Showing:

Annotations
Diagrams
Facets
Source
Used by
Main schema Win_Filemapping_Object.xsd
Namespace http://cybox.mitre.org/objects#WinFilemappingObject-1
Annotations
 
This schema was originally developed by The MITRE Corporation. The CybOX XML Schema implementation is maintained by The MITRE Corporation and developed by the open CybOX Community. For more information, including how to get involved in the effort and how to submit change requests, please visit the CybOX website at http://cybox.mitre.org.
Element WinFilemappingObj:Windows_Filemapping
Namespace http://cybox.mitre.org/objects#WinFilemappingObject-1
Annotations
 
The Windows_Filemapping object is intended to characterize Windows file mappings.
 
For more information, please see http://msdn.microsoft.com/en-us/library/windows/desktop/aa366537(v=vs.85).aspx.
Diagram
Diagram Win_Filemapping_Object_xsd.tmp#WindowsFilemappingObjectType_Name Win_Filemapping_Object_xsd.tmp#WindowsFilemappingObjectType_File_Handle Win_Filemapping_Object_xsd.tmp#WindowsFilemappingObjectType_Handle Win_Filemapping_Object_xsd.tmp#WindowsFilemappingObjectType_Page_Protection_Value Win_Filemapping_Object_xsd.tmp#WindowsFilemappingObjectType_Page_Protection_Attribute Win_Filemapping_Object_xsd.tmp#WindowsFilemappingObjectType_Maximum_Size Win_Filemapping_Object_xsd.tmp#WindowsFilemappingObjectType_Actual_Size Win_Filemapping_Object_xsd.tmp#WindowsFilemappingObjectType_Security_Attributes Win_Filemapping_Object_xsd.tmp#WindowsFilemappingObjectType
Type WinFilemappingObj:WindowsFilemappingObjectType
Type hierarchy
Children WinFilemappingObj:Actual_Size, WinFilemappingObj:File_Handle, WinFilemappingObj:Handle, WinFilemappingObj:Maximum_Size, WinFilemappingObj:Name, WinFilemappingObj:Page_Protection_Attribute, WinFilemappingObj:Page_Protection_Value, WinFilemappingObj:Security_Attributes
Source
 
<xs:element name="Windows_Filemapping" type="WinFilemappingObj:WindowsFilemappingObjectType">
  <xs:annotation>
    <xs:documentation>The Windows_Filemapping object is intended to characterize Windows file mappings.</xs:documentation>
    <xs:documentation>For more information, please see http://msdn.microsoft.com/en-us/library/windows/desktop/aa366537(v=vs.85).aspx.</xs:documentation>
  </xs:annotation>
</xs:element>
Element WinFilemappingObj:WindowsFilemappingObjectType / WinFilemappingObj:Name
Namespace http://cybox.mitre.org/objects#WinFilemappingObject-1
Annotations
 
The Name field specifies the name of the file mapping.
Diagram
Diagram
Type StringObjectPropertyType
Source
 
<xs:element minOccurs="0" name="Name" type="cyboxCommon:StringObjectPropertyType">
  <xs:annotation>
    <xs:documentation>The Name field specifies the name of the file mapping.</xs:documentation>
  </xs:annotation>
</xs:element>
Element WinFilemappingObj:WindowsFilemappingObjectType / WinFilemappingObj:File_Handle
Namespace http://cybox.mitre.org/objects#WinFilemappingObject-1
Annotations
 
The File_Handle field specifies the Windows handle to the file from which the file mapping was created. It uses the WindowsHandleObjectType from the imported CybOX Windows Handle Object.
Diagram
Diagram
Type WindowsHandleObjectType
Source
 
<xs:element minOccurs="0" name="File_Handle" type="WinHandleObj:WindowsHandleObjectType">
  <xs:annotation>
    <xs:documentation>The File_Handle field specifies the Windows handle to the file from which the file mapping was created. It uses the WindowsHandleObjectType from the imported CybOX Windows Handle Object.</xs:documentation>
  </xs:annotation>
</xs:element>
Element WinFilemappingObj:WindowsFilemappingObjectType / WinFilemappingObj:Handle
Namespace http://cybox.mitre.org/objects#WinFilemappingObject-1
Annotations
 
The Handle field specifies the Windows handle to the file mapping. It uses the WindowsHandleObjectType from the imported CybOX Windows Handle Object.
Diagram
Diagram
Type WindowsHandleObjectType
Source
 
