feat(security): add Win32 VirtualLock memory protection, CFA error diagnostics, and ShellBag OpSec

src/windows.rs

@@ -527,10 +527,56 @@ pub fn start_console_ctrl_monitor(
     }
 }
 
+/// Verriegelt einen Speicherbereich im physischen RAM (verhindert Paging in pagefile.sys / swapfile.sys).
+pub fn lock_memory(ptr: *const u8, len: usize) -> bool {
+    #[cfg(windows)]
+    {
+        extern "system" {
+            fn VirtualLock(lpaddress: *const std::ffi::c_void, dwsize: usize) -> i32;
+        }
+        if ptr.is_null() || len == 0 {
+            return false;
+        }
+        unsafe { VirtualLock(ptr as *const std::ffi::c_void, len) != 0 }
+    }
+    #[cfg(not(windows))]
+    {
+        let _ = (ptr, len);
+        false
+    }
+}
+
+/// Entriegelt einen zuvor mit `lock_memory` geschützten Speicherbereich im RAM.
+pub fn unlock_memory(ptr: *const u8, len: usize) -> bool {
+    #[cfg(windows)]
+    {
+        extern "system" {
+            fn VirtualUnlock(lpaddress: *const std::ffi::c_void, dwsize: usize) -> i32;
+        }
+        if ptr.is_null() || len == 0 {
+            return false;
+        }
+        unsafe { VirtualUnlock(ptr as *const std::ffi::c_void, len) != 0 }
+    }
+    #[cfg(not(windows))]
+    {
+        let _ = (ptr, len);
+        false
+    }
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
 
+    #[test]
+    fn test_virtual_lock_memory_lifecycle() {
+        let buffer = vec![0x42u8; 4096];
+        let _ = lock_memory(buffer.as_ptr(), buffer.len());
+        let _ = unlock_memory(buffer.as_ptr(), buffer.len());
+        assert_eq!(buffer[0], 0x42);
+    }
+
     #[test]
     fn test_find_next_available_drive() {
         let drive = find_next_available_drive().expect("Find next drive");