This schema was originally developed by The MITRE Corporation. The CybOX XML Schema implementation is maintained by The MITRE Corporation and developed by the open CybOX Community. For more information, including how to get involved in the effort and how to submit change requests, please visit the CybOX website at http://cybox.mitre.org.
Element WinMemoryPageRegionObj:Windows_Memory_Page_Region
<xs:element name="Windows_Memory_Page_Region" type="WinMemoryPageRegionObj:WindowsMemoryPageRegionObjectType"><xs:annotation><xs:documentation>The Windows_Memory_Page_Region object is intended represent a single Windows memory page region.</xs:documentation></xs:annotation></xs:element>
<xs:element minOccurs="0" name="Type" type="WinMemoryPageRegionObj:MemoryPageTypeType"><xs:annotation><xs:documentation>The Type field specifies the type of pages in the memory page region.</xs:documentation></xs:annotation></xs:element>
The Allocation_Base_Address field specifies the base address of the memory page region when the region was first allocated.
Diagram
Type
HexBinaryObjectPropertyType
Source
<xs:element minOccurs="0" name="Allocation_Base_Address" type="cyboxCommon:HexBinaryObjectPropertyType"><xs:annotation><xs:documentation>The Allocation_Base_Address field specifies the base address of the memory page region when the region was first allocated.</xs:documentation></xs:annotation></xs:element>
<xs:element minOccurs="0" name="Allocation_Protect" type="WinMemoryPageRegionObj:MemoryPageProtectionType"><xs:annotation><xs:documentation>The Allocation_Protect field specifies the memory protection option for the memory page region when the region was initially allocated.</xs:documentation></xs:annotation></xs:element>
<xs:element minOccurs="0" name="State" type="WinMemoryPageRegionObj:MemoryPageStateType"><xs:annotation><xs:documentation>The State field specifies the state of the memory pages in the region.</xs:documentation></xs:annotation></xs:element>
<xs:element minOccurs="0" name="Protect" type="WinMemoryPageRegionObj:MemoryPageProtectionType"><xs:annotation><xs:documentation>The Protect field specifies the access protection of the memory pages in the region.</xs:documentation></xs:annotation></xs:element>
Complex Type WinMemoryPageRegionObj:WindowsMemoryPageRegionObjectType
<xs:complexType name="WindowsMemoryPageRegionObjectType" mixed="false"><xs:annotation><xs:documentation>The WindowsMemoryPageRegionObjectType type is intended to characterize Windows memory page regions.</xs:documentation></xs:annotation><xs:complexContent><xs:extension base="MemoryObj:MemoryObjectType"><xs:sequence><xs:element minOccurs="0" name="Type" type="WinMemoryPageRegionObj:MemoryPageTypeType"><xs:annotation><xs:documentation>The Type field specifies the type of pages in the memory page region.</xs:documentation></xs:annotation></xs:element><xs:element minOccurs="0" name="Allocation_Base_Address" type="cyboxCommon:HexBinaryObjectPropertyType"><xs:annotation><xs:documentation>The Allocation_Base_Address field specifies the base address of the memory page region when the region was first allocated.</xs:documentation></xs:annotation></xs:element><xs:element minOccurs="0" name="Allocation_Protect" type="WinMemoryPageRegionObj:MemoryPageProtectionType"><xs:annotation><xs:documentation>The Allocation_Protect field specifies the memory protection option for the memory page region when the region was initially allocated.</xs:documentation></xs:annotation></xs:element><xs:element minOccurs="0" name="State" type="WinMemoryPageRegionObj:MemoryPageStateType"><xs:annotation><xs:documentation>The State field specifies the state of the memory pages in the region.</xs:documentation></xs:annotation></xs:element><xs:element minOccurs="0" name="Protect" type="WinMemoryPageRegionObj:MemoryPageProtectionType"><xs:annotation><xs:documentation>The Protect field specifies the access protection of the memory pages in the region.</xs:documentation></xs:annotation></xs:element></xs:sequence></xs:extension></xs:complexContent></xs:complexType>
Complex Type WinMemoryPageRegionObj:MemoryPageTypeType
MemoryPageTypeType specifies memory protection type, via a union of the MemoryPageTypeEnum type and the atomic xs:string type. Its base type is the CybOX Core BaseObjectPropertyType, for permitting complex (i.e. regular-expression based) specifications.