<xs:element minOccurs="0" name="Handle" type="WinHandleObj:WindowsHandleObjectType">
  <xs:annotation>
    <xs:documentation>The Handle field specifies the Windows handle to the file mapping. It uses the WindowsHandleObjectType from the imported CybOX Windows Handle Object.</xs:documentation>
  </xs:annotation>
</xs:element>
Element WinFilemappingObj:WindowsFilemappingObjectType / WinFilemappingObj:Page_Protection_Value
Namespace http://cybox.mitre.org/objects#WinFilemappingObject-1
Annotations
 
The Page_Protection field specifies the page protection value (i.e. PAGE_) specified for the file mapping.
Diagram
Diagram Win_Filemapping_Object_xsd.tmp#PageProtectionValueType
Type WinFilemappingObj:PageProtectionValueType
Type hierarchy
Source
 
<xs:element minOccurs="0" name="Page_Protection_Value" type="WinFilemappingObj:PageProtectionValueType">
  <xs:annotation>
    <xs:documentation>The Page_Protection field specifies the page protection value (i.e. PAGE_) specified for the file mapping.</xs:documentation>
  </xs:annotation>
</xs:element>
Element WinFilemappingObj:WindowsFilemappingObjectType / WinFilemappingObj:Page_Protection_Attribute
Namespace http://cybox.mitre.org/objects#WinFilemappingObject-1
Annotations
 
The Page_Protection_Attribute field specifies a page protection attribute (i.e. SEC_) to be used in combination with the page protection value captured in the Page_Protection_Value field. One or more such attributes can be specified using this field.
Diagram
Diagram Win_Filemapping_Object_xsd.tmp#PageProtectionAttributeType
Type WinFilemappingObj:PageProtectionAttributeType
Type hierarchy
Source
 
<xs:element maxOccurs="unbounded" minOccurs="0" name="Page_Protection_Attribute" type="WinFilemappingObj:PageProtectionAttributeType">
  <xs:annotation>
    <xs:documentation>The Page_Protection_Attribute field specifies a page protection attribute (i.e. SEC_) to be used in combination with the page protection value captured in the Page_Protection_Value field. One or more such attributes can be specified using this field.</xs:documentation>
  </xs:annotation>
</xs:element>
Element WinFilemappingObj:WindowsFilemappingObjectType / WinFilemappingObj:Maximum_Size
Namespace http://cybox.mitre.org/objects#WinFilemappingObject-1
Annotations
 
The Maximum_Size field specifies the maximum allowed size for the file mapping, in bytes. This value is typically initialized upon creation of the file mapping.
Diagram
Diagram
Type UnsignedLongObjectPropertyType
Source
 
<xs:element minOccurs="0" name="Maximum_Size" type="cyboxCommon:UnsignedLongObjectPropertyType">
  <xs:annotation>
    <xs:documentation>The Maximum_Size field specifies the maximum allowed size for the file mapping, in bytes. This value is typically initialized upon creation of the file mapping.</xs:documentation>
  </xs:annotation>
</xs:element>
Element WinFilemappingObj:WindowsFilemappingObjectType / WinFilemappingObj:Actual_Size
Namespace http://cybox.mitre.org/objects#WinFilemappingObject-1
Annotations
 
The Actual_Size field captures the actual size of the file mapping, in bytes.
Diagram
Diagram
Type UnsignedLongObjectPropertyType
Source
 
<xs:element minOccurs="0" name="Actual_Size" type="cyboxCommon:UnsignedLongObjectPropertyType">
  <xs:annotation>
    <xs:documentation>The Actual_Size field captures the actual size of the file mapping, in bytes.</xs:documentation>
  </xs:annotation>
</xs:element>
Element WinFilemappingObj:WindowsFilemappingObjectType / WinFilemappingObj:Security_Attributes
Namespace http://cybox.mitre.org/objects#WinFilemappingObject-1
Annotations
 
The Security_Attributes field specifies the Windows security attributes for the file mapping.
Diagram
Diagram
Type StringObjectPropertyType
Source
 
<xs:element minOccurs="0" name="Security_Attributes" type="cyboxCommon:StringObjectPropertyType">
  <xs:annotation>
    <xs:documentation>The Security_Attributes field specifies the Windows security attributes for the file mapping.</xs:documentation>
  </xs:annotation>
</xs:element>
Complex Type WinFilemappingObj:WindowsFilemappingObjectType
Namespace http://cybox.mitre.org/objects#WinFilemappingObject-1
Annotations
 
