# Vera Process Collector: every native (P/Invoke) API declaration
# Version:      0.3.13
# Assemblies:   Vera.ProcessCollector.Core.dll, Vera.ProcessCollector.Host.dll
# Runtime:      .NET (Windows 10/11 x64)
# Purpose:      independently-verifiable enumeration of every Windows API the
#               shipping binaries can call directly. Absence of an API here
#               means it is not called from the collector's own code.

# ==================================================================
# From CollectorEngine.cs  (Vera.ProcessCollector.Core assembly)
# ==================================================================

private const int ProcessQueryLimitedInformation = 0x1000;

[DllImport("kernel32.dll", SetLastError = true)]
private static extern IntPtr OpenProcess(int desiredAccess, bool inheritHandle, int processId);

[DllImport("kernel32.dll", SetLastError = true, CharSet = CharSet.Unicode)]
private static extern bool QueryFullProcessImageName(IntPtr hProcess, int flags, StringBuilder exeName, ref int size);

[DllImport("kernel32.dll", SetLastError = true)]
private static extern bool CloseHandle(IntPtr hObject);

// The one and only call site for OpenProcess in the entire codebase uses the
// LEAST-privileged process-access mask Windows exposes. It cannot be used to
// read another process's memory:
handle = OpenProcess(ProcessQueryLimitedInformation, false, process.Id);

# ==================================================================
# From SystemInfoCollector.cs  (Vera.ProcessCollector.Host assembly)
# ==================================================================

[DllImport("user32.dll", CharSet = CharSet.Auto)]
private static extern bool EnumDisplayDevices(string? lpDevice, uint iDevNum, ref DISPLAY_DEVICE lpDisplayDevice, uint dwFlags);

[DllImport("user32.dll", CharSet = CharSet.Auto)]
private static extern bool EnumDisplaySettings(string deviceName, int modeNum, ref DEVMODE devMode);

[DllImport("user32.dll")]
private static extern int GetDisplayConfigBufferSizes(
    uint flags, out uint numPathArrayElements, out uint numModeInfoArrayElements);

[DllImport("user32.dll")]
private static extern int QueryDisplayConfig(
    uint flags,
    ref uint numPathArrayElements, [Out] DISPLAYCONFIG_PATH_INFO[] pathArray,
    ref uint numModeInfoArrayElements, [Out] DISPLAYCONFIG_MODE_INFO[] modeInfoArray,
    IntPtr currentTopologyId);

# ==================================================================
# End of file. Seven declarations total.
# ==================================================================

# What this list makes IMPOSSIBLE for the shipping binary to do directly
# (each of these would require an API that is not declared above):

#   Read another process's memory
#     would require: ReadProcessMemory / NtReadVirtualMemory / VirtualQueryEx
#     -> not present

#   Log keystrokes
#     would require: SetWindowsHookEx / GetAsyncKeyState / GetKeyState /
#                    RegisterRawInputDevices
#     -> not present

#   Capture the screen
#     would require: BitBlt / PrintWindow / CopyFromScreen / GetWindowDC
#     -> not present

#   Read the clipboard
#     would require: OpenClipboard / GetClipboardData
#     -> not present

#   Decrypt Windows-stored credentials (browser saved passwords, DPAPI)
#     would require: CryptUnprotectData
#     -> not present. (The managed DPAPI class, ProtectedData, appears in
#        exactly one file and only round-trips Vera's own device secret;
#        that file is reproduced verbatim in evidence section 3a.)

#   Read window titles / active-window monitoring
#     would require: GetWindowText / GetForegroundWindow / SetWinEventHook
#     -> not present

#   Sniff network traffic
#     would require: pcap / raw sockets / WinDivert
#     -> not present