Memory v0.1.0

Heap allocation, virtual memory and raw memory operations.

`GetProcessHeap`

pub extern func GetProcessHeap() -> *opaque

Retrieves a handle to the default heap of the calling process.

Source

Returns: the process heap's handle, which is never released

`HeapAlloc`

pub extern func HeapAlloc(
    heap: *opaque,
    flags: uint32,
    bytes: uint
) -> *var opaque

Allocates a block of memory from a heap. The allocated memory is not movable.

Source

Parameters

Name	Type	Description
`heap`	`*opaque`	a heap handle, from `GetProcessHeap` for the process heap
`flags`	`uint32`	the call's flag bits, combined with `\|`
`bytes`	`uint`	how many bytes to take

Returns: the block's address, or null

`HeapFree`

pub extern func HeapFree(
    heap: *opaque,
    flags: uint32,
    mem: *opaque
) -> bool32

Frees a memory block allocated from a heap by the HeapAlloc or HeapReAlloc function.

Source

Parameters

Name	Type	Description
`heap`	`*opaque`	a heap handle, from `GetProcessHeap` for the process heap
`flags`	`uint32`	the call's flag bits, combined with `\|`
`mem`	`*opaque`	the block to act on

Returns: non-zero on success, and zero on failure with the reason in GetLastError

`HeapReAlloc`

pub extern func HeapReAlloc(
    heap: *opaque,
    flags: uint32,
    mem: *opaque,
    bytes: uint
) -> *var opaque

Reallocates a block of memory from a heap.

Source

Parameters

Name	Type	Description
`heap`	`*opaque`	a heap handle, from `GetProcessHeap` for the process heap
`flags`	`uint32`	the call's flag bits, combined with `\|`
`mem`	`*opaque`	the block to act on
`bytes`	`uint`	how many bytes to take

Returns: the resized block's address, or null with the original still valid

`RtlCompareMemory`

pub extern func RtlCompareMemory(
    source1: *opaque,
    source2: *opaque,
    length: uint
) -> uint

Compares two blocks of memory and returns the number of bytes that match until the first difference.

Source

Parameters

Name	Type	Description
`source1`	`*opaque`	one of the two blocks
`source2`	`*opaque`	the other
`length`	`uint`	how many bytes

Returns: how many leading bytes match

`RtlCopyMemory`

pub extern func RtlCopyMemory(
    destination: *var opaque,
    source: *opaque,
    length: uint
)

Copies a block of memory from one location to another.

Source

Parameters

Name	Type	Description
`destination`	`*var opaque`	the bytes to write
`source`	`*opaque`	the bytes to read
`length`	`uint`	how many bytes

`RtlFillMemory`

pub extern func RtlFillMemory(
    destination: *opaque,
    length: uint,
    fill: int32
)

Fills a block of memory with the specified fill value.

Source

Parameters

Name	Type	Description
`destination`	`*opaque`	the bytes to write
`length`	`uint`	how many bytes
`fill`	`int32`	the byte to write to each

`RtlZeroMemory`

pub extern func RtlZeroMemory(
    destination: *opaque,
    length: uint
)

Fills a block of memory with zeros, given a pointer to the block and the length in bytes.

Source

Parameters

Name	Type	Description
`destination`	`*opaque`	the bytes to write
`length`	`uint`	how many bytes

`MEM_COMMIT`

pub const MEM_COMMIT: uint32 = 0x00001000;

MEM_COMMIT: back the range with storage.

Source

`MEM_RESERVE`

pub const MEM_RESERVE: uint32 = 0x00002000;

MEM_RESERVE: take the address space without backing it. A reserved page cannot be touched. Touching one faults exactly as an unmapped page does, which is what makes reservation a cheap way to hold a range for later.

Source

`MEM_RESET`

pub const MEM_RESET: uint32 = 0x00080000;

MEM_RESET: the contents are no longer of interest and need not be written to the page file.

Source

`MEM_RELEASE`

pub const MEM_RELEASE: uint32 = 0x00008000;

MEM_RELEASE: give back the whole reservation, which VirtualFree requires a size of zero for.

Source

`MEM_DECOMMIT`

pub const MEM_DECOMMIT: uint32 = 0x00004000;

MEM_DECOMMIT: take back the storage but keep the reservation.