The WindowsFilemappingObjectType type is intended to characterize Windows file mapping objects.
Diagram
Diagram Win_Filemapping_Object_xsd.tmp#WindowsFilemappingObjectType_Name Win_Filemapping_Object_xsd.tmp#WindowsFilemappingObjectType_File_Handle Win_Filemapping_Object_xsd.tmp#WindowsFilemappingObjectType_Handle Win_Filemapping_Object_xsd.tmp#WindowsFilemappingObjectType_Page_Protection_Value Win_Filemapping_Object_xsd.tmp#WindowsFilemappingObjectType_Page_Protection_Attribute Win_Filemapping_Object_xsd.tmp#WindowsFilemappingObjectType_Maximum_Size Win_Filemapping_Object_xsd.tmp#WindowsFilemappingObjectType_Actual_Size Win_Filemapping_Object_xsd.tmp#WindowsFilemappingObjectType_Security_Attributes
Type extension of ObjectPropertiesType
Type hierarchy
Used by
Children WinFilemappingObj:Actual_Size, WinFilemappingObj:File_Handle, WinFilemappingObj:Handle, WinFilemappingObj:Maximum_Size, WinFilemappingObj:Name, WinFilemappingObj:Page_Protection_Attribute, WinFilemappingObj:Page_Protection_Value, WinFilemappingObj:Security_Attributes
Source
 
<xs:complexType name="WindowsFilemappingObjectType" mixed="false">
  <xs:annotation>
    <xs:documentation>The WindowsFilemappingObjectType type is intended to characterize Windows file mapping objects.</xs:documentation>
  </xs:annotation>
  <xs:complexContent>
    <xs:extension base="cyboxCommon:ObjectPropertiesType">
      <xs:sequence>
        <xs:element minOccurs="0" name="Name" type="cyboxCommon:StringObjectPropertyType">
          <xs:annotation>
            <xs:documentation>The Name field specifies the name of the file mapping.</xs:documentation>
          </xs:annotation>
        </xs:element>
        <xs:element minOccurs="0" name="File_Handle" type="WinHandleObj:WindowsHandleObjectType">
          <xs:annotation>
            <xs:documentation>The File_Handle field specifies the Windows handle to the file from which the file mapping was created. It uses the WindowsHandleObjectType from the imported CybOX Windows Handle Object.</xs:documentation>
          </xs:annotation>
        </xs:element>
        <xs:element minOccurs="0" name="Handle" type="WinHandleObj:WindowsHandleObjectType">
          <xs:annotation>
            <xs:documentation>The Handle field specifies the Windows handle to the file mapping. It uses the WindowsHandleObjectType from the imported CybOX Windows Handle Object.</xs:documentation>
          </xs:annotation>
        </xs:element>
        <xs:element minOccurs="0" name="Page_Protection_Value" type="WinFilemappingObj:PageProtectionValueType">
          <xs:annotation>
            <xs:documentation>The Page_Protection field specifies the page protection value (i.e. PAGE_) specified for the file mapping.</xs:documentation>
          </xs:annotation>
        </xs:element>
        <xs:element maxOccurs="unbounded" minOccurs="0" name="Page_Protection_Attribute" type="WinFilemappingObj:PageProtectionAttributeType">
          <xs:annotation>
            <xs:documentation>The Page_Protection_Attribute field specifies a page protection attribute (i.e. SEC_) to be used in combination with the page protection value captured in the Page_Protection_Value field. One or more such attributes can be specified using this field.</xs:documentation>
          </xs:annotation>
        </xs:element>
        <xs:element minOccurs="0" name="Maximum_Size" type="cyboxCommon:UnsignedLongObjectPropertyType">
          <xs:annotation>
            <xs:documentation>The Maximum_Size field specifies the maximum allowed size for the file mapping, in bytes. This value is typically initialized upon creation of the file mapping.</xs:documentation>
          </xs:annotation>
        </xs:element>
        <xs:element minOccurs="0" name="Actual_Size" type="cyboxCommon:UnsignedLongObjectPropertyType">
          <xs:annotation>
            <xs:documentation>The Actual_Size field captures the actual size of the file mapping, in bytes.</xs:documentation>
          </xs:annotation>
        </xs:element>
        <xs:element minOccurs="0" name="Security_Attributes" type="cyboxCommon:StringObjectPropertyType">
          <xs:annotation>
            <xs:documentation>The Security_Attributes field specifies the Windows security attributes for the file mapping.</xs:documentation>
          </xs:annotation>
        </xs:element>
      </xs:sequence>
    </xs:extension>
  </xs:complexContent>
</xs:complexType>
Complex Type WinFilemappingObj:PageProtectionValueType
Namespace http://cybox.mitre.org/objects#WinFilemappingObject-1
Annotations
 
