ae.sys.windows.process

Windows process utility code.

Members

Aliases

CreateProcessWithTokenWFunc
alias CreateProcessWithTokenWFunc = BOOL function(HANDLE hToken, DWORD dwLogonFlags, LPCWSTR lpApplicationName, LPWSTR lpCommandLine, DWORD dwCreationFlags, LPVOID lpEnvironment, LPCWSTR lpCurrentDirectory, LPSTARTUPINFOW lpStartupInfo, LPPROCESS_INFORMATION lpProcessInfo)
Undocumented in source.
CreatedProcess
alias CreatedProcess = RefCounted!CreatedProcessImpl
Undocumented in source.
HeapIterator
alias HeapIterator = ToolhelpIterator!(HEAPLIST32, Heap32ListFirst, Heap32ListNext)
Undocumented in source.
ModuleIterator
alias ModuleIterator = ToolhelpIterator!(MODULEENTRY32, Module32First, Module32Next)
Undocumented in source.
ProcessIterator
alias ProcessIterator = ToolhelpIterator!(PROCESSENTRY32, Process32First, Process32Next)
Undocumented in source.
RemoteAddress
alias RemoteAddress = ubyte*
Undocumented in source.
ThreadIterator
alias ThreadIterator = ToolhelpIterator!(THREADENTRY32, Thread32First, Thread32Next)
Undocumented in source.
ToolhelpSnapshot
alias ToolhelpSnapshot = RefCounted!ToolhelpSnapshotImpl
Undocumented in source.
wenforce
alias wenforce = ae.sys.windows.exception.wenforce
Undocumented in source.

Functions

createDesktopUserProcess
CreatedProcess createDesktopUserProcess(string applicationName, string commandLine, STARTUPINFOW si)

Create a non-elevated process, if the current process is elevated.

createProcess
CreatedProcess createProcess(string applicationName, string commandLine, STARTUPINFOW si)
Undocumented in source. Be warned that the author may not have intended to support it.
createProcess
CreatedProcess createProcess(string applicationName, string commandLine, string currentDirectory, STARTUPINFOW si)
Undocumented in source. Be warned that the author may not have intended to support it.
createToolhelpSnapshot
ToolhelpSnapshot createToolhelpSnapshot(DWORD dwFlags, DWORD th32ProcessID)
Undocumented in source. Be warned that the author may not have intended to support it.
readProcessMemory
void readProcessMemory(HANDLE h, RemoteAddress addr, void[] data)
Undocumented in source. Be warned that the author may not have intended to support it.
readProcessVar
void readProcessVar(HANDLE h, RemoteAddress addr, T* v)
Undocumented in source. Be warned that the author may not have intended to support it.
readProcessVar
T readProcessVar(HANDLE h, RemoteAddress addr)
Undocumented in source. Be warned that the author may not have intended to support it.
writeProcessMemory
void writeProcessMemory(HANDLE h, RemoteAddress addr, const(void)[] data)
Undocumented in source. Be warned that the author may not have intended to support it.
writeProcessVar
void writeProcessVar(HANDLE h, RemoteAddress addr, T v)
Undocumented in source. Be warned that the author may not have intended to support it.

Manifest constants

TOKEN_ADJUST_SESSIONID
enum TOKEN_ADJUST_SESSIONID;
Undocumented in source.

Properties

heaps
HeapIterator heaps [@property getter]
Undocumented in source. Be warned that the author may not have intended to support it.
modules
ModuleIterator modules [@property getter]
Undocumented in source. Be warned that the author may not have intended to support it.
processes
ProcessIterator processes [@property getter]
Undocumented in source. Be warned that the author may not have intended to support it.
threads
ThreadIterator threads [@property getter]
Undocumented in source. Be warned that the author may not have intended to support it.

Structs

CreatedProcessImpl
struct CreatedProcessImpl
Undocumented in source.
ProcessWatcher
struct ProcessWatcher
Undocumented in source.
RemoteProcessVarImpl
struct RemoteProcessVarImpl(T)
Undocumented in source.
ToolhelpIterator
struct ToolhelpIterator(STRUCT, alias FirstFunc, alias NextFunc)
Undocumented in source.
ToolhelpSnapshotImpl
struct ToolhelpSnapshotImpl
Undocumented in source.

Templates

RemoteProcessVar
template RemoteProcessVar(T)

Binding to a variable located in another process. Automatically allocates and deallocates remote memory. Use .read() and .write() to update local/remote data.

Meta

License

This Source Code Form is subject to the terms of the Mozilla Public License, v. 2.0. If a copy of the MPL was not distributed with this file, You can obtain one at http://mozilla.org/MPL/2.0/.

Authors

Vladimir Panteleev <vladimir@thecybershadow.net>