writes_bytes_(MemoryInformationLength) PVOID  MemoryInformation,
_In_ SIZE_T  MemoryInformationLength,
_Out_opt_ PSIZE_T  ReturnLength 
)
NTSYSCALLAPI NTSTATUS NTAPI NtReadVirtualMemory ( _In_ HANDLE  ProcessHandle,
_In_opt_ PVOID  BaseAddress,
_Out_writes_bytes_(BufferSize) PVOID  Buffer,
_In_ SIZE_T  BufferSize,
_Out_opt_ PSIZE_T  NumberOfBytesRead 
)
NTSYSCALLAPI NTSTATUS NTAPI NtResetWriteWatch ( _In_ HANDLE  ProcessHandle,
_In_ PVOID  BaseAddress,
_In_ SIZE_T  RegionSize 
)
NTSYSCALLAPI NTSTATUS NTAPI NtSetInformationVirtualMemory ( _In_ HANDLE  ProcessHandle,
_In_ VIRTUAL_MEMORY_INFORMATION_CLASS  VmInformationClass,
_In_ ULONG_PTR  NumberOfEntries,
_In_reads_(NumberOfEntries) PMEMORY_RANGE_ENTRY  VirtualAddresses,
_In_reads_bytes_(VmInformationLength) PVOID  VmInformation,
_In_ ULONG  VmInformationLength 
)
NTSYSCALLAPI NTSTATUS NTAPI NtUnlockVirtualMemory ( _In_ HANDLE  ProcessHandle,
_Inout_ PVOID *  BaseAddress,
_Inout_ PSIZE_T  RegionSize,
_In_ ULONG  MapType 
)
NTSYSCALLAPI NTSTATUS NTAPI NtUnmapViewOfSection ( _In_ HANDLE  ProcessHandle,
_In_opt_ PVOID  BaseAddress 
)
NTSYSCALLAPI NTSTATUS NTAPI NtUnmapViewOfSectionEx ( _In_ HANDLE  ProcessHandle,
_In_opt_ PVOID  BaseAddress,
_In_ ULONG  Flags 
)
NTSYSCALLAPI NTSTATUS NTAPI NtWriteVirtualMemory ( _In_ HANDLE  ProcessHandle,
_In_opt_ PVOID  BaseAddress,
_In_reads_bytes_(BufferSize) PVOID  Buffer,
_In_ SIZE_T  BufferSize,
_Out_opt_ PSIZE_T  NumberOfBytesWritten 
)