SECFORCE-SharpWhispers/data/json/Delegates-DInvoke.json

{"NtCreateThreadEx": {"type": "Data.Native.NTSTATUS", "params": [{"name": "threadHandle", "type": "IntPtr", "in": false, "out": true, "ref": false}, {"name": "desiredAccess", "type": "Data.Win32.WinNT.ACCESS_MASK", "in": false, "out": false, "ref": false}, {"name": "objectAttributes", "type": "IntPtr", "in": false, "out": false, "ref": false}, {"name": "processHandle", "type": "IntPtr", "in": false, "out": false, "ref": false}, {"name": "startAddress", "type": "IntPtr", "in": false, "out": false, "ref": false}, {"name": "parameter", "type": "IntPtr", "in": false, "out": false, "ref": false}, {"name": "createSuspended", "type": "bool", "in": false, "out": false, "ref": false}, {"name": "stackZeroBits", "type": "int", "in": false, "out": false, "ref": false}, {"name": "sizeOfStack", "type": "int", "in": false, "out": false, "ref": false}, {"name": "maximumStackSize", "type": "int", "in": false, "out": false, "ref": false}, {"name": "attributeList", "type": "IntPtr", "in": false, "out": false, "ref": false}]}, "NtCreateSection": {"type": "Data.Native.NTSTATUS", "params": [{"name": "SectionHandle", "type": "IntPtr", "in": false, "out": false, "ref": true}, {"name": "DesiredAccess", "type": "uint", "in": false, "out": false, "ref": false}, {"name": "ObjectAttributes", "type": "IntPtr", "in": false, "out": false, "ref": false}, {"name": "MaximumSize", "type": "ulong", "in": false, "out": false, "ref": true}, {"name": "SectionPageProtection", "type": "uint", "in": false, "out": false, "ref": false}, {"name": "AllocationAttributes", "type": "uint", "in": false, "out": false, "ref": false}, {"name": "FileHandle", "type": "IntPtr", "in": false, "out": false, "ref": false}]}, "NtUnmapViewOfSection": {"type": "Data.Native.NTSTATUS", "params": [{"name": "hProc", "type": "IntPtr", "in": false, "out": false, "ref": false}, {"name": "baseAddr", "type": "IntPtr", "in": false, "out": false, "ref": false}]}, "NtMapViewOfSection": {"type": "Data.Native.NTSTATUS", "params": [{"name": "SectionHandle", "type": "IntPtr", "in": false, "out": false, "ref": false}, {"name": "ProcessHandle", "type": "IntPtr", "in": false, "out": false, "ref": false}, {"name": "BaseAddress", "type": "IntPtr", "in": false, "out": true, "ref": false}, {"name": "ZeroBits", "type": "IntPtr", "in": false, "out": false, "ref": false}, {"name": "CommitSize", "type": "IntPtr", "in": false, "out": false, "ref": false}, {"name": "SectionOffset", "type": "IntPtr", "in": false, "out": false, "ref": false}, {"name": "ViewSize", "type": "ulong", "in": false, "out": true, "ref": false}, {"name": "InheritDisposition", "type": "uint", "in": false, "out": false, "ref": false}, {"name": "AllocationType", "type": "uint", "in": false, "out": false, "ref": false}, {"name": "Win32Protect", "type": "uint", "in": false, "out": false, "ref": false}]}, "NtQueryInformationProcess": {"type": "UInt32", "params": [{"name": "processHandle", "type": "IntPtr", "in": false, "out": false, "ref": false}, {"name": "processInformationClass", "type": "Data.Native.PROCESSINFOCLASS", "in": false, "out": false, "ref": false}, {"name": "processInformation", "type": "IntPtr", "in": false, "out": false, "ref": false}, {"name": "processInformationLength", "type": "int", "in": false, "out": false, "ref": false}, {"name": "returnLength", "type": "UInt32", "in": false, "out": false, "ref": true}]}, "NtOpenProcess": {"type": "UInt32", "params": [{"name": "ProcessHandle", "type": "IntPtr", "in": false, "out": false, "ref": true}, {"name": "DesiredAccess", "type": "Data.Win32.Kernel32.ProcessAccessFlags", "in": false, "out": false, "ref": false}, {"name": "ObjectAttributes", "type": "Data.Native.OBJECT_ATTRIBUTES", "in": false, "out": false, "ref