<xs:complexType name="MemoryPageTypeType"><xs:annotation><xs:documentation>MemoryPageTypeType specifies memory protection type, via a union of the MemoryPageTypeEnum type and the atomic xs:string type. Its base type is the CybOX Core BaseObjectPropertyType, for permitting complex (i.e. regular-expression based) specifications.</xs:documentation></xs:annotation><xs:simpleContent><xs:restriction base="cyboxCommon:BaseObjectPropertyType"><xs:simpleType><xs:union memberTypes="WinMemoryPageRegionObj:MemoryPageTypeEnum xs:string"/></xs:simpleType><xs:attribute fixed="string" name="datatype" type="cyboxCommon:DatatypeEnum"><xs:annotation><xs:documentation>This attribute is optional and specifies the expected type for the value of the specified property.</xs:documentation></xs:annotation></xs:attribute></xs:restriction></xs:simpleContent></xs:complexType>
Complex Type WinMemoryPageRegionObj:MemoryPageProtectionType
MemoryPageProtectionType specifies memory protection constant types, via a union of the MemoryPageProtectionEnum type and the atomic xs:string type. Its base type is the CybOX Core BaseObjectPropertyType, for permitting complex (i.e. regular-expression based) specifications.
<xs:complexType name="MemoryPageProtectionType"><xs:annotation><xs:documentation>MemoryPageProtectionType specifies memory protection constant types, via a union of the MemoryPageProtectionEnum type and the atomic xs:string type. Its base type is the CybOX Core BaseObjectPropertyType, for permitting complex (i.e. regular-expression based) specifications.</xs:documentation></xs:annotation><xs:simpleContent><xs:restriction base="cyboxCommon:BaseObjectPropertyType"><xs:simpleType><xs:union memberTypes="WinMemoryPageRegionObj:MemoryPageProtectionEnum xs:string"/></xs:simpleType><xs:attribute fixed="string" name="datatype" type="cyboxCommon:DatatypeEnum"><xs:annotation><xs:documentation>This attribute is optional and specifies the expected type for the value of the specified property.</xs:documentation></xs:annotation></xs:attribute></xs:restriction></xs:simpleContent></xs:complexType>
Complex Type WinMemoryPageRegionObj:MemoryPageStateType
MemoryPageStateType specifies memory protection states, via a union of the MemoryPageStateEnum type and the atomic xs:string type. Its base type is the CybOX Core BaseObjectPropertyType, for permitting complex (i.e. regular-expression based) specifications.
<xs:complexType name="MemoryPageStateType"><xs:annotation><xs:documentation>MemoryPageStateType specifies memory protection states, via a union of the MemoryPageStateEnum type and the atomic xs:string type. Its base type is the CybOX Core BaseObjectPropertyType, for permitting complex (i.e. regular-expression based) specifications.</xs:documentation></xs:annotation><xs:simpleContent><xs:restriction base="cyboxCommon:BaseObjectPropertyType"><xs:simpleType><xs:union memberTypes="WinMemoryPageRegionObj:MemoryPageStateEnum xs:string"/></xs:simpleType><xs:attribute fixed="string" name="datatype" type="cyboxCommon:DatatypeEnum"><xs:annotation><xs:documentation>This attribute is optional and specifies the expected type for the value of the specified property.</xs:documentation></xs:annotation></xs:attribute></xs:restriction></xs:simpleContent></xs:complexType>
Simple Type WinMemoryPageRegionObj:MemoryPageProtectionEnum
The MemoryPageProtectionEnum defines an enumeration of memory page protection constants. As a further reference, please see: http://msdn.microsoft.com/en-us/library/windows/desktop/aa366786(v=vs.85).aspx
Diagram
Type
restriction of xs:string
Facets
enumeration
PAGE_EXECUTE
From Microsoft: "Enables execute access to the committed region of pages. An attempt to read from or write to the committed region results in an access violation."
enumeration
PAGE_EXECUTE_READ
From Microsoft: "Enables execute or read-only access to the committed region of pages. An attempt to write to the committed region results in an access violation."
enumeration
PAGE_EXECUTE_READWRITE
From Microsoft: "Enables execute, read-only, or read/write access to the committed region of pages."
enumeration
PAGE_EXECUTE_WRITECOPY
From Microsoft: "Enables execute, read-only, or copy-on-write access to a mapped view of a file mapping object. An attempt to write to a committed copy-on-write page results in a private copy of the page being made for the process. The private page is marked as PAGE_EXECUTE_READWRITE, and the change is written to the new page."