The PageProtectionValueType specifies Windows file mapping page protection value types (i.e. PAGE_) via a union of the PageProtectionValueEnum type and the atomic xs:string type. Its base type is the CybOX Core BaseObjectPropertyType, for permitting complex (i.e. regular-expression based) specifications.
Diagram
Diagram
Type restriction of BaseObjectPropertyType
Type hierarchy
Used by
Source
 
<xs:complexType name="PageProtectionValueType">
  <xs:annotation>
    <xs:documentation>The PageProtectionValueType specifies Windows file mapping page protection value types (i.e. PAGE_) via a union of the PageProtectionValueEnum type and the atomic xs:string type. Its base type is the CybOX Core BaseObjectPropertyType, for permitting complex (i.e. regular-expression based) specifications.</xs:documentation>
  </xs:annotation>
  <xs:simpleContent>
    <xs:restriction base="cyboxCommon:BaseObjectPropertyType">
      <xs:simpleType>
        <xs:union memberTypes="WinFilemappingObj:PageProtectionValueEnum xs:string"/>
      </xs:simpleType>
    </xs:restriction>
  </xs:simpleContent>
</xs:complexType>
Complex Type WinFilemappingObj:PageProtectionAttributeType
Namespace http://cybox.mitre.org/objects#WinFilemappingObject-1
Annotations
 
The PageProtectionValueType specifies the optional Windows file mapping page protection attribute types (i.e. SEC_) via a union of the PageProtectionAttributeEnum type and the atomic xs:string type. Its base type is the CybOX Core BaseObjectPropertyType, for permitting complex (i.e. regular-expression based) specifications.
Diagram
Diagram
Type restriction of BaseObjectPropertyType
Type hierarchy
Used by
Source
 
<xs:complexType name="PageProtectionAttributeType">
  <xs:annotation>
    <xs:documentation>The PageProtectionValueType specifies the optional Windows file mapping page protection attribute types (i.e. SEC_) via a union of the PageProtectionAttributeEnum type and the atomic xs:string type. Its base type is the CybOX Core BaseObjectPropertyType, for permitting complex (i.e. regular-expression based) specifications.</xs:documentation>
  </xs:annotation>
  <xs:simpleContent>
    <xs:restriction base="cyboxCommon:BaseObjectPropertyType">
      <xs:simpleType>
        <xs:union memberTypes="WinFilemappingObj:PageProtectionAttributeEnum xs:string"/>
      </xs:simpleType>
    </xs:restriction>
  </xs:simpleContent>
</xs:complexType>
Simple Type WinFilemappingObj:PageProtectionValueEnum
Namespace http://cybox.mitre.org/objects#WinFilemappingObject-1
Annotations
 
The PageProtectionValueEnum is an enumeration of Windows file mapping page protection value types.
Diagram
Diagram
Type restriction of xs:string
Facets
enumeration PAGE_EXECUTE_READ 
Specifies that the mapped view of the file represented by the file mapping can be mapped for read-only, copy-on-write, or execute access.
enumeration PAGE_EXECUTE_READWRITE 
Specifies that the mapped view of the file represented by the file mapping can be mapped for read-only, copy-on-write, read/write, or execute access.
enumeration PAGE_EXECUTE_WRITECOPY 
Specifies that the mapped view of the file represented by the file mapping can be mapped for read-only, copy-on-write, or execute access. This value is equivalent to PAGE_EXECUTE_READ.
enumeration PAGE_READONLY 
Specifies that the mapped view of the file represented by the file mapping can be mapped for read-only or copy-on-write access.
enumeration PAGE_READWRITE 
Specifies that the mapped view of the file represented by the file mapping can be mapped for read-only, copy-on-write, or read/write access.
enumeration PAGE_WRITECOPY 
Specifies that the mapped view of the file represented by the file mapping can be mapped for read-only or copy-on-write access. This value is equivalent to PAGE_READONLY.
Source
 