Source

`PAGE_NOACCESS`

pub const PAGE_NOACCESS: uint32 = 0x01;

PAGE_NOACCESS: the pages may not be touched at all.

Source

`PAGE_READONLY`

pub const PAGE_READONLY: uint32 = 0x02;

PAGE_READONLY: the pages may be read.

Source

`PAGE_READWRITE`

pub const PAGE_READWRITE: uint32 = 0x04;

PAGE_READWRITE: the pages may be read and written.

Source

`PAGE_EXECUTE`

pub const PAGE_EXECUTE: uint32 = 0x10;

PAGE_EXECUTE: the pages may be executed.

Source

`PAGE_EXECUTE_READ`

pub const PAGE_EXECUTE_READ: uint32 = 0x20;

PAGE_EXECUTE_READ: the pages may be executed and read.

Source

`PAGE_EXECUTE_READWRITE`

pub const PAGE_EXECUTE_READWRITE: uint32 = 0x40;

PAGE_EXECUTE_READWRITE: the pages may be executed, read and written. What a hardened process refuses, and what an exploit needs. Prefer writing through one protection and executing through another.

Source

`PAGE_GUARD`

pub const PAGE_GUARD: uint32 = 0x100;

PAGE_GUARD: the next touch raises a one-shot guard exception and then clears the flag. Combined with another protection. This is how a stack grows on Windows.

Source

`VirtualAlloc`

pub extern func VirtualAlloc(
    address: *var opaque,
    size: uint,
    allocationType: uint32,
    protect: uint32
) -> *var opaque

Reserves, commits, or changes the state of a region of pages. Returns the base address of the region, or null on failure. A null address argument lets the system choose, which it does at 64 KiB granularity rather than page granularity.

Source

Parameters

Name	Type	Description
`address`	`*var opaque`	an address in this process
`size`	`uint`	a size in bytes
`allocationType`	`uint32`	`MEM_RESERVE`, `MEM_COMMIT`, or both
`protect`	`uint32`	the page protection, as a `PAGE_*` value

Returns: the region's base address, or null — not InvalidHandleValue

`VirtualFree`

pub extern func VirtualFree(
    address: *var opaque,
    size: uint,
    freeType: uint32
) -> int32

Releases, decommits, or both, a region of pages. Returns zero on failure. MEM_RELEASE requires a size of zero and the exact base address VirtualAlloc returned; giving it anything else fails rather than releasing part of the region.

Source

Parameters

Name	Type	Description
`address`	`*var opaque`	an address in this process
`size`	`uint`	a size in bytes
`freeType`	`uint32`	`MEM_RELEASE` or `MEM_DECOMMIT`

Returns: non-zero on success

`VirtualProtect`

pub extern func VirtualProtect(
    address: *var opaque,
    size: uint,
    newProtect: uint32,
    oldProtect: *var uint32
) -> int32

Changes the protection on a region of committed pages. Writes the previous protection through oldProtect, which must not be null. Returns zero on failure.

Source

Parameters

Name	Type	Description
`address`	`*var opaque`	an address in this process
`size`	`uint`	a size in bytes
`newProtect`	`uint32`	the protection to apply
`oldProtect`	`*var uint32`	receives the protection that was in force

Returns: non-zero on success

`VirtualLock`

pub extern func VirtualLock(
    address: *var opaque,
    size: uint
) -> int32

Locks a region into physical memory so it is never written to the page file. The way to keep a secret off the disk. The process working-set limit bounds how much may be locked, so this fails for a large region rather than succeeding slowly.

Source

Parameters

Name	Type	Description
`address`	`*var opaque`	an address in this process
`size`	`uint`	a size in bytes

Returns: non-zero on success

`VirtualUnlock`

pub extern func VirtualUnlock(
    address: *var opaque,
    size: uint
) -> int32

Unlocks a region previously locked into physical memory.

Source

Parameters

Name	Type	Description
`address`	`*var opaque`	an address in this process
`size`	`uint`	a size in bytes

Returns: non-zero on success

GetRandom

Fills length bytes of buffer with unpredictable bytes.

Processes and threads

Exiting, threads, waiting and loading libraries.

Edit this page on GitHub