": true}, {"name": "ClientId", "type": "Data.Native.CLIENT_ID", "in": false, "out": false, "ref": true}]}, "NtAllocateVirtualMemory": {"type": "UInt32", "params": [{"name": "ProcessHandle", "type": "IntPtr", "in": false, "out": false, "ref": false}, {"name": "BaseAddress", "type": "IntPtr", "in": false, "out": false, "ref": true}, {"name": "ZeroBits", "type": "IntPtr", "in": false, "out": false, "ref": false}, {"name": "RegionSize", "type": "IntPtr", "in": false, "out": false, "ref": true}, {"name": "AllocationType", "type": "UInt32", "in": false, "out": false, "ref": false}, {"name": "Protect", "type": "UInt32", "in": false, "out": false, "ref": false}]}, "NtFreeVirtualMemory": {"type": "UInt32", "params": [{"name": "ProcessHandle", "type": "IntPtr", "in": false, "out": false, "ref": false}, {"name": "BaseAddress", "type": "IntPtr", "in": false, "out": false, "ref": true}, {"name": "RegionSize", "type": "IntPtr", "in": false, "out": false, "ref": true}, {"name": "FreeType", "type": "UInt32", "in": false, "out": false, "ref": false}]}, "NtQueryVirtualMemory": {"type": "UInt32", "params": [{"name": "ProcessHandle", "type": "IntPtr", "in": false, "out": false, "ref": false}, {"name": "BaseAddress", "type": "IntPtr", "in": false, "out": false, "ref": false}, {"name": "MemoryInformationClass", "type": "Data.Native.MEMORYINFOCLASS", "in": false, "out": false, "ref": false}, {"name": "MemoryInformation", "type": "IntPtr", "in": false, "out": false, "ref": false}, {"name": "MemoryInformationLength", "type": "UInt32", "in": false, "out": false, "ref": false}, {"name": "ReturnLength", "type": "UInt32", "in": false, "out": false, "ref": true}]}, "NtProtectVirtualMemory": {"type": "UInt32", "params": [{"name": "ProcessHandle", "type": "IntPtr", "in": false, "out": false, "ref": false}, {"name": "BaseAddress", "type": "IntPtr", "in": false, "out": false, "ref": true}, {"name": "RegionSize", "type": "IntPtr", "in": false, "out": false, "ref": true}, {"name": "NewProtect", "type": "UInt32", "in": false, "out": false, "ref": false}, {"name": "OldProtect", "type": "UInt32", "in": false, "out": false, "ref": true}]}, "NtWriteVirtualMemory": {"type": "UInt32", "params": [{"name": "ProcessHandle", "type": "IntPtr", "in": false, "out": false, "ref": false}, {"name": "BaseAddress", "type": "IntPtr", "in": false, "out": false, "ref": false}, {"name": "Buffer", "type": "IntPtr", "in": false, "out": false, "ref": false}, {"name": "BufferLength", "type": "UInt32", "in": false, "out": false, "ref": false}, {"name": "BytesWritten", "type": "UInt32", "in": false, "out": false, "ref": true}]}, "NtReadVirtualMemory": {"type": "UInt32", "params": [{"name": "ProcessHandle", "type": "IntPtr", "in": false, "out": false, "ref": false}, {"name": "BaseAddress", "type": "IntPtr", "in": false, "out": false, "ref": false}, {"name": "Buffer", "type": "IntPtr", "in": false, "out": false, "ref": false}, {"name": "NumberOfBytesToRead", "type": "UInt32", "in": false, "out": false, "ref": false}, {"name": "NumberOfBytesRead", "type": "UInt32", "in": false, "out": false, "ref": true}]}, "NtOpenFile": {"type": "UInt32", "params": [{"name": "FileHandle", "type": "IntPtr", "in": false, "out": false, "ref": true}, {"name": "DesiredAccess", "type": "Data.Win32.Kernel32.FileAccessFlags", "in": false, "out": false, "ref": false}, {"name": "ObjAttr", "type": "Data.Native.OBJECT_ATTRIBUTES", "in": false, "out": false, "ref": true}, {"name": "IoStatusBlock", "type": "Data.Native.IO_STATUS_BLOCK", "in": false, "out": false, "ref": true}, {"name": "ShareAccess", "type": "Data.Win32.Kernel32.FileShareFlags", "in": false, "out": false, "ref": false}, {"name": "OpenOptions", "type": "Data.Win32.Kernel32.FileOpenFlags", "in": false, "out": false, "ref": false}]}}