// File: Services/WinApi.cs using System.Runtime.InteropServices; namespace WebmrAPI.Services { public static class WinApi { public const uint PROCESS_QUERY_INFORMATION = 0x00000400; public const uint PROCESS_VM_READ = 0x00000010; public const uint PROCESS_VM_OPERATION = 0x00000008; public const uint MEM_COMMIT = 0x00001000; public const uint MEM_FREE = 0x00010000; public const uint MEM_RESERVE = 0x00002000; public const uint MEM_IMAGE = 0x01000000; public const uint MEM_MAPPED = 0x00040000; public const uint MEM_PRIVATE = 0x00020000; public static int LastError { get => Marshal.GetLastWin32Error(); } public static uint MBISize { get => (uint)Marshal.SizeOf(typeof(MEMORY_BASIC_INFORMATION)); } private static string GetHexValue(uint data) { return $"0x{data:X8}"; } public static string GetStateString(uint state) { switch (state) { case MEM_COMMIT: return "MEM_COMMIT"; case MEM_FREE: return "MEM_FREE"; case MEM_RESERVE: return "MEM_RESERVE"; default: return GetHexValue(state); } } public static string GetProtectString(uint protect) { switch (protect) { default: return GetHexValue(protect); } } public static string GetTypeString(uint type) { switch (type) { case MEM_IMAGE: return "MEM_IMAGE"; case MEM_MAPPED: return "MEM_MAPPED"; case MEM_PRIVATE: return "MEM_PRIVATE"; default: return GetHexValue(type); } } // https://learn.microsoft.com/en-us/windows/win32/api/winnt/ns-winnt-memory_basic_information [StructLayout(LayoutKind.Sequential)] public struct MEMORY_BASIC_INFORMATION { public IntPtr BaseAddress; public IntPtr AllocationBase; public uint AllocationProtect; public ushort PartitionId; public UIntPtr RegionSize; public uint State; public uint Protect; public uint Type; } // https://learn.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-openprocess [DllImport("kernel32.dll", SetLastError = true)] public static extern IntPtr OpenProcess( uint dwDesiredAccess, [MarshalAs(UnmanagedType.Bool)] bool bInheritHandle, uint dwProcessId ); // https://learn.microsoft.com/en-us/windows/win32/api/handleapi/nf-handleapi-closehandle [DllImport("kernel32.dll", SetLastError = true)] [return: MarshalAs(UnmanagedType.Bool)] public static extern bool CloseHandle(IntPtr hObject); // https://learn.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-virtualqueryex [DllImport("kernel32.dll", SetLastError = true)] public static extern int VirtualQueryEx( IntPtr hProcess, IntPtr lpAddress, out MEMORY_BASIC_INFORMATION lpBuffer, uint dwLength ); } }