objects.Win_Filemapping_Object.xsd Maven / Gradle / Ivy
The newest version!
This schema was originally developed by The MITRE Corporation. The CybOX XML Schema implementation is maintained by The MITRE Corporation and developed by the open CybOX Community. For more information, including how to get involved in the effort and how to submit change requests, please visit the CybOX website at http://cybox.mitre.org.
Win_Filemapping_Object
1.0
01/22/2014
The following specifies the fields and types that compose this defined CybOX Object type. Each defined object is an extension of the abstract ObjectPropertiesType, defined in CybOX Common. For more information on this extension mechanism, please see the CybOX Specification. This document is intended for developers and assumes some familiarity with XML.
Copyright (c) 2012-2014, The MITRE Corporation. All rights reserved. The contents of this file are subject to the terms of the CybOX License located at http://cybox.mitre.org/about/termsofuse.html. See the CybOX License for the specific language governing permissions and limitations for use of this schema. When distributing copies of the CybOX Schema, this license header must be included.
The Windows_Filemapping object is intended to characterize Windows file mappings.
For more information, please see http://msdn.microsoft.com/en-us/library/windows/desktop/aa366537(v=vs.85).aspx.
The WindowsFilemappingObjectType type is intended to characterize Windows file mapping objects.
The Name field specifies the name of the file mapping.
The File_Handle field specifies the Windows handle to the file from which the file mapping was created. It uses the WindowsHandleObjectType from the imported CybOX Windows Handle Object.
The Handle field specifies the Windows handle to the file mapping. It uses the WindowsHandleObjectType from the imported CybOX Windows Handle Object.
The Page_Protection field specifies the page protection value (i.e. PAGE_) specified for the file mapping.
The Page_Protection_Attribute field specifies a page protection attribute (i.e. SEC_) to be used in combination with the page protection value captured in the Page_Protection_Value field. One or more such attributes can be specified using this field.
The Maximum_Size field specifies the maximum allowed size for the file mapping, in bytes. This value is typically initialized upon creation of the file mapping.
The Actual_Size field captures the actual size of the file mapping, in bytes.
The Security_Attributes field specifies the Windows security attributes for the file mapping.
The PageProtectionValueType specifies Windows file mapping page protection value types (i.e. PAGE_) via a union of the PageProtectionValueEnum type and the atomic xs:string type. Its base type is the CybOX Core BaseObjectPropertyType, for permitting complex (i.e. regular-expression based) specifications.
The PageProtectionValueEnum is an enumeration of Windows file mapping page protection value types.
Specifies that the mapped view of the file represented by the file mapping can be mapped for read-only, copy-on-write, or execute access.
Specifies that the mapped view of the file represented by the file mapping can be mapped for read-only, copy-on-write, read/write, or execute access.
Specifies that the mapped view of the file represented by the file mapping can be mapped for read-only, copy-on-write, or execute access. This value is equivalent to PAGE_EXECUTE_READ.
Specifies that the mapped view of the file represented by the file mapping can be mapped for read-only or copy-on-write access.
Specifies that the mapped view of the file represented by the file mapping can be mapped for read-only, copy-on-write, or read/write access.
Specifies that the mapped view of the file represented by the file mapping can be mapped for read-only or copy-on-write access. This value is equivalent to PAGE_READONLY.
The PageProtectionValueType specifies the optional Windows file mapping page protection attribute types (i.e. SEC_) via a union of the PageProtectionAttributeEnum type and the atomic xs:string type. Its base type is the CybOX Core BaseObjectPropertyType, for permitting complex (i.e. regular-expression based) specifications.
The PageProtectionAttributeEnum is an enumeration of Windows file mapping page protection attribute types.
Specifies that if the file mapping is backed by the operating system paging file, that when a view of the file is mapped into a process address space, the entire range of pages is committed rather than reserved.
Specifies that the file mapped by the file mapping is an executable image file.
Specifies that the file mapped by the file mapping is an executable image file that will not be executed and the loaded image file will have no forced integrity checks run.
Enables large pages to be used for file mapping objects that are backed by the operating system paging file.
Sets all pages to be non-cachable.
Specifies that when a view of the file is mapped into a process address space, the entire range of pages is reserved for later use by the process rather than committed. Only valid if the file mapping is backed by the operating system paging file.
Sets all pages to be write-combined.