enumeration
PAGE_NOACCESS
From Microsoft: "Disables all access to the committed region of pages. An attempt to read from, write to, or execute the committed region results in an access violation."
enumeration
PAGE_READONLY
From Microsoft: "Enables read-only access to the committed region of pages. An attempt to write to the committed region results in an access violation. If Data Execution Prevention is enabled, an attempt to execute code in the committed region results in an access violation."
enumeration
PAGE_READWRITE
From Microsoft: "Enables read-only or read/write access to the committed region of pages. If Data Execution Prevention is enabled, attempting to execute code in the committed region results in an access violation."
enumeration
PAGE_WRITECOPY
From Microsoft: "Enables read-only or copy-on-write access to a mapped view of a file mapping object. An attempt to write to a committed copy-on-write page results in a private copy of the page being made for the process. The private page is marked as PAGE_READWRITE, and the change is written to the new page. If Data Execution Prevention is enabled, attempting to execute code in the committed region results in an access violation."
Source
<xs:simpleType name="MemoryPageProtectionEnum"><xs:annotation><xs:documentation>The MemoryPageProtectionEnum defines an enumeration of memory page protection constants. As a further reference, please see: http://msdn.microsoft.com/en-us/library/windows/desktop/aa366786(v=vs.85).aspx</xs:documentation></xs:annotation><xs:restriction base="xs:string"><xs:enumeration value="PAGE_EXECUTE"><xs:annotation><xs:documentation>From Microsoft: "Enables execute access to the committed region of pages. An attempt to read from or write to the committed region results in an access violation."</xs:documentation></xs:annotation></xs:enumeration><xs:enumeration value="PAGE_EXECUTE_READ"><xs:annotation><xs:documentation>From Microsoft: "Enables execute or read-only access to the committed region of pages. An attempt to write to the committed region results in an access violation."</xs:documentation></xs:annotation></xs:enumeration><xs:enumeration value="PAGE_EXECUTE_READWRITE"><xs:annotation><xs:documentation>From Microsoft: "Enables execute, read-only, or read/write access to the committed region of pages."</xs:documentation></xs:annotation></xs:enumeration><xs:enumeration value="PAGE_EXECUTE_WRITECOPY"><xs:annotation><xs:documentation>From Microsoft: "Enables execute, read-only, or copy-on-write access to a mapped view of a file mapping object. An attempt to write to a committed copy-on-write page results in a private copy of the page being made for the process. The private page is marked as PAGE_EXECUTE_READWRITE, and the change is written to the new page."</xs:documentation></xs:annotation></xs:enumeration><xs:enumeration value="PAGE_NOACCESS"><xs:annotation><xs:documentation>From Microsoft: "Disables all access to the committed region of pages. An attempt to read from, write to, or execute the committed region results in an access violation."</xs:documentation></xs:annotation></xs:enumeration><xs:enumeration value="PAGE_READONLY"><xs:annotation><xs:documentation>From Microsoft: "Enables read-only access to the committed region of pages. An attempt to write to the committed region results in an access violation. If Data Execution Prevention is enabled, an attempt to execute code in the committed region results in an access violation."</xs:documentation></xs:annotation></xs:enumeration><xs:enumeration value="PAGE_READWRITE"><xs:annotation><xs:documentation>From Microsoft: "Enables read-only or read/write access to the committed region of pages. If Data Execution Prevention is enabled, attempting to execute code in the committed region results in an access violation."</xs:documentation></xs:annotation></xs:enumeration><xs:enumeration value="PAGE_WRITECOPY"><xs:annotation><xs:documentation>From Microsoft: "Enables read-only or copy-on-write access to a mapped view of a file mapping object. An attempt to write to a committed copy-on-write page results in a private copy of the page being made for the process. The private page is marked as PAGE_READWRITE, and the change is written to the new page. If Data Execution Prevention is enabled, attempting to execute code in the committed region results in an access violation."</xs:documentation></xs:annotation></xs:enumeration></xs:restriction></xs:simpleType>
Simple Type WinMemoryPageRegionObj:MemoryPageStateEnum
The MemoryPageStateEnum defines an enumeration of memory page states. As a further reference, please see: http://msdn.microsoft.com/en-us/library/windows/desktop/aa366775(v=vs.85).aspx
Diagram
Type
restriction of xs:string
Facets
enumeration
MEM_COMMIT
From Microsoft: "Indicates committed pages for which physical storage has been allocated, either in memory or in the paging file on disk."
enumeration
MEM_FREE
From Microsoft: "Indicates free pages not accessible to the calling process and available to be allocated. For free pages, the information in the AllocationBase, AllocationProtect, Protect, and Type members is undefined."
enumeration
MEM_RESERVE
From Microsoft: "Indicates reserved pages where a range of the process's virtual address space is reserved without any physical storage being allocated. For reserved pages, the information in the Protect member is undefined."