<xs:simpleType name="PageProtectionValueEnum">
  <xs:annotation>
    <xs:documentation>The PageProtectionValueEnum is an enumeration of Windows file mapping page protection value types.</xs:documentation>
  </xs:annotation>
  <xs:restriction base="xs:string">
    <xs:enumeration value="PAGE_EXECUTE_READ">
      <xs:annotation>
        <xs:documentation>Specifies that the mapped view of the file represented by the file mapping can be mapped for read-only, copy-on-write, or execute access.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="PAGE_EXECUTE_READWRITE">
      <xs:annotation>
        <xs:documentation>Specifies that the mapped view of the file represented by the file mapping can be mapped for read-only, copy-on-write, read/write, or execute access.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="PAGE_EXECUTE_WRITECOPY">
      <xs:annotation>
        <xs:documentation>Specifies that the mapped view of the file represented by the file mapping can be mapped for read-only, copy-on-write, or execute access. This value is equivalent to PAGE_EXECUTE_READ.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="PAGE_READONLY">
      <xs:annotation>
        <xs:documentation>Specifies that the mapped view of the file represented by the file mapping can be mapped for read-only or copy-on-write access.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="PAGE_READWRITE">
      <xs:annotation>
        <xs:documentation>Specifies that the mapped view of the file represented by the file mapping can be mapped for read-only, copy-on-write, or read/write access.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="PAGE_WRITECOPY">
      <xs:annotation>
        <xs:documentation>Specifies that the mapped view of the file represented by the file mapping can be mapped for read-only or copy-on-write access. This value is equivalent to PAGE_READONLY.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
  </xs:restriction>
</xs:simpleType>
Simple Type WinFilemappingObj:PageProtectionAttributeEnum
Namespace http://cybox.mitre.org/objects#WinFilemappingObject-1
Annotations
 
The PageProtectionAttributeEnum is an enumeration of Windows file mapping page protection attribute types.
Diagram
Diagram
Type restriction of xs:string
Facets
enumeration SEC_COMMIT 
Specifies that if the file mapping is backed by the operating system paging file, that when a view of the file is mapped into a process address space, the entire range of pages is committed rather than reserved.
enumeration SEC_IMAGE 
Specifies that the file mapped by the file mapping is an executable image file.
enumeration SEC_IMAGE_NO_EXECUTE 
Specifies that the file mapped by the file mapping is an executable image file that will not be executed and the loaded image file will have no forced integrity checks run.
enumeration SEC_LARGE_PAGES 
Enables large pages to be used for file mapping objects that are backed by the operating system paging file.
enumeration SEC_NOCACHE 
Sets all pages to be non-cachable.
enumeration SEC_RESERVE 
Specifies that when a view of the file is mapped into a process address space, the entire range of pages is reserved for later use by the process rather than committed. Only valid if the file mapping is backed by the operating system paging file.
enumeration SEC_WRITECOMBINE 
Sets all pages to be write-combined.
Source
 
<xs:simpleType name="PageProtectionAttributeEnum">
  <xs:annotation>
    <xs:documentation>The PageProtectionAttributeEnum is an enumeration of Windows file mapping page protection attribute types.</xs:documentation>
  </xs:annotation>
  <xs:restriction base="xs:string">
    <xs:enumeration value="SEC_COMMIT">
      <xs:annotation>
        <xs:documentation>Specifies that if the file mapping is backed by the operating system paging file, that when a view of the file is mapped into a process address space, the entire range of pages is committed rather than reserved.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="SEC_IMAGE">
      <xs:annotation>
        <xs:documentation>Specifies that the file mapped by the file mapping is an executable image file.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="SEC_IMAGE_NO_EXECUTE">
      <xs:annotation>
        <xs:documentation>Specifies that the file mapped by the file mapping is an executable image file that will not be executed and the loaded image file will have no forced integrity checks run.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="SEC_LARGE_PAGES">
      <xs:annotation>
        <xs:documentation>Enables large pages to be used for file mapping objects that are backed by the operating system paging file.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="SEC_NOCACHE">
      <xs:annotation>
        <xs:documentation>Sets all pages to be non-cachable.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="SEC_RESERVE">
      <xs:annotation>
        <xs:documentation>Specifies that when a view of the file is mapped into a process address space, the entire range of pages is reserved for later use by the process rather than committed. Only valid if the file mapping is backed by the operating system paging file.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
    <xs:enumeration value="SEC_WRITECOMBINE">
      <xs:annotation>
        <xs:documentation>Sets all pages to be write-combined.</xs:documentation>
      </xs:annotation>
    </xs:enumeration>
  </xs:restriction>
</xs:simpleType>
XML Schema documentation generated by ® XML Editor.