Source
<xs:simpleType name="MemoryPageStateEnum"><xs:annotation><xs:documentation>The MemoryPageStateEnum defines an enumeration of memory page states. As a further reference, please see: http://msdn.microsoft.com/en-us/library/windows/desktop/aa366775(v=vs.85).aspx</xs:documentation></xs:annotation><xs:restriction base="xs:string"><xs:enumeration value="MEM_COMMIT"><xs:annotation><xs:documentation>From Microsoft: "Indicates committed pages for which physical storage has been allocated, either in memory or in the paging file on disk."</xs:documentation></xs:annotation></xs:enumeration><xs:enumeration value="MEM_FREE"><xs:annotation><xs:documentation>From Microsoft: "Indicates free pages not accessible to the calling process and available to be allocated. For free pages, the information in the AllocationBase, AllocationProtect, Protect, and Type members is undefined."</xs:documentation></xs:annotation></xs:enumeration><xs:enumeration value="MEM_RESERVE"><xs:annotation><xs:documentation>From Microsoft: "Indicates reserved pages where a range of the process's virtual address space is reserved without any physical storage being allocated. For reserved pages, the information in the Protect member is undefined."</xs:documentation></xs:annotation></xs:enumeration></xs:restriction></xs:simpleType>
Simple Type WinMemoryPageRegionObj:MemoryPageTypeEnum
The MemoryPageTypeEnum defines an enumeration of memory page types. As a further reference, please see: http://msdn.microsoft.com/en-us/library/windows/desktop/aa366775(v=vs.85).aspx
Diagram
Type
restriction of xs:string
Facets
enumeration
MEM_IMAGE
From Microsoft: "Indicates that the memory pages within the region are mapped into the view of an image section."
enumeration
MEM_MAPPED
From Microsoft: "Indicates that the memory pages within the region are mapped into the view of a section."
enumeration
MEM_PRIVATE
From Microsoft: "Indicates that the memory pages within the region are private (that is, not shared by other processes)."
Source
<xs:simpleType name="MemoryPageTypeEnum"><xs:annotation><xs:documentation>The MemoryPageTypeEnum defines an enumeration of memory page types. As a further reference, please see: http://msdn.microsoft.com/en-us/library/windows/desktop/aa366775(v=vs.85).aspx</xs:documentation></xs:annotation><xs:restriction base="xs:string"><xs:enumeration value="MEM_IMAGE"><xs:annotation><xs:documentation>From Microsoft: "Indicates that the memory pages within the region are mapped into the view of an image section."</xs:documentation></xs:annotation></xs:enumeration><xs:enumeration value="MEM_MAPPED"><xs:annotation><xs:documentation>From Microsoft: "Indicates that the memory pages within the region are mapped into the view of a section."</xs:documentation></xs:annotation></xs:enumeration><xs:enumeration value="MEM_PRIVATE"><xs:annotation><xs:documentation>From Microsoft: "Indicates that the memory pages within the region are private (that is, not shared by other processes)."</xs:documentation></xs:annotation></xs:enumeration></xs:restriction></xs:simpleType>
<xs:attribute fixed="string" name="datatype" type="cyboxCommon:DatatypeEnum"><xs:annotation><xs:documentation>This attribute is optional and specifies the expected type for the value of the specified property.</xs:documentation></xs:annotation></xs:attribute>
<xs:attribute fixed="string" name="datatype" type="cyboxCommon:DatatypeEnum"><xs:annotation><xs:documentation>This attribute is optional and specifies the expected type for the value of the specified property.</xs:documentation></xs:annotation></xs:attribute>
<xs:attribute fixed="string" name="datatype" type="cyboxCommon:DatatypeEnum"><xs:annotation><xs:documentation>This attribute is optional and specifies the expected type for the value of the specified property.</xs:documentation></xs:annotation></xs:attribute>